@forestadmin/agent-bff 1.31.0 → 1.33.0

package/dist/activity-log/activity-logs-creator.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createPendingActivityLog;
+exports.markActivityLog = markActivityLog;
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+const api_key_middleware_1 = require("../api-key/api-key-middleware");
+const forest_server_token_middleware_1 = require("../auth/forest-server-token-middleware");
+const bff_http_error_1 = require("../http/bff-http-error");
+const bff_local_errors_1 = require("../http/bff-local-errors");
+/**
+ * Fail policy for the audit trail, keyed by action type: a write whose activity log cannot be
+ * created is blocked (no unaudited side effect), while a read proceeds with a warning (an audit
+ * store outage must not take down the read surface).
+ *
+ * One case is arbitrated by the cause instead of the action type: an authorization refusal (403)
+ * propagates for reads too — the read itself is not authorized either.
+ */
+const ACTION_TO_TYPE = {
+    index: 'read',
+    search: 'read',
+    filter: 'read',
+    listRelatedData: 'read',
+    action: 'write',
+};
+const MAX_STATUS_ATTEMPTS = 5;
+const STATUS_RETRY_DELAY_MS = 500;
+const NO_RENDERING_MESSAGE = 'This request carries no usable rendering';
+function describeCause(error) {
+    return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+}
+const FORBIDDEN = 403;
+const UNAUTHORIZED = 401;
+const SERVER_ERROR = 500;
+/** Not found: the document may not be visible yet. 0: unreachable. 408: timeout. 429: throttled. */
+const RETRYABLE_TRANSITION_STATUSES = new Set([0, 404, 408, 429]);
+const AUDIT_ENDPOINT_ABSENT_STATUSES = new Set([404, 501]);
+const NO_AUDIT_ENDPOINT_MESSAGE = 'The Forest server does not expose the endpoint the activity log is written through, so the ' +
+    'operation was not performed';
+/**
+ * A 403 only. A 401 is not the caller being refused: the bearer the BFF audits with is minted by
+ * the Forest server and cached, so a 401 says that token expired — answering the caller with
+ * `audit_not_authorized` would refuse a read the fail-open policy lets through.
+ */
+function isAuthorizationRefusal(error) {
+    return error instanceof forestadmin_client_1.HttpError && error.status === FORBIDDEN;
+}
+function isExpiredAuditCredential(error) {
+    return error instanceof forestadmin_client_1.HttpError && error.status === UNAUTHORIZED;
+}
+/**
+ * A Forest server that does not serve the activity-log endpoint at all, rather than one failing to
+ * answer it. No retry can make the route appear, so the caller must not be handed a `Retry-After`
+ * it would keep honouring on every write.
+ */
+function isAuditEndpointAbsent(error) {
+    return error instanceof forestadmin_client_1.HttpError && AUDIT_ENDPOINT_ABSENT_STATUSES.has(error.status);
+}
+/**
+ * What locates the failure for support, and nothing else: the credential, the record ids and the
+ * label are the payload this must never carry.
+ */
+function auditIdentifiers(ctx, context) {
+    const renderingId = (0, forest_server_token_middleware_1.resolveRenderingId)(ctx);
+    return {
+        ...(renderingId === undefined ? {} : { renderingId }),
+        ...(context?.collectionName === undefined ? {} : { collectionName: context.collectionName }),
+    };
+}
+/** An empty string is an answer, not a value: it locates no document, so it fails the guard. */
+function isPresent(value) {
+    return value !== null && value !== undefined && value !== '';
+}
+/**
+ * The status transition reads both the id and the index, so an answer carrying only an id strands
+ * the entry `pending`: the fail-closed policy has to engage here, not asynchronously afterwards.
+ */
+function isTransitionable(activityLog) {
+    return isPresent(activityLog?.id) && isPresent(activityLog?.attributes?.index);
+}
+/**
+ * A credential this deployment never mints is a degradation the Forest server declares by sending
+ * none (`api-key/api-key-client.ts`), so it warns; only a resolution that actually failed is an
+ * error. The single report for either: `with-activity-log` states nothing of its own, which used to
+ * double every line of the read path.
+ */
+function reportUnresolvedCredentials({ ctx, action, context, logger, error, }) {
+    const identifiers = { ...auditIdentifiers(ctx, context), cause: describeCause(error) };
+    if ((0, bff_local_errors_1.isUnretryableAuditFailure)(error)) {
+        logger('Warn', `Activity log for '${action}' was not created: this deployment has no credential to write ` +
+            'it with', identifiers);
+        return;
+    }
+    logger('Error', `Activity log for '${action}' has no credentials to be created with`, identifiers);
+}
+async function resolveCredentials(ctx) {
+    const renderingId = (0, forest_server_token_middleware_1.resolveRenderingId)(ctx);
+    if (renderingId === undefined)
+        throw (0, bff_http_error_1.sessionExpired)(NO_RENDERING_MESSAGE);
+    return {
+        forestServerToken: await (0, forest_server_token_middleware_1.resolveForestServerToken)(ctx),
+        renderingId: String(renderingId),
+    };
+}
+async function createPendingActivityLog({ ctx, service, action, context, logger, }) {
+    const type = ACTION_TO_TYPE[action];
+    let credentials;
+    try {
+        credentials = await resolveCredentials(ctx);
+    }
+    catch (error) {
+        reportUnresolvedCredentials({ ctx, action, context, logger, error });
+        if (type === 'write')
+            throw error;
+        return null;
+    }
+    const { forestServerToken, renderingId } = credentials;
+    let activityLog;
+    try {
+        activityLog = await service.createMcpActivityLog({
+            forestServerToken,
+            renderingId,
+            action,
+            type,
+            collectionName: context?.collectionName,
+            recordId: context?.recordId,
+            recordIds: context?.recordIds,
+            label: context?.label,
+        });
+    }
+    catch (error) {
+        logger('Error', `Activity log for '${action}' could not be created`, {
+            ...auditIdentifiers(ctx, context),
+            cause: describeCause(error),
+        });
+        if (isAuthorizationRefusal(error))
+            throw (0, bff_local_errors_1.auditNotAuthorized)();
+        if (isExpiredAuditCredential(error))
+            (0, api_key_middleware_1.invalidateApiKeyIdentity)(ctx);
+        if (type === 'write') {
+            throw isAuditEndpointAbsent(error)
+                ? (0, bff_local_errors_1.auditUnavailable)(undefined, NO_AUDIT_ENDPOINT_MESSAGE)
+                : (0, bff_local_errors_1.auditUnavailable)(bff_local_errors_1.AUDIT_RETRY_AFTER_SECONDS);
+        }
+        return null;
+    }
+    if (!isTransitionable(activityLog)) {
+        logger('Error', `Activity log for '${action}' could not be created: the server answered with no activity ` +
+            'log id or index, so the audit store dropped the write', auditIdentifiers(ctx, context));
+        if (type === 'write')
+            throw (0, bff_local_errors_1.auditUnavailable)(bff_local_errors_1.AUDIT_RETRY_AFTER_SECONDS);
+        return null;
+    }
+    return { activityLog, forestServerToken };
+}
+/**
+ * The transition is fired after the response, so nothing retries it downstream: an entry whose
+ * transition is dropped stays `pending` for good and skews the action-failure statistics. Retried
+ * are the failures a later attempt can land — the document not existing yet, a timeout, a throttle,
+ * an unreachable server (status 0) and any 5xx — plus a transport failure the client rethrows raw,
+ * which carries no status at all. A refusal or a malformed request is left to fail at once.
+ */
+function isRetryableTransitionFailure(error) {
+    if (!(error instanceof forestadmin_client_1.HttpError))
+        return true;
+    return error.status >= SERVER_ERROR || RETRYABLE_TRANSITION_STATUSES.has(error.status);
+}
+async function updateStatus(options, attempt = 1) {
+    const { service, pending, status, logger } = options;
+    try {
+        await service.updateActivityLogStatus({
+            forestServerToken: pending.forestServerToken,
+            activityLog: pending.activityLog,
+            status,
+        });
+    }
+    catch (error) {
+        if (isRetryableTransitionFailure(error) && attempt < MAX_STATUS_ATTEMPTS) {
+            logger('Debug', `Activity log status transition failed, retrying it`, {
+                attempt,
+                attempts: MAX_STATUS_ATTEMPTS,
+                cause: describeCause(error),
+            });
+            await new Promise(resolve => {
+                // Unreferenced: a pending retry must not outlive the shutdown grace the drainer enforces.
+                setTimeout(resolve, STATUS_RETRY_DELAY_MS).unref();
+            });
+            await updateStatus(options, attempt + 1);
+            return;
+        }
+        throw error;
+    }
+}
+/**
+ * Fire-and-forget on purpose: the caller's response must not wait for the audit store. The drainer
+ * holds the promise so a shutdown can wait for it instead.
+ */
+function markActivityLog(options) {
+    const { drainer, status, logger } = options;
+    drainer
+        .track(() => updateStatus(options), `'${status}' transition of the activity log ${options.pending.activityLog.id}`)
+        .catch(error => {
+        logger('Error', `Failed to mark the activity log as '${status}'`, {
+            activityLogId: options.pending.activityLog.id,
+            index: options.pending.activityLog.attributes?.index,
+            cause: describeCause(error),
+        });
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aXZpdHktbG9ncy1jcmVhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGl2aXR5LWxvZy9hY3Rpdml0eS1sb2dzLWNyZWF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUF1TUEsMkNBb0VDO0FBMERELDBDQWVDO0FBMVVELHdFQUE0RDtBQUU1RCxzRUFBeUU7QUFDekUsMkZBR2dEO0FBQ2hELDJEQUF3RDtBQUN4RCwrREFLa0M7QUFRbEM7Ozs7Ozs7R0FPRztBQUNILE1BQU0sY0FBYyxHQUFrRDtJQUNwRSxLQUFLLEVBQUUsTUFBTTtJQUNiLE1BQU0sRUFBRSxNQUFNO0lBQ2QsTUFBTSxFQUFFLE1BQU07SUFDZCxlQUFlLEVBQUUsTUFBTTtJQUN2QixNQUFNLEVBQUUsT0FBTztDQUNoQixDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLENBQUM7QUFDOUIsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLENBQUM7QUFFbEMsTUFBTSxvQkFBb0IsR0FBRywwQ0FBMEMsQ0FBQztBQStCeEUsU0FBUyxhQUFhLENBQUMsS0FBYztJQUNuQyxPQUFPLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNwRixDQUFDO0FBRUQsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDO0FBQ3RCLE1BQU0sWUFBWSxHQUFHLEdBQUcsQ0FBQztBQUN6QixNQUFNLFlBQVksR0FBRyxHQUFHLENBQUM7QUFDekIsb0dBQW9HO0FBQ3BHLE1BQU0sNkJBQTZCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBQ2xFLE1BQU0sOEJBQThCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUUzRCxNQUFNLHlCQUF5QixHQUM3Qiw2RkFBNkY7SUFDN0YsNkJBQTZCLENBQUM7QUFFaEM7Ozs7R0FJRztBQUNILFNBQVMsc0JBQXNCLENBQUMsS0FBYztJQUM1QyxPQUFPLEtBQUssWUFBWSw4QkFBUyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDO0FBQ2xFLENBQUM7QUFFRCxTQUFTLHdCQUF3QixDQUFDLEtBQWM7SUFDOUMsT0FBTyxLQUFLLFlBQVksOEJBQVMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQztBQUNyRSxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQVMscUJBQXFCLENBQUMsS0FBYztJQUMzQyxPQUFPLEtBQUssWUFBWSw4QkFBUyxJQUFJLDhCQUE4QixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDeEYsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsZ0JBQWdCLENBQ3ZCLEdBQVksRUFDWixPQUE0QjtJQUU1QixNQUFNLFdBQVcsR0FBRyxJQUFBLG1EQUFrQixFQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRTVDLE9BQU87UUFDTCxHQUFHLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDO1FBQ3JELEdBQUcsQ0FBQyxPQUFPLEVBQUUsY0FBYyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7S0FDN0YsQ0FBQztBQUNKLENBQUM7QUFFRCxnR0FBZ0c7QUFDaEcsU0FBUyxTQUFTLENBQUMsS0FBZ0M7SUFDakQsT0FBTyxLQUFLLEtBQUssSUFBSSxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztBQUMvRCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsU0FBUyxnQkFBZ0IsQ0FBQyxXQUFnQztJQUN4RCxPQUFPLFNBQVMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLElBQUksU0FBUyxDQUFDLFdBQVcsRUFBRSxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDakYsQ0FBQztBQVVEOzs7OztHQUtHO0FBQ0gsU0FBUywyQkFBMkIsQ0FBQyxFQUNuQyxHQUFHLEVBQ0gsTUFBTSxFQUNOLE9BQU8sRUFDUCxNQUFNLEVBQ04sS0FBSyxHQUN1QjtJQUM1QixNQUFNLFdBQVcsR0FBRyxFQUFFLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztJQUV2RixJQUFJLElBQUEsNENBQXlCLEVBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxNQUFNLENBQ0osTUFBTSxFQUNOLHFCQUFxQixNQUFNLGdFQUFnRTtZQUN6RixTQUFTLEVBQ1gsV0FBVyxDQUNaLENBQUM7UUFFRixPQUFPO0lBQ1QsQ0FBQztJQUVELE1BQU0sQ0FDSixPQUFPLEVBQ1AscUJBQXFCLE1BQU0seUNBQXlDLEVBQ3BFLFdBQVcsQ0FDWixDQUFDO0FBQ0osQ0FBQztBQUVELEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxHQUFZO0lBQzVDLE1BQU0sV0FBVyxHQUFHLElBQUEsbURBQWtCLEVBQUMsR0FBRyxDQUFDLENBQUM7SUFFNUMsSUFBSSxXQUFXLEtBQUssU0FBUztRQUFFLE1BQU0sSUFBQSwrQkFBYyxFQUFDLG9CQUFvQixDQUFDLENBQUM7SUFFMUUsT0FBTztRQUNMLGlCQUFpQixFQUFFLE1BQU0sSUFBQSx5REFBd0IsRUFBQyxHQUFHLENBQUM7UUFDdEQsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUM7S0FDakMsQ0FBQztBQUNKLENBQUM7QUFFYyxLQUFLLFVBQVUsd0JBQXdCLENBQUMsRUFDckQsR0FBRyxFQUNILE9BQU8sRUFDUCxNQUFNLEVBQ04sT0FBTyxFQUNQLE1BQU0sR0FDMEI7SUFDaEMsTUFBTSxJQUFJLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRXBDLElBQUksV0FBNkIsQ0FBQztJQUVsQyxJQUFJLENBQUM7UUFDSCxXQUFXLEdBQUcsTUFBTSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLDJCQUEyQixDQUFDLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFFckUsSUFBSSxJQUFJLEtBQUssT0FBTztZQUFFLE1BQU0sS0FBSyxDQUFDO1FBRWxDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsR0FBRyxXQUFXLENBQUM7SUFFdkQsSUFBSSxXQUFnQyxDQUFDO0lBRXJDLElBQUksQ0FBQztRQUNILFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQztZQUMvQyxpQkFBaUI7WUFDakIsV0FBVztZQUNYLE1BQU07WUFDTixJQUFJO1lBQ0osY0FBYyxFQUFFLE9BQU8sRUFBRSxjQUFjO1lBQ3ZDLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUTtZQUMzQixTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVM7WUFDN0IsS0FBSyxFQUFFLE9BQU8sRUFBRSxLQUFLO1NBQ3RCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsTUFBTSx3QkFBd0IsRUFBRTtZQUNuRSxHQUFHLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUM7WUFDakMsS0FBSyxFQUFFLGFBQWEsQ0FBQyxLQUFLLENBQUM7U0FDNUIsQ0FBQyxDQUFDO1FBRUgsSUFBSSxzQkFBc0IsQ0FBQyxLQUFLLENBQUM7WUFBRSxNQUFNLElBQUEscUNBQWtCLEdBQUUsQ0FBQztRQUM5RCxJQUFJLHdCQUF3QixDQUFDLEtBQUssQ0FBQztZQUFFLElBQUEsNkNBQXdCLEVBQUMsR0FBRyxDQUFDLENBQUM7UUFFbkUsSUFBSSxJQUFJLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDckIsTUFBTSxxQkFBcUIsQ0FBQyxLQUFLLENBQUM7Z0JBQ2hDLENBQUMsQ0FBQyxJQUFBLG1DQUFnQixFQUFDLFNBQVMsRUFBRSx5QkFBeUIsQ0FBQztnQkFDeEQsQ0FBQyxDQUFDLElBQUEsbUNBQWdCLEVBQUMsNENBQXlCLENBQUMsQ0FBQztRQUNsRCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDbkMsTUFBTSxDQUNKLE9BQU8sRUFDUCxxQkFBcUIsTUFBTSwrREFBK0Q7WUFDeEYsdURBQXVELEVBQ3pELGdCQUFnQixDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FDL0IsQ0FBQztRQUVGLElBQUksSUFBSSxLQUFLLE9BQU87WUFBRSxNQUFNLElBQUEsbUNBQWdCLEVBQUMsNENBQXlCLENBQUMsQ0FBQztRQUV4RSxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxPQUFPLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLENBQUM7QUFDNUMsQ0FBQztBQVVEOzs7Ozs7R0FNRztBQUNILFNBQVMsNEJBQTRCLENBQUMsS0FBYztJQUNsRCxJQUFJLENBQUMsQ0FBQyxLQUFLLFlBQVksOEJBQVMsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRS9DLE9BQU8sS0FBSyxDQUFDLE1BQU0sSUFBSSxZQUFZLElBQUksNkJBQTZCLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUN6RixDQUFDO0FBRUQsS0FBSyxVQUFVLFlBQVksQ0FBQyxPQUErQixFQUFFLE9BQU8sR0FBRyxDQUFDO0lBQ3RFLE1BQU0sRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUM7SUFFckQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLENBQUMsdUJBQXVCLENBQUM7WUFDcEMsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLGlCQUFpQjtZQUM1QyxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7WUFDaEMsTUFBTTtTQUNQLENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLEdBQUcsbUJBQW1CLEVBQUUsQ0FBQztZQUN6RSxNQUFNLENBQUMsT0FBTyxFQUFFLG9EQUFvRCxFQUFFO2dCQUNwRSxPQUFPO2dCQUNQLFFBQVEsRUFBRSxtQkFBbUI7Z0JBQzdCLEtBQUssRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDO2FBQzVCLENBQUMsQ0FBQztZQUVILE1BQU0sSUFBSSxPQUFPLENBQU8sT0FBTyxDQUFDLEVBQUU7Z0JBQ2hDLDBGQUEwRjtnQkFDMUYsVUFBVSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3JELENBQUMsQ0FBQyxDQUFDO1lBRUgsTUFBTSxZQUFZLENBQUMsT0FBTyxFQUFFLE9BQU8sR0FBRyxDQUFDLENBQUMsQ0FBQztZQUV6QyxPQUFPO1FBQ1QsQ0FBQztRQUVELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixlQUFlLENBQUMsT0FBK0I7SUFDN0QsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDO0lBRTVDLE9BQU87U0FDSixLQUFLLENBQ0osR0FBRyxFQUFFLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxFQUMzQixJQUFJLE1BQU0sb0NBQW9DLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsRUFBRSxDQUMvRTtTQUNBLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRTtRQUNiLE1BQU0sQ0FBQyxPQUFPLEVBQUUsdUNBQXVDLE1BQU0sR0FBRyxFQUFFO1lBQ2hFLGFBQWEsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFO1lBQzdDLEtBQUssRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsS0FBSztZQUNwRCxLQUFLLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQztTQUM1QixDQUFDLENBQUM7SUFDTCxDQUFDLENBQUMsQ0FBQztBQUNQLENBQUMifQ==

package/dist/activity-log/activity-logs-service.d.ts

@@ -0,0 +1,18 @@
+import type { ActivityLogResponse, CreateActivityLogParams, UpdateActivityLogStatusParams } from '@forestadmin/forestadmin-client';
+export declare const APPLICATION_SOURCE_HEADER = "Forest-Application-Source";
+export declare const BFF_APPLICATION_SOURCE = "BFF";
+/**
+ * The slice of `ActivityLogsService` the BFF uses. Named so a fake can stand in for the two calls
+ * without carrying the rest of the Forest client.
+ */
+export interface ActivityLogsWriter {
+    createMcpActivityLog(params: CreateActivityLogParams): Promise<ActivityLogResponse>;
+    updateActivityLogStatus(params: UpdateActivityLogStatusParams): Promise<void>;
+}
+/**
+ * Its own instance rather than the client `oauth/forest-server-client.ts` already holds:
+ * `ForestAdminClientOptions` carries no `headers`, so that one cannot tell the server which channel
+ * wrote the log.
+ */
+export default function createBffActivityLogsService(forestServerUrl: string): ActivityLogsWriter;
+//# sourceMappingURL=activity-logs-service.d.ts.map

package/dist/activity-log/activity-logs-service.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BFF_APPLICATION_SOURCE = exports.APPLICATION_SOURCE_HEADER = void 0;
+exports.default = createBffActivityLogsService;
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+exports.APPLICATION_SOURCE_HEADER = 'Forest-Application-Source';
+exports.BFF_APPLICATION_SOURCE = 'BFF';
+/**
+ * Its own instance rather than the client `oauth/forest-server-client.ts` already holds:
+ * `ForestAdminClientOptions` carries no `headers`, so that one cannot tell the server which channel
+ * wrote the log.
+ */
+function createBffActivityLogsService(forestServerUrl) {
+    return new forestadmin_client_1.ActivityLogsService(new forestadmin_client_1.ForestHttpApi(), {
+        forestServerUrl,
+        headers: { [exports.APPLICATION_SOURCE_HEADER]: exports.BFF_APPLICATION_SOURCE },
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aXZpdHktbG9ncy1zZXJ2aWNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGl2aXR5LWxvZy9hY3Rpdml0eS1sb2dzLXNlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBeUJBLCtDQUtDO0FBeEJELHdFQUFxRjtBQUV4RSxRQUFBLHlCQUF5QixHQUFHLDJCQUEyQixDQUFDO0FBQ3hELFFBQUEsc0JBQXNCLEdBQUcsS0FBSyxDQUFDO0FBVzVDOzs7O0dBSUc7QUFDSCxTQUF3Qiw0QkFBNEIsQ0FBQyxlQUF1QjtJQUMxRSxPQUFPLElBQUksd0NBQW1CLENBQUMsSUFBSSxrQ0FBYSxFQUFFLEVBQUU7UUFDbEQsZUFBZTtRQUNmLE9BQU8sRUFBRSxFQUFFLENBQUMsaUNBQXlCLENBQUMsRUFBRSw4QkFBc0IsRUFBRTtLQUNqRSxDQUFDLENBQUM7QUFDTCxDQUFDIn0=

package/dist/activity-log/with-activity-log.d.ts

@@ -0,0 +1,25 @@
+import type ActivityLogDrainer from './activity-log-drainer';
+import type { ActivityLogContext, BffActivityLogAction } from './activity-logs-creator';
+import type { ActivityLogsWriter } from './activity-logs-service';
+import type { Logger } from '../ports/logger-port';
+import type { Context } from 'koa';
+export interface WithActivityLogOptions<T> {
+    ctx: Context;
+    service: ActivityLogsWriter;
+    drainer: ActivityLogDrainer;
+    action: BffActivityLogAction;
+    context?: ActivityLogContext;
+    logger: Logger;
+    operation: () => Promise<T>;
+    /**
+     * Errors the log records as `completed` rather than `failed` — the operation reached a business
+     * outcome the BFF answers with an error status.
+     */
+    isCompletedDespite?: (error: unknown) => boolean;
+}
+/**
+ * Runs an operation under an activity log: the pending log is awaited before the operation starts,
+ * so nothing runs unaudited, and the status transition is fired without `await` afterwards.
+ */
+export default function withActivityLog<T>(options: WithActivityLogOptions<T>): Promise<T>;
+//# sourceMappingURL=with-activity-log.d.ts.map

package/dist/activity-log/with-activity-log.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = withActivityLog;
+const activity_logs_creator_1 = __importStar(require("./activity-logs-creator"));
+const COMPLETED = 'completed';
+const FAILED = 'failed';
+/**
+ * Runs an operation under an activity log: the pending log is awaited before the operation starts,
+ * so nothing runs unaudited, and the status transition is fired without `await` afterwards.
+ */
+async function withActivityLog(options) {
+    const { ctx, service, drainer, action, context, logger, operation, isCompletedDespite } = options;
+    // No log line of its own when nothing came back: the creator reports the case it hit, with the
+    // rendering and the collection this one could not name. A read proceeds unaudited from here.
+    const pending = await (0, activity_logs_creator_1.default)({ ctx, service, action, context, logger });
+    try {
+        const result = await operation();
+        if (pending)
+            (0, activity_logs_creator_1.markActivityLog)({ service, drainer, pending, status: COMPLETED, logger });
+        return result;
+    }
+    catch (error) {
+        if (pending) {
+            const status = isCompletedDespite?.(error) ? COMPLETED : FAILED;
+            (0, activity_logs_creator_1.markActivityLog)({ service, drainer, pending, status, logger });
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2l0aC1hY3Rpdml0eS1sb2cuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWN0aXZpdHktbG9nL3dpdGgtYWN0aXZpdHktbG9nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBOEJBLGtDQXFCQztBQTdDRCxpRkFBb0Y7QUFFcEYsTUFBTSxTQUFTLEdBQUcsV0FBVyxDQUFDO0FBQzlCLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQztBQWlCeEI7OztHQUdHO0FBQ1ksS0FBSyxVQUFVLGVBQWUsQ0FBSSxPQUFrQztJQUNqRixNQUFNLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsT0FBTyxDQUFDO0lBRWxHLCtGQUErRjtJQUMvRiw2RkFBNkY7SUFDN0YsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFBLCtCQUF3QixFQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFFMUYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxTQUFTLEVBQUUsQ0FBQztRQUVqQyxJQUFJLE9BQU87WUFBRSxJQUFBLHVDQUFlLEVBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFFdkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ1osTUFBTSxNQUFNLEdBQUcsa0JBQWtCLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7WUFDaEUsSUFBQSx1Q0FBZSxFQUFDLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUMifQ==

package/dist/api-key/api-key-authenticator.d.ts

@@ -9,9 +9,20 @@ export interface ApiKeyAuthenticatorOptions {
 export interface AuthenticatedApiKey {
     agentToken: string;
     identity: ResolvedApiKeyIdentity;
+    /** The Forest server token the resolve response carried, cached with the identity. */
+    forestServerToken?: string;
 }
 export interface ApiKeyAuthenticator {
     authenticate(rawKey: string): Promise<AuthenticatedApiKey>;
+    /**
+     * Forgets what a key resolved to, so the next request resolves it against the Forest server
+     * again. The resolution carries a short-lived server token the BFF caches with the identity:
+     * once that token is refused, the whole entry has to go.
+     *
+     * `credential` is the refused token, which tells a repeat refusal of the same one from the
+     * refusal of the token the previous invalidation went and fetched.
+     */
+    invalidate(rawKey: string, credential?: string): void;
 }
 export default function createApiKeyAuthenticator({ client, cache, authSecret, }: ApiKeyAuthenticatorOptions): ApiKeyAuthenticator;
 //# sourceMappingURL=api-key-authenticator.d.ts.map

package/dist/api-key/api-key-authenticator.js

@@ -25,7 +25,11 @@ function mapResolveError(error) {
 }
 function createApiKeyAuthenticator({ client, cache, authSecret, }) {
     function mint(identity) {
-        return { agentToken: (0, agent_token_1.issueAgentToken)({ identity, authSecret }), identity };
+        return {
+            agentToken: (0, agent_token_1.issueAgentToken)({ identity, authSecret }),
+            identity,
+            forestServerToken: identity.saasAccessToken,
+        };
     }
     return {
         async authenticate(rawKey) {
@@ -56,6 +60,12 @@ function createApiKeyAuthenticator({ client, cache, authSecret, }) {
             cache.setPositive(hash, identity);
             return authenticated;
         },
+        invalidate(rawKey, credential) {
+            const parsed = (0, api_key_1.parseApiKey)(rawKey);
+            if (!parsed)
+                return;
+            cache.invalidate((0, api_key_1.hashApiKey)(parsed.keyId, parsed.secret), credential);
+        },
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1hdXRoZW50aWNhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1hdXRoZW50aWNhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBa0RBLDRDQTRDQztBQXpGRCwrQ0FBZ0Q7QUFDaEQsdUNBQW9EO0FBQ3BELHFEQUFzRDtBQUN0RCxtREFLeUI7QUFFekIsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLENBQUM7QUFDMUMsTUFBTSx1QkFBdUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBaUJwRCxTQUFTLGVBQWUsQ0FBQyxLQUF5QjtJQUNoRCxJQUFJLEtBQUssQ0FBQyxXQUFXO1FBQUUsT0FBTyxJQUFBLHdDQUF3QixFQUFDLCtCQUErQixDQUFDLENBQUM7SUFFeEYsUUFBUSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckIsS0FBSyxHQUFHO1lBQ04sT0FBTyxJQUFBLDZCQUFhLEdBQUUsQ0FBQztRQUN6QixLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsd0NBQXdCLEdBQUUsQ0FBQztRQUNwQyxLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsOEJBQWMsR0FBRSxDQUFDO1FBQzFCLEtBQUssR0FBRztZQUNOLE9BQU8sSUFBQSx3Q0FBd0IsRUFBQyxLQUFLLENBQUMsVUFBVSxJQUFJLCtCQUErQixDQUFDLENBQUM7UUFDdkY7WUFDRSxPQUFPLElBQUEsd0NBQXdCLEVBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQXdCLHlCQUF5QixDQUFDLEVBQ2hELE1BQU0sRUFDTixLQUFLLEVBQ0wsVUFBVSxHQUNpQjtJQUMzQixTQUFTLElBQUksQ0FBQyxRQUFnQztRQUM1QyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUEsNkJBQWUsRUFBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQzdFLENBQUM7SUFFRCxPQUFPO1FBQ0wsS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUFNO1lBQ3ZCLE1BQU0sTUFBTSxHQUFHLElBQUEscUJBQVcsRUFBQyxNQUFNLENBQUMsQ0FBQztZQUVuQyxJQUFJLENBQUMsTUFBTTtnQkFBRSxNQUFNLElBQUEsNkJBQWEsR0FBRSxDQUFDO1lBRW5DLE1BQU0sSUFBSSxHQUFHLElBQUEsb0JBQVUsRUFBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUVyRCxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksY0FBYztnQkFBRSxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUVoRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLElBQUksV0FBVztnQkFBRSxNQUFNLFdBQVcsQ0FBQztZQUVuQyxJQUFJLFFBQWdDLENBQUM7WUFFckMsSUFBSSxDQUFDO2dCQUNILFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDaEQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxLQUFLLFlBQVksbUNBQWtCLEVBQUUsQ0FBQztvQkFDeEMsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN0QyxJQUFJLHVCQUF1QixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO3dCQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO29CQUVoRixNQUFNLE1BQU0sQ0FBQztnQkFDZixDQUFDO2dCQUVELE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUVELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyQyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztZQUVsQyxPQUFPLGFBQWEsQ0FBQztRQUN2QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1hdXRoZW50aWNhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1hdXRoZW50aWNhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBNkRBLDRDQXdEQztBQWhIRCwrQ0FBZ0Q7QUFDaEQsdUNBQW9EO0FBQ3BELHFEQUFzRDtBQUN0RCxtREFLeUI7QUFFekIsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLENBQUM7QUFDMUMsTUFBTSx1QkFBdUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBNEJwRCxTQUFTLGVBQWUsQ0FBQyxLQUF5QjtJQUNoRCxJQUFJLEtBQUssQ0FBQyxXQUFXO1FBQUUsT0FBTyxJQUFBLHdDQUF3QixFQUFDLCtCQUErQixDQUFDLENBQUM7SUFFeEYsUUFBUSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckIsS0FBSyxHQUFHO1lBQ04sT0FBTyxJQUFBLDZCQUFhLEdBQUUsQ0FBQztRQUN6QixLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsd0NBQXdCLEdBQUUsQ0FBQztRQUNwQyxLQUFLLEdBQUc7WUFDTixPQUFPLElBQUEsOEJBQWMsR0FBRSxDQUFDO1FBQzFCLEtBQUssR0FBRztZQUNOLE9BQU8sSUFBQSx3Q0FBd0IsRUFBQyxLQUFLLENBQUMsVUFBVSxJQUFJLCtCQUErQixDQUFDLENBQUM7UUFDdkY7WUFDRSxPQUFPLElBQUEsd0NBQXdCLEVBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQXdCLHlCQUF5QixDQUFDLEVBQ2hELE1BQU0sRUFDTixLQUFLLEVBQ0wsVUFBVSxHQUNpQjtJQUMzQixTQUFTLElBQUksQ0FBQyxRQUFnQztRQUM1QyxPQUFPO1lBQ0wsVUFBVSxFQUFFLElBQUEsNkJBQWUsRUFBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQztZQUNyRCxRQUFRO1lBQ1IsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGVBQWU7U0FDNUMsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPO1FBQ0wsS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUFNO1lBQ3ZCLE1BQU0sTUFBTSxHQUFHLElBQUEscUJBQVcsRUFBQyxNQUFNLENBQUMsQ0FBQztZQUVuQyxJQUFJLENBQUMsTUFBTTtnQkFBRSxNQUFNLElBQUEsNkJBQWEsR0FBRSxDQUFDO1lBRW5DLE1BQU0sSUFBSSxHQUFHLElBQUEsb0JBQVUsRUFBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUVyRCxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksY0FBYztnQkFBRSxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUVoRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLElBQUksV0FBVztnQkFBRSxNQUFNLFdBQVcsQ0FBQztZQUVuQyxJQUFJLFFBQWdDLENBQUM7WUFFckMsSUFBSSxDQUFDO2dCQUNILFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDaEQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxLQUFLLFlBQVksbUNBQWtCLEVBQUUsQ0FBQztvQkFDeEMsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN0QyxJQUFJLHVCQUF1QixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO3dCQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO29CQUVoRixNQUFNLE1BQU0sQ0FBQztnQkFDZixDQUFDO2dCQUVELE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUVELE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyQyxLQUFLLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztZQUVsQyxPQUFPLGFBQWEsQ0FBQztRQUN2QixDQUFDO1FBRUQsVUFBVSxDQUFDLE1BQU0sRUFBRSxVQUFVO1lBQzNCLE1BQU0sTUFBTSxHQUFHLElBQUEscUJBQVcsRUFBQyxNQUFNLENBQUMsQ0FBQztZQUVuQyxJQUFJLENBQUMsTUFBTTtnQkFBRSxPQUFPO1lBRXBCLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBQSxvQkFBVSxFQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyJ9

package/dist/api-key/api-key-client.d.ts

@@ -16,6 +16,12 @@ export interface ResolvedApiKeyIdentity {
     user: ApiKeyIdentityUser;
     renderingId: number;
     allowedOrigins: string[];
+    /**
+     * Short-lived, user-scoped Forest server token, used to write the activity log. Optional so a
+     * Forest server that does not send one yet still resolves keys: the audit trail then degrades on
+     * its own terms (a read proceeds unaudited, a write is blocked) instead of taking auth down.
+     */
+    saasAccessToken?: string;
 }
 export interface ApiKeyClientOptions {
     forestServerUrl: string;

package/dist/api-key/api-key-client.js

@@ -56,6 +56,7 @@ class ApiKeyClient {
         return (typeof candidate.renderingId === 'number' &&
             Array.isArray(candidate.allowedOrigins) &&
             candidate.allowedOrigins.every(entry => typeof entry === 'string') &&
+            (candidate.saasAccessToken === undefined || typeof candidate.saasAccessToken === 'string') &&
             ApiKeyClient.isIdentityUser(candidate.user));
     }
     // Every field the agent-token mint reads must be present, so a partial body fails here
@@ -83,4 +84,4 @@ class ApiKeyClient {
     }
 }
 exports.default = ApiKeyClient;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hcGkta2V5LWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtRUFBNkQ7QUFFN0QsaUVBQTZEO0FBQXBELDJIQUFBLGtCQUFrQixPQUFBO0FBd0IzQixNQUFNLGVBQWUsR0FBRyxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBVyxDQUFDO0FBQ3hFLE1BQU0sa0JBQWtCLEdBQUcsS0FBTSxDQUFDO0FBQ2xDLE1BQU0sWUFBWSxHQUFHLGdDQUFnQyxDQUFDO0FBTXRELE1BQXFCLFlBQVk7SUFJL0IsWUFBWSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQXVCO1FBQzdELElBQUksQ0FBQyxlQUFlLEdBQUcsZUFBZSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7SUFFRCxLQUFLLENBQUMsYUFBYSxDQUFDLFNBR25CO1FBQ0MsSUFBSSxRQUFrQixDQUFDO1FBRXZCLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM3QyxNQUFNLEVBQUUsTUFBTTtnQkFDZCxPQUFPLEVBQUUsRUFBRSxHQUFHLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFO2dCQUNwRSxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzFFLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO2FBQ2hELENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQWtCLENBQUM7WUFDeEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBRXBDLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQztnQkFDM0IsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNO2dCQUN2QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxJQUFJO2dCQUM1QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUk7Z0JBQ3RCLFVBQVUsRUFBRSxZQUFZLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2FBQzlFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLElBQWEsQ0FBQztRQUVsQixJQUFJLENBQUM7WUFDSCxJQUFJLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDL0IsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFFRCx5RkFBeUY7UUFDekYseUZBQXlGO1FBQ3pGLElBQUksQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQixDQUFDLElBQWE7UUFDN0MsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUEyRSxDQUFDO1FBRTlGLE9BQU8sQ0FDTCxPQUFPLFNBQVMsQ0FBQyxXQUFXLEtBQUssUUFBUTtZQUN6QyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7WUFDdkMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUM7WUFDbEUsWUFBWSxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQzVDLENBQUM7SUFDSixDQUFDO0lBRUQsdUZBQXVGO0lBQ3ZGLGtGQUFrRjtJQUMxRSxNQUFNLENBQUMsY0FBYyxDQUFDLElBQWE7UUFDekMsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUErQixDQUFDO1FBRWxELE9BQU8sQ0FDTCxPQUFPLFNBQVMsQ0FBQyxFQUFFLEtBQUssUUFBUTtZQUNoQyxPQUFPLFNBQVMsQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUNuQyxPQUFPLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUNsQyxPQUFPLFNBQVMsQ0FBQyxlQUFlLEtBQUssUUFBUTtZQUM3QyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCwrRkFBK0Y7SUFDL0YsaUdBQWlHO0lBQ3pGLE1BQU0sQ0FBQyxlQUFlLENBQUMsTUFBcUI7UUFDbEQsSUFBSSxNQUFNLEtBQUssSUFBSTtZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRXRDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUUvQixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEUsQ0FBQztJQUVPLEdBQUcsQ0FBQyxJQUFZO1FBQ3RCLE9BQU8sSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0NBQ0Y7QUFqR0QsK0JBaUdDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hcGkta2V5LWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtRUFBNkQ7QUFFN0QsaUVBQTZEO0FBQXBELDJIQUFBLGtCQUFrQixPQUFBO0FBOEIzQixNQUFNLGVBQWUsR0FBRyxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBVyxDQUFDO0FBQ3hFLE1BQU0sa0JBQWtCLEdBQUcsS0FBTSxDQUFDO0FBQ2xDLE1BQU0sWUFBWSxHQUFHLGdDQUFnQyxDQUFDO0FBTXRELE1BQXFCLFlBQVk7SUFJL0IsWUFBWSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQXVCO1FBQzdELElBQUksQ0FBQyxlQUFlLEdBQUcsZUFBZSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7SUFFRCxLQUFLLENBQUMsYUFBYSxDQUFDLFNBR25CO1FBQ0MsSUFBSSxRQUFrQixDQUFDO1FBRXZCLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM3QyxNQUFNLEVBQUUsTUFBTTtnQkFDZCxPQUFPLEVBQUUsRUFBRSxHQUFHLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFO2dCQUNwRSxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzFFLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO2FBQ2hELENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQWtCLENBQUM7WUFDeEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBRXBDLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQztnQkFDM0IsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNO2dCQUN2QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxJQUFJO2dCQUM1QixJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUk7Z0JBQ3RCLFVBQVUsRUFBRSxZQUFZLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2FBQzlFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLElBQWEsQ0FBQztRQUVsQixJQUFJLENBQUM7WUFDSCxJQUFJLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDL0IsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sSUFBSSwwQ0FBa0IsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFFRCx5RkFBeUY7UUFDekYseUZBQXlGO1FBQ3pGLElBQUksQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxNQUFNLElBQUksMENBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sTUFBTSxDQUFDLGtCQUFrQixDQUFDLElBQWE7UUFDN0MsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUtqQixDQUFDO1FBRUYsT0FBTyxDQUNMLE9BQU8sU0FBUyxDQUFDLFdBQVcsS0FBSyxRQUFRO1lBQ3pDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQztZQUN2QyxTQUFTLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsQ0FBQztZQUNsRSxDQUFDLFNBQVMsQ0FBQyxlQUFlLEtBQUssU0FBUyxJQUFJLE9BQU8sU0FBUyxDQUFDLGVBQWUsS0FBSyxRQUFRLENBQUM7WUFDMUYsWUFBWSxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQzVDLENBQUM7SUFDSixDQUFDO0lBRUQsdUZBQXVGO0lBQ3ZGLGtGQUFrRjtJQUMxRSxNQUFNLENBQUMsY0FBYyxDQUFDLElBQWE7UUFDekMsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUU1RCxNQUFNLFNBQVMsR0FBRyxJQUErQixDQUFDO1FBRWxELE9BQU8sQ0FDTCxPQUFPLFNBQVMsQ0FBQyxFQUFFLEtBQUssUUFBUTtZQUNoQyxPQUFPLFNBQVMsQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUNuQyxPQUFPLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUNsQyxPQUFPLFNBQVMsQ0FBQyxlQUFlLEtBQUssUUFBUTtZQUM3QyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCwrRkFBK0Y7SUFDL0YsaUdBQWlHO0lBQ3pGLE1BQU0sQ0FBQyxlQUFlLENBQUMsTUFBcUI7UUFDbEQsSUFBSSxNQUFNLEtBQUssSUFBSTtZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRXRDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUUvQixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEUsQ0FBQztJQUVPLEdBQUcsQ0FBQyxJQUFZO1FBQ3RCLE9BQU8sSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0NBQ0Y7QUF2R0QsK0JBdUdDIn0=

package/dist/api-key/api-key-middleware.d.ts

@@ -1,10 +1,19 @@
 import type { ApiKeyAuthenticator } from './api-key-authenticator';
 import type { Logger } from '../ports/logger-port';
-import type { Middleware } from 'koa';
+import type { Context, Middleware } from 'koa';
 export declare const BFF_KEY_HEADER = "X-Forest-Bff-Key";
+export type ApiKeyIdentityInvalidator = () => void;
 export interface ApiKeyMiddlewareOptions {
     authenticator: ApiKeyAuthenticator;
     logger: Logger;
 }
 export default function createApiKeyMiddleware({ authenticator, logger, }: ApiKeyMiddlewareOptions): Middleware;
+/**
+ * Forgets the identity this request was authenticated with. Called when the Forest server refuses
+ * the token that came with it: the token is cached with the identity, so the next request must
+ * resolve the key again instead of replaying the refused one for the rest of the cache window.
+ *
+ * A no-op outside api-key mode — nothing else lands an invalidator.
+ */
+export declare function invalidateApiKeyIdentity(ctx: Context): void;
 //# sourceMappingURL=api-key-middleware.d.ts.map

package/dist/api-key/api-key-middleware.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BFF_KEY_HEADER = void 0;
 exports.default = createApiKeyMiddleware;
+exports.invalidateApiKeyIdentity = invalidateApiKeyIdentity;
 const api_key_1 = require("./api-key");
 const api_key_error_1 = require("./api-key-error");
 exports.BFF_KEY_HEADER = 'X-Forest-Bff-Key';
@@ -34,8 +35,13 @@ function createApiKeyMiddleware({ authenticator, logger, }) {
             }
             throw error;
         }
+        // Bound to the token this request was authenticated with: the cache uses it to tell a repeat
+        // refusal of the same credential from the refusal of the one it just went and fetched.
+        const invalidateIdentity = () => authenticator.invalidate(rawKey, authenticated.forestServerToken);
+        ctx.state.invalidateApiKeyIdentity = invalidateIdentity;
         ctx.state.agentToken = authenticated.agentToken;
         ctx.state.apiKeyIdentity = authenticated.identity;
+        ctx.state.forestServerToken = authenticated.forestServerToken;
         ctx.set('Cache-Control', 'no-store');
         logger('Info', 'Resolved BFF API key', {
             keyHash: (0, api_key_1.fingerprintApiKey)(rawKey),
@@ -44,4 +50,15 @@ function createApiKeyMiddleware({ authenticator, logger, }) {
         await next();
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1taWRkbGV3YXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWlCQSx5Q0EyQ0M7QUF4REQsdUNBQThDO0FBQzlDLG1EQUE4QztBQUVqQyxRQUFBLGNBQWMsR0FBRyxrQkFBa0IsQ0FBQztBQU9qRCwrRUFBK0U7QUFDL0UsNkVBQTZFO0FBQzdFLHFFQUFxRTtBQUNyRSxTQUF3QixzQkFBc0IsQ0FBQyxFQUM3QyxhQUFhLEVBQ2IsTUFBTSxHQUNrQjtJQUN4QixPQUFPLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUM5QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsR0FBRyxDQUFDLHNCQUFjLENBQUMsQ0FBQztRQUV2QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxJQUFJLGFBQWtDLENBQUM7UUFFdkMsSUFBSSxDQUFDO1lBQ0gsYUFBYSxHQUFHLE1BQU0sYUFBYSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLDJCQUFXLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxDQUFDLE1BQU0sRUFBRSxzQkFBc0IsRUFBRTtvQkFDckMsT0FBTyxFQUFFLElBQUEsMkJBQWlCLEVBQUMsTUFBTSxDQUFDO29CQUNsQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7aUJBQ2pCLENBQUMsQ0FBQztZQUNMLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLENBQUMsT0FBTyxFQUFFLGdDQUFnQyxFQUFFO29CQUNoRCxPQUFPLEVBQUUsSUFBQSwyQkFBaUIsRUFBQyxNQUFNLENBQUM7b0JBQ2xDLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2lCQUNsRixDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBRUQsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQztRQUNoRCxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDO1FBQ2xELEdBQUcsQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsc0JBQXNCLEVBQUU7WUFDckMsT0FBTyxFQUFFLElBQUEsMkJBQWlCLEVBQUMsTUFBTSxDQUFDO1lBQ2xDLFdBQVcsRUFBRSxhQUFhLENBQUMsUUFBUSxDQUFDLFdBQVc7U0FDaEQsQ0FBQyxDQUFDO1FBRUgsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUMifQ==
+/**
+ * Forgets the identity this request was authenticated with. Called when the Forest server refuses
+ * the token that came with it: the token is cached with the identity, so the next request must
+ * resolve the key again instead of replaying the refused one for the rest of the cache window.
+ *
+ * A no-op outside api-key mode — nothing else lands an invalidator.
+ */
+function invalidateApiKeyIdentity(ctx) {
+    const invalidate = ctx.state.invalidateApiKeyIdentity;
+    invalidate?.();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS1rZXkvYXBpLWtleS1taWRkbGV3YXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQW1CQSx5Q0FrREM7QUFTRCw0REFJQztBQTlFRCx1Q0FBOEM7QUFDOUMsbURBQThDO0FBRWpDLFFBQUEsY0FBYyxHQUFHLGtCQUFrQixDQUFDO0FBU2pELCtFQUErRTtBQUMvRSw2RUFBNkU7QUFDN0UscUVBQXFFO0FBQ3JFLFNBQXdCLHNCQUFzQixDQUFDLEVBQzdDLGFBQWEsRUFDYixNQUFNLEdBQ2tCO0lBQ3hCLE9BQU8sS0FBSyxVQUFVLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxJQUFJO1FBQzlDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxHQUFHLENBQUMsc0JBQWMsQ0FBQyxDQUFDO1FBRXZDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE1BQU0sSUFBSSxFQUFFLENBQUM7WUFFYixPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksYUFBa0MsQ0FBQztRQUV2QyxJQUFJLENBQUM7WUFDSCxhQUFhLEdBQUcsTUFBTSxhQUFhLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksMkJBQVcsRUFBRSxDQUFDO2dCQUNqQyxNQUFNLENBQUMsTUFBTSxFQUFFLHNCQUFzQixFQUFFO29CQUNyQyxPQUFPLEVBQUUsSUFBQSwyQkFBaUIsRUFBQyxNQUFNLENBQUM7b0JBQ2xDLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtpQkFDakIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLE1BQU0sQ0FBQyxPQUFPLEVBQUUsZ0NBQWdDLEVBQUU7b0JBQ2hELE9BQU8sRUFBRSxJQUFBLDJCQUFpQixFQUFDLE1BQU0sQ0FBQztvQkFDbEMsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7aUJBQ2xGLENBQUMsQ0FBQztZQUNMLENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFFRCw2RkFBNkY7UUFDN0YsdUZBQXVGO1FBQ3ZGLE1BQU0sa0JBQWtCLEdBQThCLEdBQUcsRUFBRSxDQUN6RCxhQUFhLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxhQUFhLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUVwRSxHQUFHLENBQUMsS0FBSyxDQUFDLHdCQUF3QixHQUFHLGtCQUFrQixDQUFDO1FBQ3hELEdBQUcsQ0FBQyxLQUFLLENBQUMsVUFBVSxHQUFHLGFBQWEsQ0FBQyxVQUFVLENBQUM7UUFDaEQsR0FBRyxDQUFDLEtBQUssQ0FBQyxjQUFjLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUNsRCxHQUFHLENBQUMsS0FBSyxDQUFDLGlCQUFpQixHQUFHLGFBQWEsQ0FBQyxpQkFBaUIsQ0FBQztRQUM5RCxHQUFHLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNyQyxNQUFNLENBQUMsTUFBTSxFQUFFLHNCQUFzQixFQUFFO1lBQ3JDLE9BQU8sRUFBRSxJQUFBLDJCQUFpQixFQUFDLE1BQU0sQ0FBQztZQUNsQyxXQUFXLEVBQUUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxXQUFXO1NBQ2hELENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxFQUFFLENBQUM7SUFDZixDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsU0FBZ0Isd0JBQXdCLENBQUMsR0FBWTtJQUNuRCxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLHdCQUFpRSxDQUFDO0lBRS9GLFVBQVUsRUFBRSxFQUFFLENBQUM7QUFDakIsQ0FBQyJ9

package/dist/api-key/resolve-cache.d.ts

@@ -5,6 +5,18 @@ export interface ResolveCache {
     getNegative(hash: string): ApiKeyError | undefined;
     setPositive(hash: string, identity: ResolvedApiKeyIdentity): void;
     setNegative(hash: string, error: ApiKeyError): void;
+    /**
+     * Forgets a key. Bounded because the caller is a refusal the Forest server may repeat on every
+     * request: invalidating each time would defeat the cache and cost two round trips per request
+     * instead of one extra per window.
+     *
+     * `credential` is the server token that was refused. A window opened by one token still lets a
+     * second, different one through: the re-resolution that followed the first refusal caches a
+     * fresh token, and suppressing its refusal too would replay a credential the server rejects for
+     * the rest of the window. Only the second is allowed, so the bound holds whatever the server
+     * hands back.
+     */
+    invalidate(hash: string, credential?: string): void;
     size(): number;
 }
 export interface ResolveCacheOptions {

package/dist/api-key/resolve-cache.js

@@ -6,12 +6,21 @@ const DEFAULT_NEGATIVE_TTL_SECONDS = 10;
 const DEFAULT_MAX_ENTRIES = 10000;
 function createResolveCache({ now, positiveTtlSeconds = DEFAULT_POSITIVE_TTL_SECONDS, negativeTtlSeconds = DEFAULT_NEGATIVE_TTL_SECONDS, maxEntries = DEFAULT_MAX_ENTRIES, }) {
     const entries = new Map();
+    /**
+     * Per key, the window opened by its last invalidation. Bounded by `maxEntries` like the entries
+     * it guards: invalidations of distinct keys would otherwise grow it without limit.
+     */
+    const invalidatedUntil = new Map();
     function purgeExpired() {
         const current = now();
         for (const [hash, entry] of entries) {
             if (current >= entry.expiresAt)
                 entries.delete(hash);
         }
+        for (const [hash, window] of invalidatedUntil) {
+            if (current >= window.until)
+                invalidatedUntil.delete(hash);
+        }
     }
     function liveEntry(hash) {
         const entry = entries.get(hash);
@@ -23,13 +32,16 @@ function createResolveCache({ now, positiveTtlSeconds = DEFAULT_POSITIVE_TTL_SEC
         }
         return entry;
     }
+    function evictOldestIfFull(map, hash) {
+        if (map.has(hash) || map.size < maxEntries)
+            return;
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined)
+            map.delete(oldest);
+    }
     function store(hash, entry) {
         purgeExpired();
-        if (!entries.has(hash) && entries.size >= maxEntries) {
-            const oldest = entries.keys().next().value;
-            if (oldest !== undefined)
-                entries.delete(oldest);
-        }
+        evictOldestIfFull(entries, hash);
         entries.set(hash, entry);
     }
     return {
@@ -47,10 +59,30 @@ function createResolveCache({ now, positiveTtlSeconds = DEFAULT_POSITIVE_TTL_SEC
         setNegative(hash, error) {
             store(hash, { kind: 'negative', error, expiresAt: now() + negativeTtlSeconds * 1000 });
         },
+        invalidate(hash, credential) {
+            const open = invalidatedUntil.get(hash);
+            const live = open !== undefined && now() < open.until;
+            if (live) {
+                if (open.retried || open.credential === credential)
+                    return;
+                // The window is kept: a second refusal buys one more resolution, not a later deadline.
+                invalidatedUntil.set(hash, { ...open, credential, retried: true });
+                entries.delete(hash);
+                return;
+            }
+            purgeExpired();
+            evictOldestIfFull(invalidatedUntil, hash);
+            invalidatedUntil.set(hash, {
+                until: now() + positiveTtlSeconds * 1000,
+                credential,
+                retried: false,
+            });
+            entries.delete(hash);
+        },
         size() {
             purgeExpired();
             return entries.size;
         },
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1jYWNoZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hcGkta2V5L3Jlc29sdmUtY2FjaGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFvQ0EscUNBbUVDO0FBdkVELE1BQU0sNEJBQTRCLEdBQUcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sNEJBQTRCLEdBQUcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sbUJBQW1CLEdBQUcsS0FBTSxDQUFDO0FBRW5DLFNBQXdCLGtCQUFrQixDQUFDLEVBQ3pDLEdBQUcsRUFDSCxrQkFBa0IsR0FBRyw0QkFBNEIsRUFDakQsa0JBQWtCLEdBQUcsNEJBQTRCLEVBQ2pELFVBQVUsR0FBRyxtQkFBbUIsR0FDWjtJQUNwQixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBc0IsQ0FBQztJQUU5QyxTQUFTLFlBQVk7UUFDbkIsTUFBTSxPQUFPLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFFdEIsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLElBQUksT0FBTyxJQUFJLEtBQUssQ0FBQyxTQUFTO2dCQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkQsQ0FBQztJQUNILENBQUM7SUFFRCxTQUFTLFNBQVMsQ0FBQyxJQUFZO1FBQzdCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDaEMsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUU3QixJQUFJLEdBQUcsRUFBRSxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUM3QixPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRXJCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFFRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRCxTQUFTLEtBQUssQ0FBQyxJQUFZLEVBQUUsS0FBaUI7UUFDNUMsWUFBWSxFQUFFLENBQUM7UUFFZixJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsSUFBSSxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQ3JELE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDM0MsSUFBSSxNQUFNLEtBQUssU0FBUztnQkFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFFRCxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztJQUMzQixDQUFDO0lBRUQsT0FBTztRQUNMLFdBQVcsQ0FBQyxJQUFJO1lBQ2QsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRTlCLE9BQU8sS0FBSyxFQUFFLElBQUksS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUNqRSxDQUFDO1FBRUQsV0FBVyxDQUFDLElBQUk7WUFDZCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFOUIsT0FBTyxLQUFLLEVBQUUsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzlELENBQUM7UUFFRCxXQUFXLENBQUMsSUFBSSxFQUFFLFFBQVE7WUFDeEIsS0FBSyxDQUFDLElBQUksRUFBRSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsR0FBRyxrQkFBa0IsR0FBRyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7UUFFRCxXQUFXLENBQUMsSUFBSSxFQUFFLEtBQUs7WUFDckIsS0FBSyxDQUFDLElBQUksRUFBRSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsR0FBRyxrQkFBa0IsR0FBRyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFFRCxJQUFJO1lBQ0YsWUFBWSxFQUFFLENBQUM7WUFFZixPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFDdEIsQ0FBQztLQUNGLENBQUM7QUFDSixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1jYWNoZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hcGkta2V5L3Jlc29sdmUtY2FjaGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUF3REEscUNBdUdDO0FBM0dELE1BQU0sNEJBQTRCLEdBQUcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sNEJBQTRCLEdBQUcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sbUJBQW1CLEdBQUcsS0FBTSxDQUFDO0FBRW5DLFNBQXdCLGtCQUFrQixDQUFDLEVBQ3pDLEdBQUcsRUFDSCxrQkFBa0IsR0FBRyw0QkFBNEIsRUFDakQsa0JBQWtCLEdBQUcsNEJBQTRCLEVBQ2pELFVBQVUsR0FBRyxtQkFBbUIsR0FDWjtJQUNwQixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBc0IsQ0FBQztJQUM5Qzs7O09BR0c7SUFDSCxNQUFNLGdCQUFnQixHQUFHLElBQUksR0FBRyxFQUE4QixDQUFDO0lBRS9ELFNBQVMsWUFBWTtRQUNuQixNQUFNLE9BQU8sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUV0QixLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksT0FBTyxFQUFFLENBQUM7WUFDcEMsSUFBSSxPQUFPLElBQUksS0FBSyxDQUFDLFNBQVM7Z0JBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBRUQsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLGdCQUFnQixFQUFFLENBQUM7WUFDOUMsSUFBSSxPQUFPLElBQUksTUFBTSxDQUFDLEtBQUs7Z0JBQUUsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdELENBQUM7SUFDSCxDQUFDO0lBRUQsU0FBUyxTQUFTLENBQUMsSUFBWTtRQUM3QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFFN0IsSUFBSSxHQUFHLEVBQUUsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDN0IsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUVyQixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsU0FBUyxpQkFBaUIsQ0FBSSxHQUFtQixFQUFFLElBQVk7UUFDN0QsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQyxJQUFJLEdBQUcsVUFBVTtZQUFFLE9BQU87UUFFbkQsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQztRQUN2QyxJQUFJLE1BQU0sS0FBSyxTQUFTO1lBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBRUQsU0FBUyxLQUFLLENBQUMsSUFBWSxFQUFFLEtBQWlCO1FBQzVDLFlBQVksRUFBRSxDQUFDO1FBQ2YsaUJBQWlCLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRWpDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFRCxPQUFPO1FBQ0wsV0FBVyxDQUFDLElBQUk7WUFDZCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFOUIsT0FBTyxLQUFLLEVBQUUsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxXQUFXLENBQUMsSUFBSTtZQUNkLE1BQU0sS0FBSyxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUU5QixPQUFPLEtBQUssRUFBRSxJQUFJLEtBQUssVUFBVSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDOUQsQ0FBQztRQUVELFdBQVcsQ0FBQyxJQUFJLEVBQUUsUUFBUTtZQUN4QixLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLGtCQUFrQixHQUFHLElBQUksRUFBRSxDQUFDLENBQUM7UUFDNUYsQ0FBQztRQUVELFdBQVcsQ0FBQyxJQUFJLEVBQUUsS0FBSztZQUNyQixLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLGtCQUFrQixHQUFHLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUVELFVBQVUsQ0FBQyxJQUFJLEVBQUUsVUFBVTtZQUN6QixNQUFNLElBQUksR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDeEMsTUFBTSxJQUFJLEdBQUcsSUFBSSxLQUFLLFNBQVMsSUFBSSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDO1lBRXRELElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ1QsSUFBSSxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxVQUFVLEtBQUssVUFBVTtvQkFBRSxPQUFPO2dCQUUzRCx1RkFBdUY7Z0JBQ3ZGLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxHQUFHLElBQUksRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQ25FLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBRXJCLE9BQU87WUFDVCxDQUFDO1lBRUQsWUFBWSxFQUFFLENBQUM7WUFDZixpQkFBaUIsQ0FBQyxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUMxQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFO2dCQUN6QixLQUFLLEVBQUUsR0FBRyxFQUFFLEdBQUcsa0JBQWtCLEdBQUcsSUFBSTtnQkFDeEMsVUFBVTtnQkFDVixPQUFPLEVBQUUsS0FBSzthQUNmLENBQUMsQ0FBQztZQUNILE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdkIsQ0FBQztRQUVELElBQUk7WUFDRixZQUFZLEVBQUUsQ0FBQztZQUVmLE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQztRQUN0QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUMifQ==

package/dist/auth/auth-mode.d.ts

@@ -1,5 +1,6 @@
 import type { BffAccessTokenPayload } from '../oauth/bff-token';
 export type AuthMode = 'oauth' | 'api-key';
+export declare function readRenderingId(principal: BffAccessTokenPayload): number | undefined;
 export declare function requireRenderingId(principal: BffAccessTokenPayload): number;
 export declare function extractBearerToken(authorization: string | undefined): string | undefined;
 export declare function resolveAuthMode({ hasBearer, hasApiKey, }: {