@forestadmin/agent-bff 1.6.0 → 1.8.0

package/dist/action/action-form-mapper.d.ts

@@ -0,0 +1,18 @@
+import type { ActionForm } from './agent-action-client';
+import type { ForestServerActionFormLayoutElement } from '@forestadmin/forestadmin-client';
+export interface ActionFormFieldResponse {
+    name: string;
+    type: string;
+    value: unknown;
+    isRequired: boolean;
+    enumValues?: string[] | null;
+}
+export interface ActionFormResponse {
+    fields: ActionFormFieldResponse[];
+    canExecute: boolean;
+    requiredFields: string[];
+    skippedFields: string[];
+    layout: ForestServerActionFormLayoutElement[];
+}
+export declare function mapActionForm(action: ActionForm, skippedFields: string[], layout: ForestServerActionFormLayoutElement[]): ActionFormResponse;
+//# sourceMappingURL=action-form-mapper.d.ts.map

package/dist/action/action-form-mapper.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapActionForm = mapActionForm;
+const ENUM_TYPE = 'Enum';
+// Mirrors the MCP getActionForm tool, adding `layout`. A required field is "missing a value" only
+// when its resolved value is null/undefined; an explicit empty string or 0 counts as present.
+function mapActionForm(action, skippedFields, layout) {
+    const fields = action.getFields();
+    const requiredFields = fields
+        .filter(field => field.isRequired())
+        .filter(field => field.getValue() === undefined || field.getValue() === null)
+        .map(field => field.getName());
+    return {
+        fields: fields.map(field => {
+            const base = {
+                name: field.getName(),
+                type: field.getType(),
+                value: field.getValue(),
+                isRequired: field.isRequired() ?? false,
+            };
+            // enumValues is emitted only for Enum fields, matching the MCP tool.
+            if (field.getType() === ENUM_TYPE) {
+                return { ...base, enumValues: action.getEnumField(field.getName()).getOptions() ?? null };
+            }
+            return base;
+        }),
+        canExecute: requiredFields.length === 0,
+        requiredFields,
+        skippedFields,
+        layout,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9uLWZvcm0tbWFwcGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGlvbi9hY3Rpb24tZm9ybS1tYXBwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUF1QkEsc0NBaUNDO0FBckRELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQztBQWtCekIsa0dBQWtHO0FBQ2xHLDhGQUE4RjtBQUM5RixTQUFnQixhQUFhLENBQzNCLE1BQWtCLEVBQ2xCLGFBQXVCLEVBQ3ZCLE1BQTZDO0lBRTdDLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUVsQyxNQUFNLGNBQWMsR0FBRyxNQUFNO1NBQzFCLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQztTQUNuQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxRQUFRLEVBQUUsS0FBSyxJQUFJLENBQUM7U0FDNUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFFakMsT0FBTztRQUNMLE1BQU0sRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFO1lBQ3pCLE1BQU0sSUFBSSxHQUE0QjtnQkFDcEMsSUFBSSxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUU7Z0JBQ3JCLElBQUksRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFO2dCQUNyQixLQUFLLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRTtnQkFDdkIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsSUFBSSxLQUFLO2FBQ3hDLENBQUM7WUFFRixxRUFBcUU7WUFDckUsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ2xDLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxVQUFVLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1RixDQUFDO1lBRUQsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDLENBQUM7UUFDRixVQUFVLEVBQUUsY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQ3ZDLGNBQWM7UUFDZCxhQUFhO1FBQ2IsTUFBTTtLQUNQLENBQUM7QUFDSixDQUFDIn0=

package/dist/action/action-routes-middleware.d.ts

@@ -0,0 +1,12 @@
+import type { AgentActionClient, AgentActionClientOptions } from './agent-action-client';
+import type { Logger } from '../ports/logger-port';
+import type ReadModelStore from '../read-model/read-model-store';
+import type { Middleware } from 'koa';
+export interface ActionRoutesMiddlewareOptions {
+    store: ReadModelStore;
+    agentUrl: string;
+    logger: Logger;
+    createClient?: (options: AgentActionClientOptions) => AgentActionClient;
+}
+export default function createActionRoutesMiddleware({ store, agentUrl, logger, createClient, }: ActionRoutesMiddlewareOptions): Middleware;
+//# sourceMappingURL=action-routes-middleware.d.ts.map

package/dist/action/action-routes-middleware.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createActionRoutesMiddleware;
+const action_form_mapper_1 = require("./action-form-mapper");
+const agent_action_client_1 = __importStar(require("./agent-action-client"));
+const agent_route_helpers_1 = require("../http/agent-route-helpers");
+const bff_local_errors_1 = require("../http/bff-local-errors");
+const ACTION_FORM_ROUTE = /^\/agent\/v1\/([^/]+)\/actions\/([^/]+)\/form$/;
+// recordIds are opaque BFF ids; only presence and array-ness are checked. An empty array is allowed
+// on purpose (global/bulk actions have no selected records); the spec AC only covers a missing
+// recordIds, so `[]` is an explicit BFF choice, not a spec requirement.
+// Ids are coerced to strings so a valid `0` (numeric primary key) survives agent-client's downstream
+// `.filter(Boolean)`, which would otherwise drop it and load the form as if no record were selected.
+function parseRecordIds(raw) {
+    if (!Array.isArray(raw)) {
+        throw (0, bff_local_errors_1.invalidRequest)('recordIds is required and must be an array');
+    }
+    return raw.map(id => String(id));
+}
+function parseValues(raw) {
+    if (raw === undefined)
+        return {};
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw (0, bff_local_errors_1.invalidRequest)('values must be an object');
+    }
+    return raw;
+}
+function createActionRoutesMiddleware({ store, agentUrl, logger, createClient = agent_action_client_1.default, }) {
+    return async function actionRoutesMiddleware(ctx, next) {
+        const match = ACTION_FORM_ROUTE.exec(ctx.path);
+        if (!match || ctx.method !== 'POST') {
+            await next();
+            return;
+        }
+        const collection = (0, agent_route_helpers_1.decodeSegment)(match[1], 'collection name');
+        const actionName = (0, agent_route_helpers_1.decodeSegment)(match[2], 'action name');
+        const token = (0, agent_route_helpers_1.requireAgentToken)(ctx);
+        const readModel = await (0, agent_route_helpers_1.resolveReadModel)(store);
+        // The read-model's action map IS the allow-list, so an absent action cannot be told from a
+        // known-but-disallowed one — every non-exposed action maps to 404 here; `action_not_allowed`
+        // (403) has no local trigger, mirroring `collection_not_allowed`/`relation_not_allowed`. The
+        // URL identity is resolved before the body, so a bad action 404s before its payload is read.
+        // TODO(PRD-673): distinguish disallowed from unknown when a separate exposure source exists.
+        if (!readModel.isActionAllowed(collection, actionName)) {
+            throw (0, bff_local_errors_1.unknownAction)(`Unknown action: ${collection}.${actionName}`);
+        }
+        const body = (ctx.request.body ?? {});
+        const recordIds = parseRecordIds(body.recordIds);
+        const values = parseValues(body.values);
+        const client = createClient({
+            agentUrl,
+            token,
+            actionEndpoints: readModel.getActionEndpoints(),
+        });
+        // Each agent-hitting call is wrapped on its own; getFields/extractRawLayout/mapping stay outside
+        // callAgent so a local BFF bug surfaces as a 500, not a mislabelled agent error. Fields and
+        // layout are read AFTER tryToSetFields because a change hook rebuilds them in place.
+        const action = await (0, agent_route_helpers_1.callAgent)(() => client.loadActionForm(collection, actionName, recordIds), logger);
+        const skippedFields = await (0, agent_route_helpers_1.callAgent)(() => action.tryToSetFields(values), logger);
+        ctx.status = 200;
+        ctx.body = (0, action_form_mapper_1.mapActionForm)(action, skippedFields, (0, agent_action_client_1.extractRawLayout)(action));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWN0aW9uLXJvdXRlcy1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FjdGlvbi9hY3Rpb24tcm91dGVzLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFvREEsK0NBbURDO0FBbEdELDZEQUFxRDtBQUNyRCw2RUFBeUY7QUFDekYscUVBS3FDO0FBQ3JDLCtEQUF5RTtBQUV6RSxNQUFNLGlCQUFpQixHQUFHLGdEQUFnRCxDQUFDO0FBTzNFLG9HQUFvRztBQUNwRywrRkFBK0Y7QUFDL0Ysd0VBQXdFO0FBQ3hFLHFHQUFxRztBQUNyRyxxR0FBcUc7QUFDckcsU0FBUyxjQUFjLENBQUMsR0FBWTtJQUNsQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVELE9BQU8sR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ25DLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxHQUFZO0lBQy9CLElBQUksR0FBRyxLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUVqQyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVEsSUFBSSxHQUFHLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNsRSxNQUFNLElBQUEsaUNBQWMsRUFBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxPQUFPLEdBQThCLENBQUM7QUFDeEMsQ0FBQztBQVNELFNBQXdCLDRCQUE0QixDQUFDLEVBQ25ELEtBQUssRUFDTCxRQUFRLEVBQ1IsTUFBTSxFQUNOLFlBQVksR0FBRyw2QkFBOEIsR0FDZjtJQUM5QixPQUFPLEtBQUssVUFBVSxzQkFBc0IsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUNwRCxNQUFNLEtBQUssR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRS9DLElBQUksQ0FBQyxLQUFLLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNwQyxNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFBLG1DQUFhLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDOUQsTUFBTSxVQUFVLEdBQUcsSUFBQSxtQ0FBYSxFQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUMxRCxNQUFNLEtBQUssR0FBRyxJQUFBLHVDQUFpQixFQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBQSxzQ0FBZ0IsRUFBQyxLQUFLLENBQUMsQ0FBQztRQUVoRCwyRkFBMkY7UUFDM0YsNkZBQTZGO1FBQzdGLDZGQUE2RjtRQUM3Riw2RkFBNkY7UUFDN0YsNkZBQTZGO1FBQzdGLElBQUksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sSUFBQSxnQ0FBYSxFQUFDLG1CQUFtQixVQUFVLElBQUksVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksSUFBSSxFQUFFLENBQTBCLENBQUM7UUFDL0QsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNqRCxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXhDLE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQztZQUMxQixRQUFRO1lBQ1IsS0FBSztZQUNMLGVBQWUsRUFBRSxTQUFTLENBQUMsa0JBQWtCLEVBQUU7U0FDaEQsQ0FBQyxDQUFDO1FBRUgsaUdBQWlHO1FBQ2pHLDRGQUE0RjtRQUM1RixxRkFBcUY7UUFDckYsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFBLCtCQUFTLEVBQzVCLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsRUFDOUQsTUFBTSxDQUNQLENBQUM7UUFDRixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUEsK0JBQVMsRUFBQyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRW5GLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1FBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsSUFBQSxrQ0FBYSxFQUFDLE1BQU0sRUFBRSxhQUFhLEVBQUUsSUFBQSxzQ0FBZ0IsRUFBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQzVFLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/action/agent-action-client.d.ts

@@ -0,0 +1,32 @@
+import type { ActionEndpointsByCollection } from '@forestadmin/agent-client';
+import type { ForestServerActionFormLayoutElement } from '@forestadmin/forestadmin-client';
+export interface ActionFormField {
+    getName(): string;
+    getType(): string;
+    getValue(): unknown;
+    isRequired(): boolean | undefined;
+}
+export interface ActionForm {
+    tryToSetFields(values: Record<string, unknown>): Promise<string[]>;
+    getFields(): ActionFormField[];
+    getEnumField(name: string): {
+        getOptions(): string[] | undefined;
+    };
+    getLayout(): unknown;
+}
+export interface AgentActionClient {
+    loadActionForm(collection: string, action: string, recordIds: string[]): Promise<ActionForm>;
+}
+export interface AgentActionClientOptions {
+    agentUrl: string;
+    token: string;
+    actionEndpoints: ActionEndpointsByCollection;
+}
+export declare function extractRawLayout(action: ActionForm): ForestServerActionFormLayoutElement[];
+/**
+ * Thin action-form client bound to a request's agent token. Reuses agent-client's stateful form
+ * loading (`/hooks/load` + `/hooks/change`, Ruby 404 fallback, dependent-field re-evaluation) rather
+ * than reimplementing it. The endpoint map from the read-model is the action allow-list.
+ */
+export default function createAgentActionClient({ agentUrl, token, actionEndpoints, }: AgentActionClientOptions): AgentActionClient;
+//# sourceMappingURL=agent-action-client.d.ts.map

package/dist/action/agent-action-client.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractRawLayout = extractRawLayout;
+exports.default = createAgentActionClient;
+const agent_client_1 = require("@forestadmin/agent-client");
+// The raw layout must be read AFTER tryToSetFields: a change hook rebuilds fields+layout in place.
+// agent-client's `Action.getLayout()` only returns an `ActionLayoutRoot` wrapper whose element array
+// lives in a protected field. The rollback contract forbids agent-client changes, so we read it
+// through a cast rather than adding a public accessor. `extract-raw-layout.test.ts` builds a real
+// `ActionLayoutRoot` and asserts this unwraps it, so a rename of that field fails a test.
+function extractRawLayout(action) {
+    const root = action.getLayout();
+    return root.layout ?? [];
+}
+/**
+ * Thin action-form client bound to a request's agent token. Reuses agent-client's stateful form
+ * loading (`/hooks/load` + `/hooks/change`, Ruby 404 fallback, dependent-field re-evaluation) rather
+ * than reimplementing it. The endpoint map from the read-model is the action allow-list.
+ */
+function createAgentActionClient({ agentUrl, token, actionEndpoints, }) {
+    const client = (0, agent_client_1.createRemoteAgentClient)({ url: agentUrl, token, actionEndpoints });
+    return {
+        loadActionForm: (collection, action, recordIds) => client.collection(collection).action(action, { recordIds }),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtYWN0aW9uLWNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hY3Rpb24vYWdlbnQtYWN0aW9uLWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQW9DQSw0Q0FJQztBQU9ELDBDQVdDO0FBdkRELDREQUFvRTtBQTRCcEUsbUdBQW1HO0FBQ25HLHFHQUFxRztBQUNyRyxnR0FBZ0c7QUFDaEcsa0dBQWtHO0FBQ2xHLDBGQUEwRjtBQUMxRixTQUFnQixnQkFBZ0IsQ0FBQyxNQUFrQjtJQUNqRCxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsU0FBUyxFQUF3RCxDQUFDO0lBRXRGLE9BQU8sSUFBSSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUM7QUFDM0IsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUF3Qix1QkFBdUIsQ0FBQyxFQUM5QyxRQUFRLEVBQ1IsS0FBSyxFQUNMLGVBQWUsR0FDVTtJQUN6QixNQUFNLE1BQU0sR0FBRyxJQUFBLHNDQUF1QixFQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUMsQ0FBQztJQUVsRixPQUFPO1FBQ0wsY0FBYyxFQUFFLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsRUFBRSxDQUNoRCxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQztLQUM5RCxDQUFDO0FBQ0osQ0FBQyJ9

package/dist/cli-core.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = runCli;
 exports.reportFatalError = reportFatalError;
 const bodyparser_1 = require("@koa/bodyparser");
+const action_routes_middleware_1 = __importDefault(require("./action/action-routes-middleware"));
 const console_logger_1 = __importDefault(require("./adapters/console-logger"));
 const agent_stub_1 = __importDefault(require("./agent/agent-stub"));
 const api_key_authenticator_1 = __importDefault(require("./api-key/api-key-authenticator"));
@@ -16,6 +17,7 @@ const auth_mode_middleware_1 = __importDefault(require("./auth/auth-mode-middlew
 const env_config_1 = require("./config/env-config");
 const cors_middleware_1 = __importDefault(require("./cors/cors-middleware"));
 const per_key_origin_1 = __importDefault(require("./cors/per-key-origin"));
+const data_routes_middleware_1 = __importDefault(require("./data/data-routes-middleware"));
 const errors_1 = require("./errors");
 const bff_http_error_1 = require("./http/bff-http-error");
 const bff_http_server_1 = __importDefault(require("./http/bff-http-server"));
@@ -24,6 +26,7 @@ const forest_server_client_1 = __importDefault(require("./oauth/forest-server-cl
 const oauth_routes_1 = __importDefault(require("./oauth/oauth-routes"));
 const session_store_1 = __importDefault(require("./oauth/session-store"));
 const token_cipher_1 = __importDefault(require("./oauth/token-cipher"));
+const create_read_model_1 = __importDefault(require("./read-model/create-read-model"));
 const timezone_middleware_1 = __importDefault(require("./timezone/timezone-middleware"));
 const version_1 = __importDefault(require("./version"));
 const BODY_LIMIT = '16kb';
@@ -109,6 +112,25 @@ function buildApiKeyMiddleware(config, logger) {
     });
     return (0, api_key_middleware_1.default)({ authenticator, logger });
 }
+// Data and action routes share one read-model store (a single cache, a single schema fetch). The
+// data middleware falls through to the action middleware on a non-data path.
+function buildAgentRouteMiddlewares(config, logger) {
+    const apiKeyConfig = resolveApiKeyConfig(config);
+    if (!apiKeyConfig || !config.agentUrl) {
+        logger('Warn', 'Data endpoints disabled: AGENT_URL or read-model configuration is missing');
+        return [(0, agent_stub_1.default)()];
+    }
+    const { store } = (0, create_read_model_1.default)({
+        forestServerUrl: apiKeyConfig.forestServerUrl,
+        envSecret: apiKeyConfig.forestEnvSecret,
+        logger,
+    });
+    const { agentUrl } = config;
+    return [
+        (0, data_routes_middleware_1.default)({ store, agentUrl, logger }),
+        (0, action_routes_middleware_1.default)({ store, agentUrl, logger }),
+    ];
+}
 function buildAgentMiddlewares(config, logger) {
     const { forestAuthSecret, defaultTimezone } = config;
     if (!forestAuthSecret) {
@@ -121,7 +143,7 @@ function buildAgentMiddlewares(config, logger) {
         apiKeyStep,
         (0, per_key_origin_1.default)(),
         (0, timezone_middleware_1.default)({ defaultTimezone }),
-        (0, agent_stub_1.default)(),
+        ...buildAgentRouteMiddlewares(config, logger),
     ];
     return chain.map(agentScoped);
 }
@@ -156,4 +178,4 @@ function reportFatalError(err) {
     process.stderr.write(`Error: ${(0, errors_1.extractErrorMessage)(err)}\n`);
     process.exitCode = 1;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLWNvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2xpLWNvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFnTEEseUJBa0NDO0FBRUQsNENBR0M7QUFuTkQsZ0RBQTZDO0FBRTdDLCtFQUE0RDtBQUM1RCxvRUFBMkQ7QUFDM0QsNEZBQXdFO0FBQ3hFLDhFQUFvRDtBQUNwRCxzRkFBa0U7QUFDbEUsNEVBQXlEO0FBQ3pELHVGQUFtRTtBQUNuRSxvREFBa0Q7QUFDbEQsNkVBQTBEO0FBQzFELDJFQUFpRTtBQUNqRSxxQ0FBK0M7QUFDL0MsMERBQXFEO0FBQ3JELDZFQUFtRDtBQUNuRCwrRUFBNEQ7QUFDNUQsd0ZBQThEO0FBQzlELHdFQUFxRDtBQUNyRCwwRUFBK0Q7QUFDL0Qsd0VBQXFEO0FBQ3JELHlGQUFzRTtBQUN0RSx3REFBZ0M7QUFFaEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDO0FBQzFCLE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUFFekMsU0FBUyxXQUFXLENBQUMsSUFBWTtJQUMvQixPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUN6RCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsVUFBc0I7SUFDekMsT0FBTyxLQUFLLFVBQVUsTUFBTSxDQUFDLEdBQUcsRUFBRSxJQUFJO1FBQ3BDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUViLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlCLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLDRCQUE0QixDQUFDLE1BQWM7SUFDbEQsT0FBTyxLQUFLLFVBQVUsc0JBQXNCLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDcEQsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyQyxNQUFNLENBQUMsT0FBTyxFQUFFLDJEQUEyRCxDQUFDLENBQUM7WUFDN0UsTUFBTSxJQUFBLDZCQUFZLEVBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUM7QUFVRCxTQUFTLGtCQUFrQixDQUFDLE1BQWlCO0lBQzNDLE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxHQUM1RixNQUFNLENBQUM7SUFFVCxJQUNFLGVBQWU7UUFDZixlQUFlO1FBQ2YsWUFBWTtRQUNaLGdCQUFnQjtRQUNoQixrQkFBa0IsRUFDbEIsQ0FBQztRQUNELE9BQU8sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxDQUFDO0lBQ2xHLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQztBQUNuQixDQUFDO0FBRUQsS0FBSyxVQUFVLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUNwRSxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUUvQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDakIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxHQUM1RixXQUFXLENBQUM7SUFFZCxNQUFNLFlBQVksR0FBRyxJQUFJLDhCQUFrQixDQUFDLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sYUFBYSxHQUFHLE1BQU0sWUFBWSxDQUFDLGtCQUFrQixFQUFFLENBQUM7SUFFOUQsTUFBTSxZQUFZLEdBQUcsSUFBQSx1QkFBMEIsRUFBQztRQUM5QyxNQUFNLEVBQUUsSUFBQSxzQkFBaUIsRUFBQyxrQkFBa0IsQ0FBQztRQUM3QyxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNyQixpQkFBaUIsRUFBRSxtQkFBbUI7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsTUFBTSxXQUFXLEdBQUcsSUFBQSxzQkFBaUIsRUFBQztRQUNwQyxZQUFZO1FBQ1osWUFBWTtRQUNaLFlBQVk7UUFDWixVQUFVLEVBQUUsZ0JBQWdCO1FBQzVCLGFBQWE7UUFDYixNQUFNO0tBQ1AsQ0FBQyxDQUFDO0lBRUgsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3ZCLENBQUM7QUFRRCxTQUFTLG1CQUFtQixDQUFDLE1BQWlCO0lBQzVDLE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRXRFLElBQUksZUFBZSxJQUFJLGVBQWUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1FBQzNELE9BQU8sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDaEUsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUM5RCxNQUFNLFlBQVksR0FBRyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUVqRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFZLENBQUM7UUFDOUIsZUFBZSxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQzdDLFNBQVMsRUFBRSxZQUFZLENBQUMsZUFBZTtLQUN4QyxDQUFDLENBQUM7SUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHVCQUFrQixFQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUQsTUFBTSxhQUFhLEdBQUcsSUFBQSwrQkFBeUIsRUFBQztRQUM5QyxNQUFNO1FBQ04sS0FBSztRQUNMLFVBQVUsRUFBRSxZQUFZLENBQUMsZ0JBQWdCO0tBQzFDLENBQUMsQ0FBQztJQUVILE9BQU8sSUFBQSw0QkFBc0IsRUFBQyxFQUFFLGFBQWEsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQzNELENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUM5RCxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRXJELElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sQ0FBQyxNQUFNLEVBQUUsb0RBQW9ELENBQUMsQ0FBQztRQUVyRSxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBRyxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLElBQUksNEJBQTRCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFakcsTUFBTSxLQUFLLEdBQWlCO1FBQzFCLElBQUEsOEJBQXdCLEVBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQztRQUMxRCxVQUFVO1FBQ1YsSUFBQSx3QkFBNEIsR0FBRTtRQUM5QixJQUFBLDZCQUF3QixFQUFDLEVBQUUsZUFBZSxFQUFFLENBQUM7UUFDN0MsSUFBQSxvQkFBeUIsR0FBRTtLQUM1QixDQUFDO0lBRUYsT0FBTyxLQUFLLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ2hDLENBQUM7QUFFYyxLQUFLLFVBQVUsTUFBTSxDQUNsQyxHQUFzQixFQUN0QixTQUFpQixJQUFBLHdCQUFtQixHQUFFO0lBRXRDLE1BQU0sTUFBTSxHQUFHLElBQUEsd0JBQVcsRUFBQyxHQUFHLENBQUMsQ0FBQztJQUVoQyxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDNUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxnREFBZ0QsRUFBRTtZQUMvRCxPQUFPLEVBQUUsTUFBTSxDQUFDLHFCQUFxQjtTQUN0QyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyRSxNQUFNLGdCQUFnQixHQUFHLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMvRCxNQUFNLG9CQUFvQixHQUN4QixnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxJQUFBLDBCQUFxQixFQUFDLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUN0RixNQUFNLFdBQVcsR0FBRztRQUNsQixJQUFBLHlCQUFvQixFQUFDLEVBQUUsY0FBYyxFQUFFLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUMvRCxHQUFHLG9CQUFvQjtRQUN2QixJQUFBLHVCQUFVLEVBQUMsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDckMsR0FBRyxnQkFBZ0I7UUFDbkIsR0FBRyxnQkFBZ0I7S0FDcEIsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUkseUJBQWEsQ0FBQztRQUMvQixJQUFJLEVBQUUsTUFBTSxDQUFDLFFBQVE7UUFDckIsT0FBTyxFQUFQLGlCQUFPO1FBQ1AsTUFBTTtRQUNOLE1BQU07UUFDTixXQUFXO0tBQ1osQ0FBQyxDQUFDO0lBRUgsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFFckIsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLEdBQVk7SUFDM0MsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3RCxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztBQUN2QixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLWNvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2xpLWNvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUEyTUEseUJBa0NDO0FBRUQsNENBR0M7QUE5T0QsZ0RBQTZDO0FBRTdDLGlHQUE2RTtBQUM3RSwrRUFBNEQ7QUFDNUQsb0VBQTJEO0FBQzNELDRGQUF3RTtBQUN4RSw4RUFBb0Q7QUFDcEQsc0ZBQWtFO0FBQ2xFLDRFQUF5RDtBQUN6RCx1RkFBbUU7QUFDbkUsb0RBQWtEO0FBQ2xELDZFQUEwRDtBQUMxRCwyRUFBaUU7QUFDakUsMkZBQXVFO0FBQ3ZFLHFDQUErQztBQUMvQywwREFBcUQ7QUFDckQsNkVBQW1EO0FBQ25ELCtFQUE0RDtBQUM1RCx3RkFBOEQ7QUFDOUQsd0VBQXFEO0FBQ3JELDBFQUErRDtBQUMvRCx3RUFBcUQ7QUFDckQsdUZBQTZEO0FBQzdELHlGQUFzRTtBQUN0RSx3REFBZ0M7QUFFaEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDO0FBQzFCLE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUFFekMsU0FBUyxXQUFXLENBQUMsSUFBWTtJQUMvQixPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUN6RCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsVUFBc0I7SUFDekMsT0FBTyxLQUFLLFVBQVUsTUFBTSxDQUFDLEdBQUcsRUFBRSxJQUFJO1FBQ3BDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUViLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlCLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLDRCQUE0QixDQUFDLE1BQWM7SUFDbEQsT0FBTyxLQUFLLFVBQVUsc0JBQXNCLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDcEQsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyQyxNQUFNLENBQUMsT0FBTyxFQUFFLDJEQUEyRCxDQUFDLENBQUM7WUFDN0UsTUFBTSxJQUFBLDZCQUFZLEVBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUM7QUFVRCxTQUFTLGtCQUFrQixDQUFDLE1BQWlCO0lBQzNDLE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxHQUM1RixNQUFNLENBQUM7SUFFVCxJQUNFLGVBQWU7UUFDZixlQUFlO1FBQ2YsWUFBWTtRQUNaLGdCQUFnQjtRQUNoQixrQkFBa0IsRUFDbEIsQ0FBQztRQUNELE9BQU8sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxDQUFDO0lBQ2xHLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQztBQUNuQixDQUFDO0FBRUQsS0FBSyxVQUFVLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUNwRSxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUUvQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDakIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxHQUM1RixXQUFXLENBQUM7SUFFZCxNQUFNLFlBQVksR0FBRyxJQUFJLDhCQUFrQixDQUFDLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sYUFBYSxHQUFHLE1BQU0sWUFBWSxDQUFDLGtCQUFrQixFQUFFLENBQUM7SUFFOUQsTUFBTSxZQUFZLEdBQUcsSUFBQSx1QkFBMEIsRUFBQztRQUM5QyxNQUFNLEVBQUUsSUFBQSxzQkFBaUIsRUFBQyxrQkFBa0IsQ0FBQztRQUM3QyxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNyQixpQkFBaUIsRUFBRSxtQkFBbUI7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsTUFBTSxXQUFXLEdBQUcsSUFBQSxzQkFBaUIsRUFBQztRQUNwQyxZQUFZO1FBQ1osWUFBWTtRQUNaLFlBQVk7UUFDWixVQUFVLEVBQUUsZ0JBQWdCO1FBQzVCLGFBQWE7UUFDYixNQUFNO0tBQ1AsQ0FBQyxDQUFDO0lBRUgsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3ZCLENBQUM7QUFRRCxTQUFTLG1CQUFtQixDQUFDLE1BQWlCO0lBQzVDLE1BQU0sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRXRFLElBQUksZUFBZSxJQUFJLGVBQWUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1FBQzNELE9BQU8sRUFBRSxlQUFlLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDaEUsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLE1BQWlCLEVBQUUsTUFBYztJQUM5RCxNQUFNLFlBQVksR0FBRyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUVqRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEIsTUFBTSxDQUFDLE1BQU0sRUFBRSwwREFBMEQsQ0FBQyxDQUFDO1FBRTNFLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFZLENBQUM7UUFDOUIsZUFBZSxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQzdDLFNBQVMsRUFBRSxZQUFZLENBQUMsZUFBZTtLQUN4QyxDQUFDLENBQUM7SUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHVCQUFrQixFQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUQsTUFBTSxhQUFhLEdBQUcsSUFBQSwrQkFBeUIsRUFBQztRQUM5QyxNQUFNO1FBQ04sS0FBSztRQUNMLFVBQVUsRUFBRSxZQUFZLENBQUMsZ0JBQWdCO0tBQzFDLENBQUMsQ0FBQztJQUVILE9BQU8sSUFBQSw0QkFBc0IsRUFBQyxFQUFFLGFBQWEsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQzNELENBQUM7QUFFRCxpR0FBaUc7QUFDakcsNkVBQTZFO0FBQzdFLFNBQVMsMEJBQTBCLENBQUMsTUFBaUIsRUFBRSxNQUFjO0lBQ25FLE1BQU0sWUFBWSxHQUFHLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRWpELElBQUksQ0FBQyxZQUFZLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDdEMsTUFBTSxDQUFDLE1BQU0sRUFBRSwyRUFBMkUsQ0FBQyxDQUFDO1FBRTVGLE9BQU8sQ0FBQyxJQUFBLG9CQUF5QixHQUFFLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLElBQUEsMkJBQWUsRUFBQztRQUNoQyxlQUFlLEVBQUUsWUFBWSxDQUFDLGVBQWU7UUFDN0MsU0FBUyxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQ3ZDLE1BQU07S0FDUCxDQUFDLENBQUM7SUFDSCxNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRTVCLE9BQU87UUFDTCxJQUFBLGdDQUEwQixFQUFDLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUN2RCxJQUFBLGtDQUE0QixFQUFDLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztLQUMxRCxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMscUJBQXFCLENBQUMsTUFBaUIsRUFBRSxNQUFjO0lBQzlELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxlQUFlLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFckQsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDdEIsTUFBTSxDQUFDLE1BQU0sRUFBRSxvREFBb0QsQ0FBQyxDQUFDO1FBRXJFLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSw0QkFBNEIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUVqRyxNQUFNLEtBQUssR0FBaUI7UUFDMUIsSUFBQSw4QkFBd0IsRUFBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO1FBQzFELFVBQVU7UUFDVixJQUFBLHdCQUE0QixHQUFFO1FBQzlCLElBQUEsNkJBQXdCLEVBQUMsRUFBRSxlQUFlLEVBQUUsQ0FBQztRQUM3QyxHQUFHLDBCQUEwQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUM7S0FDOUMsQ0FBQztJQUVGLE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUNoQyxDQUFDO0FBRWMsS0FBSyxVQUFVLE1BQU0sQ0FDbEMsR0FBc0IsRUFDdEIsU0FBaUIsSUFBQSx3QkFBbUIsR0FBRTtJQUV0QyxNQUFNLE1BQU0sR0FBRyxJQUFBLHdCQUFXLEVBQUMsR0FBRyxDQUFDLENBQUM7SUFFaEMsSUFBSSxNQUFNLENBQUMscUJBQXFCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsZ0RBQWdELEVBQUU7WUFDL0QsT0FBTyxFQUFFLE1BQU0sQ0FBQyxxQkFBcUI7U0FDdEMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDckUsTUFBTSxnQkFBZ0IsR0FBRyxxQkFBcUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDL0QsTUFBTSxvQkFBb0IsR0FDeEIsZ0JBQWdCLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsSUFBQSwwQkFBcUIsRUFBQyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdEYsTUFBTSxXQUFXLEdBQUc7UUFDbEIsSUFBQSx5QkFBb0IsRUFBQyxFQUFFLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDL0QsR0FBRyxvQkFBb0I7UUFDdkIsSUFBQSx1QkFBVSxFQUFDLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQ3JDLEdBQUcsZ0JBQWdCO1FBQ25CLEdBQUcsZ0JBQWdCO0tBQ3BCLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBRyxJQUFJLHlCQUFhLENBQUM7UUFDL0IsSUFBSSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1FBQ3JCLE9BQU8sRUFBUCxpQkFBTztRQUNQLE1BQU07UUFDTixNQUFNO1FBQ04sV0FBVztLQUNaLENBQUMsQ0FBQztJQUVILE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBRXJCLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxTQUFnQixnQkFBZ0IsQ0FBQyxHQUFZO0lBQzNDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsSUFBQSw0QkFBbUIsRUFBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDN0QsT0FBTyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUM7QUFDdkIsQ0FBQyJ9

package/dist/data/agent-data-client.d.ts

@@ -0,0 +1,17 @@
+export interface AgentDataClientOptions {
+    agentUrl: string;
+    token: string;
+}
+export interface AgentDataClient {
+    list(collection: string, query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    countRaw(collection: string, query: Record<string, unknown>): Promise<unknown>;
+    listRelation(collection: string, parentId: string, relation: string, query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    countRelationRaw(collection: string, parentId: string, relation: string, query: Record<string, unknown>): Promise<unknown>;
+}
+/**
+ * Thin data client bound to a request's agent token. Uses the raw `HttpRequester` (not `Collection`)
+ * so the BFF controls the query params — notably the resolved `timezone` — and can read the count
+ * endpoint's raw payload, which `collection.count()` coerces through `Number()` and loses.
+ */
+export default function createAgentDataClient({ agentUrl, token, }: AgentDataClientOptions): AgentDataClient;
+//# sourceMappingURL=agent-data-client.d.ts.map

package/dist/data/agent-data-client.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createAgentDataClient;
+const agent_client_1 = require("@forestadmin/agent-client");
+/**
+ * Thin data client bound to a request's agent token. Uses the raw `HttpRequester` (not `Collection`)
+ * so the BFF controls the query params — notably the resolved `timezone` — and can read the count
+ * endpoint's raw payload, which `collection.count()` coerces through `Number()` and loses.
+ */
+function createAgentDataClient({ agentUrl, token, }) {
+    const requester = new agent_client_1.HttpRequester(token, { url: agentUrl });
+    // Segments are passed raw: HttpRequester.buildUrl already runs the whole path through
+    // escapeUrlSlug/encodeURI, so pre-encoding here would double-encode (`|` -> `%257C`).
+    const relationPath = (collection, parentId, relation) => `/forest/${collection}/${parentId}/relationships/${relation}`;
+    return {
+        list: (collection, query) => requester.query({ method: 'get', path: `/forest/${collection}`, query }),
+        countRaw: (collection, query) => requester.query({
+            method: 'get',
+            path: `/forest/${collection}/count`,
+            query,
+            skipDeserialization: true,
+        }),
+        listRelation: (collection, parentId, relation, query) => requester.query({ method: 'get', path: relationPath(collection, parentId, relation), query }),
+        countRelationRaw: (collection, parentId, relation, query) => requester.query({
+            method: 'get',
+            path: `${relationPath(collection, parentId, relation)}/count`,
+            query,
+            skipDeserialization: true,
+        }),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtZGF0YS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGF0YS9hZ2VudC1kYXRhLWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQTZCQSx3Q0ErQkM7QUE1REQsNERBQTBEO0FBd0IxRDs7OztHQUlHO0FBQ0gsU0FBd0IscUJBQXFCLENBQUMsRUFDNUMsUUFBUSxFQUNSLEtBQUssR0FDa0I7SUFDdkIsTUFBTSxTQUFTLEdBQUcsSUFBSSw0QkFBYSxDQUFDLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBRTlELHNGQUFzRjtJQUN0RixzRkFBc0Y7SUFDdEYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxVQUFrQixFQUFFLFFBQWdCLEVBQUUsUUFBZ0IsRUFBRSxFQUFFLENBQzlFLFdBQVcsVUFBVSxJQUFJLFFBQVEsa0JBQWtCLFFBQVEsRUFBRSxDQUFDO0lBRWhFLE9BQU87UUFDTCxJQUFJLEVBQUUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FDMUIsU0FBUyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLFdBQVcsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDMUUsUUFBUSxFQUFFLENBQUMsVUFBVSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQzlCLFNBQVMsQ0FBQyxLQUFLLENBQUM7WUFDZCxNQUFNLEVBQUUsS0FBSztZQUNiLElBQUksRUFBRSxXQUFXLFVBQVUsUUFBUTtZQUNuQyxLQUFLO1lBQ0wsbUJBQW1CLEVBQUUsSUFBSTtTQUMxQixDQUFDO1FBQ0osWUFBWSxFQUFFLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FDdEQsU0FBUyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLFlBQVksQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQy9GLGdCQUFnQixFQUFFLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FDMUQsU0FBUyxDQUFDLEtBQUssQ0FBQztZQUNkLE1BQU0sRUFBRSxLQUFLO1lBQ2IsSUFBSSxFQUFFLEdBQUcsWUFBWSxDQUFDLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7WUFDN0QsS0FBSztZQUNMLG1CQUFtQixFQUFFLElBQUk7U0FDMUIsQ0FBQztLQUNMLENBQUM7QUFDSixDQUFDIn0=

package/dist/data/agent-query.d.ts

@@ -0,0 +1,36 @@
+export interface BffSortClause {
+    field: string;
+    direction?: 'asc' | 'desc';
+}
+export interface BffPage {
+    limit: number;
+    offset: number;
+}
+export interface ListRequestBody {
+    filter?: unknown;
+    projection?: string[];
+    sort?: BffSortClause[];
+    page?: BffPage;
+}
+export interface CountRequestBody {
+    filter?: unknown;
+}
+export type RelationListRequestBody = ListRequestBody & {
+    parentId: string;
+};
+export type RelationCountRequestBody = CountRequestBody & {
+    parentId: string;
+};
+export type AgentQuery = Record<string, unknown> & {
+    timezone: string;
+};
+export declare function parseListRequest(body: unknown): ListRequestBody;
+export declare function parseCountRequest(body: unknown): CountRequestBody;
+export declare function buildListAgentQuery(collection: string, timezone: string, body: ListRequestBody): AgentQuery;
+export declare function buildCountAgentQuery(timezone: string, body: CountRequestBody): AgentQuery;
+export declare function collectListFieldPaths(body: ListRequestBody): string[];
+export declare function parseParentId(parentId: unknown): string;
+export declare function parseRelationListRequest(body: unknown): RelationListRequestBody;
+export declare function parseRelationCountRequest(body: unknown): RelationCountRequestBody;
+export declare function collectCountFieldPaths(body: CountRequestBody): string[];
+//# sourceMappingURL=agent-query.d.ts.map

package/dist/data/agent-query.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseListRequest = parseListRequest;
+exports.parseCountRequest = parseCountRequest;
+exports.buildListAgentQuery = buildListAgentQuery;
+exports.buildCountAgentQuery = buildCountAgentQuery;
+exports.collectListFieldPaths = collectListFieldPaths;
+exports.parseParentId = parseParentId;
+exports.parseRelationListRequest = parseRelationListRequest;
+exports.parseRelationCountRequest = parseRelationCountRequest;
+exports.collectCountFieldPaths = collectCountFieldPaths;
+const bff_local_errors_1 = require("../http/bff-local-errors");
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// Validate the untyped request body before it reaches the query builders, so malformed shapes
+// (e.g. `projection` or `sort` as a string) surface as 400 invalid_request rather than a 500 from
+// an array method blowing up downstream.
+function parseListRequest(body) {
+    if (!isPlainObject(body))
+        throw (0, bff_local_errors_1.invalidRequest)('Request body must be an object');
+    const { filter, projection, sort, page } = body;
+    if (projection !== undefined) {
+        if (!Array.isArray(projection) || projection.some(field => typeof field !== 'string')) {
+            throw (0, bff_local_errors_1.invalidRequest)('projection must be an array of field names');
+        }
+    }
+    if (sort !== undefined) {
+        const valid = Array.isArray(sort) &&
+            sort.every(clause => isPlainObject(clause) &&
+                typeof clause.field === 'string' &&
+                (clause.direction === undefined ||
+                    clause.direction === 'asc' ||
+                    clause.direction === 'desc'));
+        if (!valid)
+            throw (0, bff_local_errors_1.invalidRequest)('sort must be an array of { field, direction? }');
+    }
+    if (filter !== undefined && !isPlainObject(filter)) {
+        throw (0, bff_local_errors_1.invalidRequest)('filter must be an object');
+    }
+    if (page !== undefined) {
+        if (!isPlainObject(page)) {
+            throw (0, bff_local_errors_1.invalidRequest)('page must be an object with limit and offset');
+        }
+        if (!Number.isInteger(page.limit) || page.limit <= 0) {
+            throw (0, bff_local_errors_1.invalidRequest)('page.limit must be a positive integer');
+        }
+        if (!Number.isInteger(page.offset) || page.offset < 0) {
+            throw (0, bff_local_errors_1.invalidRequest)('page.offset must be a non-negative integer');
+        }
+    }
+    return body;
+}
+function parseCountRequest(body) {
+    if (!isPlainObject(body))
+        throw (0, bff_local_errors_1.invalidRequest)('Request body must be an object');
+    if (body.filter !== undefined && !isPlainObject(body.filter)) {
+        throw (0, bff_local_errors_1.invalidRequest)('filter must be an object');
+    }
+    return body;
+}
+function isBranch(node) {
+    return (typeof node === 'object' &&
+        node !== null &&
+        Array.isArray(node.conditions));
+}
+function isLeaf(node) {
+    return (typeof node === 'object' &&
+        node !== null &&
+        typeof node.field === 'string');
+}
+function collectFilterFields(filter, acc) {
+    if (isBranch(filter)) {
+        filter.conditions.forEach(condition => collectFilterFields(condition, acc));
+    }
+    else if (isLeaf(filter)) {
+        acc.push(filter.field);
+    }
+}
+function serializeSort(sort) {
+    return sort.map(({ field, direction }) => (direction === 'desc' ? `-${field}` : field)).join(',');
+}
+// `parseListRequest` guarantees `limit` > 0 and `offset` >= 0 are integers; this only enforces the
+// page-model rule. The agent paginates by page number/size, so an arbitrary offset that is not a
+// whole multiple of the limit cannot be expressed — reject it rather than return a shifted window.
+function serializePage(page) {
+    const { limit, offset } = page;
+    if (offset % limit !== 0) {
+        throw (0, bff_local_errors_1.invalidRequest)(`page.offset (${offset}) must be a multiple of page.limit (${limit})`);
+    }
+    return { 'page[size]': limit, 'page[number]': offset / limit + 1 };
+}
+function buildListAgentQuery(collection, timezone, body) {
+    const query = { timezone };
+    if (body.filter !== undefined)
+        query.filters = JSON.stringify(body.filter);
+    if (body.projection?.length)
+        query[`fields[${collection}]`] = body.projection.join(',');
+    if (body.sort?.length)
+        query.sort = serializeSort(body.sort);
+    if (body.page)
+        Object.assign(query, serializePage(body.page));
+    return query;
+}
+function buildCountAgentQuery(timezone, body) {
+    const query = { timezone };
+    if (body.filter !== undefined)
+        query.filters = JSON.stringify(body.filter);
+    return query;
+}
+function collectListFieldPaths(body) {
+    const paths = [...(body.projection ?? [])];
+    collectFilterFields(body.filter, paths);
+    (body.sort ?? []).forEach(({ field }) => paths.push(field));
+    return paths;
+}
+// The parent record id is opaque: a packed/composite id must survive unchanged, so its content is
+// never inspected — only presence and primitive type. A finite number (single numeric pk) is
+// coerced to string; anything else is a BFF-local 400 with no agent call.
+function parseParentId(parentId) {
+    if (typeof parentId === 'string') {
+        if (parentId.trim() === '')
+            throw (0, bff_local_errors_1.invalidRequest)('parentId must not be empty');
+        return parentId;
+    }
+    if (typeof parentId === 'number' && Number.isFinite(parentId)) {
+        return String(parentId);
+    }
+    throw (0, bff_local_errors_1.invalidRequest)('parentId is required and must be a non-empty string or a number');
+}
+function parseRelationListRequest(body) {
+    const parentId = parseParentId(body?.parentId);
+    return { ...parseListRequest(body), parentId };
+}
+function parseRelationCountRequest(body) {
+    const parentId = parseParentId(body?.parentId);
+    return { ...parseCountRequest(body), parentId };
+}
+function collectCountFieldPaths(body) {
+    const paths = [];
+    collectFilterFields(body.filter, paths);
+    return paths;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtcXVlcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGF0YS9hZ2VudC1xdWVyeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQW9DQSw0Q0E0Q0M7QUFFRCw4Q0FRQztBQW1ERCxrREFhQztBQUVELG9EQU1DO0FBRUQsc0RBTUM7QUFLRCxzQ0FZQztBQUVELDREQUlDO0FBRUQsOERBSUM7QUFFRCx3REFLQztBQTlNRCwrREFBMEQ7QUE2QjFELFNBQVMsYUFBYSxDQUFDLEtBQWM7SUFDbkMsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDOUUsQ0FBQztBQUVELDhGQUE4RjtBQUM5RixrR0FBa0c7QUFDbEcseUNBQXlDO0FBQ3pDLFNBQWdCLGdCQUFnQixDQUFDLElBQWE7SUFDNUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUM7UUFBRSxNQUFNLElBQUEsaUNBQWMsRUFBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBRWpGLE1BQU0sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFFaEQsSUFBSSxVQUFVLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDdEYsTUFBTSxJQUFBLGlDQUFjLEVBQUMsNENBQTRDLENBQUMsQ0FBQztRQUNyRSxDQUFDO0lBQ0gsQ0FBQztJQUVELElBQUksSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sS0FBSyxHQUNULEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO1lBQ25CLElBQUksQ0FBQyxLQUFLLENBQ1IsTUFBTSxDQUFDLEVBQUUsQ0FDUCxhQUFhLENBQUMsTUFBTSxDQUFDO2dCQUNyQixPQUFPLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUTtnQkFDaEMsQ0FBQyxNQUFNLENBQUMsU0FBUyxLQUFLLFNBQVM7b0JBQzdCLE1BQU0sQ0FBQyxTQUFTLEtBQUssS0FBSztvQkFDMUIsTUFBTSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsQ0FDakMsQ0FBQztRQUNKLElBQUksQ0FBQyxLQUFLO1lBQUUsTUFBTSxJQUFBLGlDQUFjLEVBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNyRixDQUFDO0lBRUQsSUFBSSxNQUFNLEtBQUssU0FBUyxJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDbkQsTUFBTSxJQUFBLGlDQUFjLEVBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdkIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSyxJQUFJLENBQUMsS0FBZ0IsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNqRSxNQUFNLElBQUEsaUNBQWMsRUFBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUssSUFBSSxDQUFDLE1BQWlCLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEUsTUFBTSxJQUFBLGlDQUFjLEVBQUMsNENBQTRDLENBQUMsQ0FBQztRQUNyRSxDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sSUFBdUIsQ0FBQztBQUNqQyxDQUFDO0FBRUQsU0FBZ0IsaUJBQWlCLENBQUMsSUFBYTtJQUM3QyxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztRQUFFLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFFakYsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM3RCxNQUFNLElBQUEsaUNBQWMsRUFBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxPQUFPLElBQXdCLENBQUM7QUFDbEMsQ0FBQztBQVVELFNBQVMsUUFBUSxDQUFDLElBQWE7SUFDN0IsT0FBTyxDQUNMLE9BQU8sSUFBSSxLQUFLLFFBQVE7UUFDeEIsSUFBSSxLQUFLLElBQUk7UUFDYixLQUFLLENBQUMsT0FBTyxDQUFFLElBQWlDLENBQUMsVUFBVSxDQUFDLENBQzdELENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxNQUFNLENBQUMsSUFBYTtJQUMzQixPQUFPLENBQ0wsT0FBTyxJQUFJLEtBQUssUUFBUTtRQUN4QixJQUFJLEtBQUssSUFBSTtRQUNiLE9BQVEsSUFBNEIsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUN4RCxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsbUJBQW1CLENBQUMsTUFBZSxFQUFFLEdBQWE7SUFDekQsSUFBSSxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNyQixNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLG1CQUFtQixDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzlFLENBQUM7U0FBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFCLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pCLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsSUFBcUI7SUFDMUMsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDcEcsQ0FBQztBQUVELG1HQUFtRztBQUNuRyxpR0FBaUc7QUFDakcsbUdBQW1HO0FBQ25HLFNBQVMsYUFBYSxDQUFDLElBQWE7SUFDbEMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFFL0IsSUFBSSxNQUFNLEdBQUcsS0FBSyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLGdCQUFnQixNQUFNLHVDQUF1QyxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFFRCxPQUFPLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRSxjQUFjLEVBQUUsTUFBTSxHQUFHLEtBQUssR0FBRyxDQUFDLEVBQUUsQ0FBQztBQUNyRSxDQUFDO0FBRUQsU0FBZ0IsbUJBQW1CLENBQ2pDLFVBQWtCLEVBQ2xCLFFBQWdCLEVBQ2hCLElBQXFCO0lBRXJCLE1BQU0sS0FBSyxHQUFlLEVBQUUsUUFBUSxFQUFFLENBQUM7SUFFdkMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVM7UUFBRSxLQUFLLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzNFLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNO1FBQUUsS0FBSyxDQUFDLFVBQVUsVUFBVSxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN4RixJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTTtRQUFFLEtBQUssQ0FBQyxJQUFJLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3RCxJQUFJLElBQUksQ0FBQyxJQUFJO1FBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBRTlELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELFNBQWdCLG9CQUFvQixDQUFDLFFBQWdCLEVBQUUsSUFBc0I7SUFDM0UsTUFBTSxLQUFLLEdBQWUsRUFBRSxRQUFRLEVBQUUsQ0FBQztJQUV2QyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztRQUFFLEtBQUssQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFM0UsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBZ0IscUJBQXFCLENBQUMsSUFBcUI7SUFDekQsTUFBTSxLQUFLLEdBQWEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3JELG1CQUFtQixDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDeEMsQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUU1RCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxrR0FBa0c7QUFDbEcsNkZBQTZGO0FBQzdGLDBFQUEwRTtBQUMxRSxTQUFnQixhQUFhLENBQUMsUUFBaUI7SUFDN0MsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNqQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFO1lBQUUsTUFBTSxJQUFBLGlDQUFjLEVBQUMsNEJBQTRCLENBQUMsQ0FBQztRQUUvRSxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzlELE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFFRCxNQUFNLElBQUEsaUNBQWMsRUFBQyxpRUFBaUUsQ0FBQyxDQUFDO0FBQzFGLENBQUM7QUFFRCxTQUFnQix3QkFBd0IsQ0FBQyxJQUFhO0lBQ3BELE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBRSxJQUFzQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBRWxGLE9BQU8sRUFBRSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ2pELENBQUM7QUFFRCxTQUFnQix5QkFBeUIsQ0FBQyxJQUFhO0lBQ3JELE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBRSxJQUFzQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBRWxGLE9BQU8sRUFBRSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ2xELENBQUM7QUFFRCxTQUFnQixzQkFBc0IsQ0FBQyxJQUFzQjtJQUMzRCxNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsbUJBQW1CLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQztJQUV4QyxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMifQ==

package/dist/data/data-routes-middleware.d.ts

@@ -0,0 +1,12 @@
+import type { AgentDataClient, AgentDataClientOptions } from './agent-data-client';
+import type { Logger } from '../ports/logger-port';
+import type ReadModelStore from '../read-model/read-model-store';
+import type { Middleware } from 'koa';
+export interface DataRoutesMiddlewareOptions {
+    store: ReadModelStore;
+    agentUrl: string;
+    logger: Logger;
+    createClient?: (options: AgentDataClientOptions) => AgentDataClient;
+}
+export default function createDataRoutesMiddleware({ store, agentUrl, logger, createClient, }: DataRoutesMiddlewareOptions): Middleware;
+//# sourceMappingURL=data-routes-middleware.d.ts.map

package/dist/data/data-routes-middleware.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createDataRoutesMiddleware;
+const agent_data_client_1 = __importDefault(require("./agent-data-client"));
+const agent_query_1 = require("./agent-query");
+const response_mappers_1 = require("./response-mappers");
+const agent_route_helpers_1 = require("../http/agent-route-helpers");
+const bff_local_errors_1 = require("../http/bff-local-errors");
+const relation_field_guard_1 = __importDefault(require("../validation/relation-field-guard"));
+const DATA_ROUTE = /^\/agent\/v1\/([^/]+)\/(list|count)$/;
+const RELATION_ROUTE = /^\/agent\/v1\/([^/]+)\/relations\/([^/]+)\/(list|count)$/;
+// Only to-many relations expose list/count on the agent; to-one relations get update-relation only.
+// A polymorphic relation carrying multiple targets is always the to-one (PolymorphicManyToOne) side.
+function resolveForeignCollection(target) {
+    if (!target || !('target' in target))
+        return null;
+    if (target.type !== 'HasMany' && target.type !== 'BelongsToMany')
+        return null;
+    return target.target;
+}
+async function handleList(ctx, body, deps) {
+    (0, relation_field_guard_1.default)((0, agent_query_1.collectListFieldPaths)(body));
+    const query = (0, agent_query_1.buildListAgentQuery)(deps.collection, deps.timezone, body);
+    const records = await (0, agent_route_helpers_1.callAgent)(() => deps.client.list(deps.collection, query), deps.logger);
+    ctx.status = 200;
+    ctx.body = (0, response_mappers_1.mapListResponse)(deps.collection, records, deps.primaryKeys);
+}
+async function handleCount(ctx, body, deps) {
+    (0, relation_field_guard_1.default)((0, agent_query_1.collectCountFieldPaths)(body));
+    const query = (0, agent_query_1.buildCountAgentQuery)(deps.timezone, body);
+    const raw = await (0, agent_route_helpers_1.callAgent)(() => deps.client.countRaw(deps.collection, query), deps.logger);
+    ctx.status = 200;
+    ctx.body = (0, response_mappers_1.mapCountResponse)(raw);
+}
+async function handleRelationList(ctx, body, deps) {
+    // The nested-relation guard IS wired here: the agent's list-related asserts browse only on the
+    // immediate foreign collection, so a nested `:`-path would traverse to a third collection whose
+    // browse is never checked. Plain foreign fields (no `:`) are unaffected.
+    (0, relation_field_guard_1.default)((0, agent_query_1.collectListFieldPaths)(body));
+    const query = (0, agent_query_1.buildListAgentQuery)(deps.foreignCollection, deps.timezone, body);
+    const records = await (0, agent_route_helpers_1.callAgent)(() => deps.client.listRelation(deps.collection, body.parentId, deps.relation, query), deps.logger);
+    ctx.status = 200;
+    ctx.body = (0, response_mappers_1.mapListResponse)(deps.foreignCollection, records, deps.primaryKeys);
+}
+async function handleRelationCount(ctx, body, deps) {
+    (0, relation_field_guard_1.default)((0, agent_query_1.collectCountFieldPaths)(body));
+    const query = (0, agent_query_1.buildCountAgentQuery)(deps.timezone, body);
+    const raw = await (0, agent_route_helpers_1.callAgent)(() => deps.client.countRelationRaw(deps.collection, body.parentId, deps.relation, query), deps.logger);
+    ctx.status = 200;
+    ctx.body = (0, response_mappers_1.mapCountResponse)(raw);
+}
+async function handleRelation(ctx, rawBody, match, { deps, readModel }) {
+    const relation = (0, agent_route_helpers_1.decodeSegment)(match[2], 'relation name');
+    const operation = match[3];
+    // The URL identity (does this listable relation exist?) is resolved before the body,
+    // so a bad path 404s before its payload is inspected.
+    const foreignCollection = resolveForeignCollection(readModel.getRelationTarget(deps.collection, relation));
+    // TODO(PRD-672): the read-model's relation map is the allow-list, so an absent/to-one/polymorphic
+    // relation cannot be told from a disallowed one — every non-listable relation maps to 404 here;
+    // `relation_not_allowed` (403) has no local trigger, mirroring `collection_not_allowed`.
+    if (!foreignCollection) {
+        throw (0, bff_local_errors_1.unknownRelation)(`Unknown relation: ${deps.collection}.${relation}`);
+    }
+    // The agent's count-related authorizes only the parent, so an unguarded foreign collection would
+    // leak a hidden collection's rows/count. Guard it here, mirroring the parent allow-list check.
+    if (!readModel.isCollectionAllowed(foreignCollection)) {
+        throw (0, bff_local_errors_1.unknownCollection)();
+    }
+    const relationDeps = { ...deps, relation, foreignCollection };
+    if (operation === 'list') {
+        await handleRelationList(ctx, (0, agent_query_1.parseRelationListRequest)(rawBody), {
+            ...relationDeps,
+            primaryKeys: readModel.getPrimaryKeys(foreignCollection),
+        });
+    }
+    else {
+        await handleRelationCount(ctx, (0, agent_query_1.parseRelationCountRequest)(rawBody), relationDeps);
+    }
+}
+function createDataRoutesMiddleware({ store, agentUrl, logger, createClient = agent_data_client_1.default, }) {
+    return async function dataRoutesMiddleware(ctx, next) {
+        const dataMatch = DATA_ROUTE.exec(ctx.path);
+        const relationMatch = dataMatch ? null : RELATION_ROUTE.exec(ctx.path);
+        const match = dataMatch ?? relationMatch;
+        if (!match || ctx.method !== 'POST') {
+            await next();
+            return;
+        }
+        const collection = (0, agent_route_helpers_1.decodeSegment)(match[1], 'collection name');
+        const token = (0, agent_route_helpers_1.requireAgentToken)(ctx);
+        const readModel = await (0, agent_route_helpers_1.resolveReadModel)(store);
+        if (!readModel.isCollectionAllowed(collection)) {
+            // TODO(PRD-671): the read-model exposes a single allow-list (the exposed collections), so it
+            // cannot tell an unknown collection from a known-but-disallowed one. Every absent name maps
+            // to 404 here; `collection_not_allowed` (403) has no local trigger until a distinct exposure
+            // source exists. Escalated on the ticket — revisit when Anthony answers.
+            throw (0, bff_local_errors_1.unknownCollection)(`Unknown collection: ${collection}`);
+        }
+        const deps = {
+            collection,
+            client: createClient({ agentUrl, token }),
+            timezone: ctx.state.timezone,
+            logger,
+        };
+        const rawBody = ctx.request.body ?? {};
+        if (relationMatch) {
+            await handleRelation(ctx, rawBody, relationMatch, { deps, readModel });
+            return;
+        }
+        const operation = match[2];
+        if (operation === 'list') {
+            const body = (0, agent_query_1.parseListRequest)(rawBody);
+            await handleList(ctx, body, { ...deps, primaryKeys: readModel.getPrimaryKeys(collection) });
+        }
+        else {
+            const body = (0, agent_query_1.parseCountRequest)(rawBody);
+            await handleCount(ctx, body, deps);
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0YS1yb3V0ZXMtbWlkZGxld2FyZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kYXRhL2RhdGEtcm91dGVzLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUF3S0EsNkNBcURDO0FBaE5ELDRFQUErRDtBQUMvRCwrQ0FTdUI7QUFDdkIseURBQXVFO0FBQ3ZFLHFFQUtxQztBQUNyQywrREFBOEU7QUFDOUUsOEZBQTRFO0FBRTVFLE1BQU0sVUFBVSxHQUFHLHNDQUFzQyxDQUFDO0FBQzFELE1BQU0sY0FBYyxHQUFHLDBEQUEwRCxDQUFDO0FBRWxGLG9HQUFvRztBQUNwRyxxR0FBcUc7QUFDckcsU0FBUyx3QkFBd0IsQ0FBQyxNQUFrQztJQUNsRSxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDbEQsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLGVBQWU7UUFBRSxPQUFPLElBQUksQ0FBQztJQUU5RSxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7QUFDdkIsQ0FBQztBQWtCRCxLQUFLLFVBQVUsVUFBVSxDQUFDLEdBQVksRUFBRSxJQUFxQixFQUFFLElBQXFCO0lBQ2xGLElBQUEsOEJBQTBCLEVBQUMsSUFBQSxtQ0FBcUIsRUFBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBRXhELE1BQU0sS0FBSyxHQUFHLElBQUEsaUNBQW1CLEVBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBQSwrQkFBUyxFQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRTdGLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsSUFBQSxrQ0FBZSxFQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUN6RSxDQUFDO0FBRUQsS0FBSyxVQUFVLFdBQVcsQ0FBQyxHQUFZLEVBQUUsSUFBc0IsRUFBRSxJQUF3QjtJQUN2RixJQUFBLDhCQUEwQixFQUFDLElBQUEsb0NBQXNCLEVBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUV6RCxNQUFNLEtBQUssR0FBRyxJQUFBLGtDQUFvQixFQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDeEQsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFBLCtCQUFTLEVBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFN0YsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFBLG1DQUFnQixFQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ25DLENBQUM7QUFXRCxLQUFLLFVBQVUsa0JBQWtCLENBQy9CLEdBQVksRUFDWixJQUE2QixFQUM3QixJQUE2QjtJQUU3QiwrRkFBK0Y7SUFDL0YsZ0dBQWdHO0lBQ2hHLHlFQUF5RTtJQUN6RSxJQUFBLDhCQUEwQixFQUFDLElBQUEsbUNBQXFCLEVBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUV4RCxNQUFNLEtBQUssR0FBRyxJQUFBLGlDQUFtQixFQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQy9FLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBQSwrQkFBUyxFQUM3QixHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsRUFDcEYsSUFBSSxDQUFDLE1BQU0sQ0FDWixDQUFDO0lBRUYsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFBLGtDQUFlLEVBQUMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDaEYsQ0FBQztBQUVELEtBQUssVUFBVSxtQkFBbUIsQ0FDaEMsR0FBWSxFQUNaLElBQThCLEVBQzlCLElBQXlCO0lBRXpCLElBQUEsOEJBQTBCLEVBQUMsSUFBQSxvQ0FBc0IsRUFBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBRXpELE1BQU0sS0FBSyxHQUFHLElBQUEsa0NBQW9CLEVBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN4RCxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUEsK0JBQVMsRUFDekIsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsRUFDeEYsSUFBSSxDQUFDLE1BQU0sQ0FDWixDQUFDO0lBRUYsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFBLG1DQUFnQixFQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ25DLENBQUM7QUFFRCxLQUFLLFVBQVUsY0FBYyxDQUMzQixHQUFZLEVBQ1osT0FBZ0IsRUFDaEIsS0FBc0IsRUFDdEIsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFzRDtJQUV2RSxNQUFNLFFBQVEsR0FBRyxJQUFBLG1DQUFhLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLGVBQWUsQ0FBQyxDQUFDO0lBQzFELE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQXFCLENBQUM7SUFFL0MscUZBQXFGO0lBQ3JGLHNEQUFzRDtJQUN0RCxNQUFNLGlCQUFpQixHQUFHLHdCQUF3QixDQUNoRCxTQUFTLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FDdkQsQ0FBQztJQUVGLGtHQUFrRztJQUNsRyxnR0FBZ0c7SUFDaEcseUZBQXlGO0lBQ3pGLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBQSxrQ0FBZSxFQUFDLHFCQUFxQixJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVELGlHQUFpRztJQUNqRywrRkFBK0Y7SUFDL0YsSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxJQUFBLG9DQUFpQixHQUFFLENBQUM7SUFDNUIsQ0FBQztJQUVELE1BQU0sWUFBWSxHQUF3QixFQUFFLEdBQUcsSUFBSSxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsRUFBRSxDQUFDO0lBRW5GLElBQUksU0FBUyxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3pCLE1BQU0sa0JBQWtCLENBQUMsR0FBRyxFQUFFLElBQUEsc0NBQXdCLEVBQUMsT0FBTyxDQUFDLEVBQUU7WUFDL0QsR0FBRyxZQUFZO1lBQ2YsV0FBVyxFQUFFLFNBQVMsQ0FBQyxjQUFjLENBQUMsaUJBQWlCLENBQUM7U0FDekQsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLG1CQUFtQixDQUFDLEdBQUcsRUFBRSxJQUFBLHVDQUF5QixFQUFDLE9BQU8sQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ25GLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBd0IsMEJBQTBCLENBQUMsRUFDakQsS0FBSyxFQUNMLFFBQVEsRUFDUixNQUFNLEVBQ04sWUFBWSxHQUFHLDJCQUE0QixHQUNmO0lBQzVCLE9BQU8sS0FBSyxVQUFVLG9CQUFvQixDQUFDLEdBQUcsRUFBRSxJQUFJO1FBQ2xELE1BQU0sU0FBUyxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLE1BQU0sYUFBYSxHQUFHLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2RSxNQUFNLEtBQUssR0FBRyxTQUFTLElBQUksYUFBYSxDQUFDO1FBRXpDLElBQUksQ0FBQyxLQUFLLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNwQyxNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFBLG1DQUFhLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDOUQsTUFBTSxLQUFLLEdBQUcsSUFBQSx1Q0FBaUIsRUFBQyxHQUFHLENBQUMsQ0FBQztRQUNyQyxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsc0NBQWdCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFFaEQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQy9DLDZGQUE2RjtZQUM3Riw0RkFBNEY7WUFDNUYsNkZBQTZGO1lBQzdGLHlFQUF5RTtZQUN6RSxNQUFNLElBQUEsb0NBQWlCLEVBQUMsdUJBQXVCLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELE1BQU0sSUFBSSxHQUF1QjtZQUMvQixVQUFVO1lBQ1YsTUFBTSxFQUFFLFlBQVksQ0FBQyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUN6QyxRQUFRLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxRQUFrQjtZQUN0QyxNQUFNO1NBQ1AsQ0FBQztRQUNGLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUV2QyxJQUFJLGFBQWEsRUFBRSxDQUFDO1lBQ2xCLE1BQU0sY0FBYyxDQUFDLEdBQUcsRUFBRSxPQUFPLEVBQUUsYUFBYSxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFFdkUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFxQixDQUFDO1FBRS9DLElBQUksU0FBUyxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxHQUFHLElBQUEsOEJBQWdCLEVBQUMsT0FBTyxDQUFDLENBQUM7WUFDdkMsTUFBTSxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFLEdBQUcsSUFBSSxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM5RixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sSUFBSSxHQUFHLElBQUEsK0JBQWlCLEVBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEMsTUFBTSxXQUFXLENBQUMsR0FBRyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNyQyxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0FBQ0osQ0FBQyJ9

package/dist/data/pack-id.d.ts

@@ -0,0 +1,9 @@
+import type { PrimaryKeyField } from '../read-model/read-model';
+/**
+ * Rebuild the structured primary key of a record from its opaque packed id, mirroring the agent's
+ * `IdUtils.packId`/`unpackId` (`|`-joined values, `Number` columns cast back to numbers). Returns a
+ * `{ pkField: value }` map for `__forest.primaryKey`. Throws a mapping error rather than emitting a
+ * malformed key when the schema lacks key metadata or the packed id shape does not match it.
+ */
+export default function unpackPrimaryKey(packedId: string, primaryKeys: PrimaryKeyField[]): Record<string, string | number>;
+//# sourceMappingURL=pack-id.d.ts.map

package/dist/data/pack-id.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = unpackPrimaryKey;
+const bff_local_errors_1 = require("../http/bff-local-errors");
+const PACKED_ID_SEPARATOR = '|';
+// The only column type unpacked to a number, mirroring the agent's `IdUtils.unpackId`.
+const NUMBER_COLUMN_TYPE = 'Number';
+/**
+ * Rebuild the structured primary key of a record from its opaque packed id, mirroring the agent's
+ * `IdUtils.packId`/`unpackId` (`|`-joined values, `Number` columns cast back to numbers). Returns a
+ * `{ pkField: value }` map for `__forest.primaryKey`. Throws a mapping error rather than emitting a
+ * malformed key when the schema lacks key metadata or the packed id shape does not match it.
+ */
+function unpackPrimaryKey(packedId, primaryKeys) {
+    if (primaryKeys.length === 0) {
+        throw (0, bff_local_errors_1.mappingError)('Cannot build primary key: the collection exposes no key metadata');
+    }
+    const values = packedId.split(PACKED_ID_SEPARATOR);
+    if (values.length !== primaryKeys.length) {
+        throw (0, bff_local_errors_1.mappingError)(`Cannot build primary key: expected ${primaryKeys.length} values, found ${values.length}`);
+    }
+    const result = {};
+    primaryKeys.forEach(({ name, type }, index) => {
+        const value = values[index];
+        if (type !== NUMBER_COLUMN_TYPE) {
+            result[name] = value;
+            return;
+        }
+        const numeric = Number(value);
+        if (Number.isNaN(numeric)) {
+            throw (0, bff_local_errors_1.mappingError)(`Cannot build primary key: invalid numeric value "${value}" for "${name}"`);
+        }
+        result[name] = numeric;
+    });
+    return result;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFjay1pZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kYXRhL3BhY2staWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFlQSxtQ0F1Q0M7QUFwREQsK0RBQXdEO0FBRXhELE1BQU0sbUJBQW1CLEdBQUcsR0FBRyxDQUFDO0FBRWhDLHVGQUF1RjtBQUN2RixNQUFNLGtCQUFrQixHQUFHLFFBQVEsQ0FBQztBQUVwQzs7Ozs7R0FLRztBQUNILFNBQXdCLGdCQUFnQixDQUN0QyxRQUFnQixFQUNoQixXQUE4QjtJQUU5QixJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0IsTUFBTSxJQUFBLCtCQUFZLEVBQUMsa0VBQWtFLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBRW5ELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDekMsTUFBTSxJQUFBLCtCQUFZLEVBQ2hCLHNDQUFzQyxXQUFXLENBQUMsTUFBTSxrQkFBa0IsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUMxRixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFvQyxFQUFFLENBQUM7SUFFbkQsV0FBVyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFO1FBQzVDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUU1QixJQUFJLElBQUksS0FBSyxrQkFBa0IsRUFBRSxDQUFDO1lBQ2hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUM7WUFFckIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFOUIsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFBLCtCQUFZLEVBQ2hCLG9EQUFvRCxLQUFLLFVBQVUsSUFBSSxHQUFHLENBQzNFLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sQ0FBQztJQUN6QixDQUFDLENBQUMsQ0FBQztJQUVILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMifQ==

package/dist/data/response-mappers.d.ts

@@ -0,0 +1,20 @@
+import type { PrimaryKeyField } from '../read-model/read-model';
+export interface ForestRecordMetadata {
+    collection: string;
+    primaryKey: Record<string, string | number>;
+}
+export interface ListResponse {
+    data: Array<Record<string, unknown> & {
+        __forest: ForestRecordMetadata;
+    }>;
+    meta: {
+        countStatus: 'not_requested';
+    };
+}
+export interface CountResponse {
+    count: number | null;
+    countStatus: 'available' | 'deactivated';
+}
+export declare function mapListResponse(collection: string, records: Record<string, unknown>[], primaryKeys: PrimaryKeyField[]): ListResponse;
+export declare function mapCountResponse(raw: unknown): CountResponse;
+//# sourceMappingURL=response-mappers.d.ts.map

package/dist/data/response-mappers.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapListResponse = mapListResponse;
+exports.mapCountResponse = mapCountResponse;
+const pack_id_1 = __importDefault(require("./pack-id"));
+const bff_local_errors_1 = require("../http/bff-local-errors");
+const DEACTIVATED = 'deactivated';
+function mapListResponse(collection, records, primaryKeys) {
+    const data = records.map(record => {
+        if (record.id === undefined || record.id === null) {
+            throw (0, bff_local_errors_1.mappingError)('Agent record is missing its id');
+        }
+        return {
+            ...record,
+            __forest: {
+                collection,
+                primaryKey: (0, pack_id_1.default)(String(record.id), primaryKeys),
+            },
+        };
+    });
+    return { data, meta: { countStatus: 'not_requested' } };
+}
+// meta.count is the only deactivation signal the agent exposes.
+function mapCountResponse(raw) {
+    const body = (typeof raw === 'object' && raw !== null ? raw : {});
+    if (body.meta?.count === DEACTIVATED) {
+        return { count: null, countStatus: 'deactivated' };
+    }
+    if (typeof body.count === 'number' && Number.isFinite(body.count)) {
+        return { count: body.count, countStatus: 'available' };
+    }
+    // Neither schema metadata nor a usable raw payload: never silently report 0.
+    throw (0, bff_local_errors_1.mappingError)('Agent count payload has no numeric count and no deactivated marker');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzcG9uc2UtbWFwcGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kYXRhL3Jlc3BvbnNlLW1hcHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFzQkEsMENBb0JDO0FBR0QsNENBZ0JDO0FBM0RELHdEQUF5QztBQUN6QywrREFBd0Q7QUFpQnhELE1BQU0sV0FBVyxHQUFHLGFBQWEsQ0FBQztBQUVsQyxTQUFnQixlQUFlLENBQzdCLFVBQWtCLEVBQ2xCLE9BQWtDLEVBQ2xDLFdBQThCO0lBRTlCLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUU7UUFDaEMsSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBQSwrQkFBWSxFQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUVELE9BQU87WUFDTCxHQUFHLE1BQU07WUFDVCxRQUFRLEVBQUU7Z0JBQ1IsVUFBVTtnQkFDVixVQUFVLEVBQUUsSUFBQSxpQkFBZ0IsRUFBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFdBQVcsQ0FBQzthQUM3RDtTQUNGLENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQztJQUVILE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxFQUFFLENBQUM7QUFDMUQsQ0FBQztBQUVELGdFQUFnRTtBQUNoRSxTQUFnQixnQkFBZ0IsQ0FBQyxHQUFZO0lBQzNDLE1BQU0sSUFBSSxHQUFHLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLEdBQUcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUcvRCxDQUFDO0lBRUYsSUFBSSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUNyQyxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDckQsQ0FBQztJQUVELElBQUksT0FBTyxJQUFJLENBQUMsS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUVELDZFQUE2RTtJQUM3RSxNQUFNLElBQUEsK0JBQVksRUFBQyxvRUFBb0UsQ0FBQyxDQUFDO0FBQzNGLENBQUMifQ==

package/dist/http/agent-error-mapper.d.ts

@@ -0,0 +1,18 @@
+import type { Logger } from '../ports/logger-port';
+import { BffHttpError } from './bff-http-error';
+declare const TYPE_INVALID_REQUEST = "invalid_request";
+declare const TYPE_VALIDATION_ERROR = "validation_error";
+declare const TYPE_UNAUTHORIZED = "unauthorized";
+declare const TYPE_FORBIDDEN = "forbidden";
+declare const TYPE_NOT_FOUND = "not_found";
+declare const TYPE_UNPROCESSABLE = "unprocessable_entity";
+declare const TYPE_TOO_MANY_REQUESTS = "too_many_requests";
+declare const TYPE_NETWORK_ERROR = "network_error";
+declare const TYPE_AGENT_UNAVAILABLE = "agent_unavailable";
+type BffErrorType = typeof TYPE_INVALID_REQUEST | typeof TYPE_VALIDATION_ERROR | typeof TYPE_UNAUTHORIZED | typeof TYPE_FORBIDDEN | typeof TYPE_NOT_FOUND | typeof TYPE_UNPROCESSABLE | typeof TYPE_TOO_MANY_REQUESTS | typeof TYPE_NETWORK_ERROR | typeof TYPE_AGENT_UNAVAILABLE;
+export declare const AGENT_ERROR_TYPE_MAP: Record<string, BffErrorType>;
+export declare function mapAgentError(error: unknown, { logger }: {
+    logger: Logger;
+}): BffHttpError;
+export {};
+//# sourceMappingURL=agent-error-mapper.d.ts.map

package/dist/http/agent-error-mapper.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_ERROR_TYPE_MAP = void 0;
+exports.mapAgentError = mapAgentError;
+const agent_client_1 = require("@forestadmin/agent-client");
+const bff_http_error_1 = require("./bff-http-error");
+const TYPE_INVALID_REQUEST = 'invalid_request';
+const TYPE_VALIDATION_ERROR = 'validation_error';
+const TYPE_UNAUTHORIZED = 'unauthorized';
+const TYPE_FORBIDDEN = 'forbidden';
+const TYPE_NOT_FOUND = 'not_found';
+const TYPE_UNPROCESSABLE = 'unprocessable_entity';
+const TYPE_TOO_MANY_REQUESTS = 'too_many_requests';
+const TYPE_NETWORK_ERROR = 'network_error';
+const TYPE_AGENT_UNAVAILABLE = 'agent_unavailable';
+const DEFAULT_NETWORK_MESSAGE = 'The agent could not be reached';
+const DEFAULT_UNAVAILABLE_MESSAGE = 'The agent is unavailable';
+const DEFAULT_ERROR_MESSAGE = 'Unexpected error';
+exports.AGENT_ERROR_TYPE_MAP = {
+    ValidationError: TYPE_VALIDATION_ERROR,
+    BadRequestError: TYPE_INVALID_REQUEST,
+    UnauthorizedError: TYPE_UNAUTHORIZED,
+    ForbiddenError: TYPE_FORBIDDEN,
+    NotFoundError: TYPE_NOT_FOUND,
+    UnprocessableError: TYPE_UNPROCESSABLE,
+    TooManyRequestsError: TYPE_TOO_MANY_REQUESTS,
+};
+const FALLBACK_TYPE_BY_STATUS = {
+    400: TYPE_INVALID_REQUEST,
+    401: TYPE_UNAUTHORIZED,
+    403: TYPE_FORBIDDEN,
+    404: TYPE_NOT_FOUND,
+    422: TYPE_UNPROCESSABLE,
+    429: TYPE_TOO_MANY_REQUESTS,
+};
+function coerceStatus(status, fallback) {
+    const parsed = typeof status === 'string' ? Number(status) : status;
+    return typeof parsed === 'number' && Number.isFinite(parsed) ? parsed : fallback;
+}
+function fallbackTypeByStatus(status) {
+    return FALLBACK_TYPE_BY_STATUS[status] ?? TYPE_INVALID_REQUEST;
+}
+function agentUnavailable() {
+    return new bff_http_error_1.BffHttpError(503, TYPE_AGENT_UNAVAILABLE, DEFAULT_UNAVAILABLE_MESSAGE);
+}
+function firstJsonApiError(body) {
+    if (typeof body !== 'object' || body === null)
+        return undefined;
+    const { errors } = body;
+    return Array.isArray(errors) ? errors[0] : undefined;
+}
+function mapJsonApiError(agentError, fallbackStatus, logger) {
+    const bodyStatus = coerceStatus(agentError.status, fallbackStatus);
+    // Never surface an upstream failure as a 2xx/3xx: ignore a non-error body status.
+    const status = bodyStatus >= 400 ? bodyStatus : fallbackStatus;
+    // The wrapped-message path skips the outer AgentHttpError 5xx check, so normalize here too.
+    if (status >= 500)
+        return agentUnavailable();
+    const message = agentError.detail ?? agentError.message ?? DEFAULT_ERROR_MESSAGE;
+    const mappedType = agentError.name ? exports.AGENT_ERROR_TYPE_MAP[agentError.name] : undefined;
+    if (agentError.name && mappedType === undefined) {
+        logger('Warn', 'Unmapped agent error name; using status-derived type', {
+            name: agentError.name,
+            status,
+        });
+    }
+    return new bff_http_error_1.BffHttpError(status, mappedType ?? fallbackTypeByStatus(status), message, agentError.data);
+}
+function parseJsonApiFromMessage(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    try {
+        return firstJsonApiError(JSON.parse(error.message));
+    }
+    catch {
+        return undefined;
+    }
+}
+function mapFlatBody(status, body, responseText) {
+    const flat = (typeof body === 'object' && body !== null ? body : {});
+    const message = (typeof flat.error === 'string' ? flat.error : undefined) ??
+        (typeof flat.message === 'string' ? flat.message : undefined) ??
+        (typeof responseText === 'string' && responseText !== '' ? responseText : undefined) ??
+        DEFAULT_ERROR_MESSAGE;
+    return new bff_http_error_1.BffHttpError(status, fallbackTypeByStatus(status), message);
+}
+function mapAgentError(error, { logger }) {
+    // A BFF-origin error that reached here (e.g. thrown inside a caller's agent-call try/catch) keeps
+    // its own type — it must not be recategorized as a transport/agent error.
+    if (error instanceof bff_http_error_1.BffHttpError)
+        return error;
+    if (!(error instanceof agent_client_1.AgentHttpError)) {
+        const agentError = parseJsonApiFromMessage(error);
+        if (agentError)
+            return mapJsonApiError(agentError, 400, logger);
+        // No HTTP response: treated as a transport failure reaching the agent. Log the real cause but
+        // return a generic message — transport errors embed internal topology (hostnames/IPs) that must
+        // not leak to the client. Semantic agent-client errors (action form validation / approval
+        // outcomes) are NOT transport failures: the action endpoint catches and maps those before this
+        // fallback. Callers must scope their try/catch to the agent call so a local BFF bug surfaces as
+        // a 500 through the error middleware rather than being mislabelled here.
+        logger('Warn', 'Agent transport failure mapped to network_error', {
+            cause: error instanceof Error ? error.message : String(error),
+        });
+        return new bff_http_error_1.BffHttpError(502, TYPE_NETWORK_ERROR, DEFAULT_NETWORK_MESSAGE);
+    }
+    if (error.status >= 500)
+        return agentUnavailable();
+    const agentError = firstJsonApiError(error.body);
+    if (agentError)
+        return mapJsonApiError(agentError, error.status, logger);
+    return mapFlatBody(error.status, error.body, error.responseText);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtZXJyb3ItbWFwcGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2h0dHAvYWdlbnQtZXJyb3ItbWFwcGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQXNJQSxzQ0E0QkM7QUFoS0QsNERBQTJEO0FBRTNELHFEQUFnRDtBQUVoRCxNQUFNLG9CQUFvQixHQUFHLGlCQUFpQixDQUFDO0FBQy9DLE1BQU0scUJBQXFCLEdBQUcsa0JBQWtCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxjQUFjLENBQUM7QUFDekMsTUFBTSxjQUFjLEdBQUcsV0FBVyxDQUFDO0FBQ25DLE1BQU0sY0FBYyxHQUFHLFdBQVcsQ0FBQztBQUNuQyxNQUFNLGtCQUFrQixHQUFHLHNCQUFzQixDQUFDO0FBQ2xELE1BQU0sc0JBQXNCLEdBQUcsbUJBQW1CLENBQUM7QUFDbkQsTUFBTSxrQkFBa0IsR0FBRyxlQUFlLENBQUM7QUFDM0MsTUFBTSxzQkFBc0IsR0FBRyxtQkFBbUIsQ0FBQztBQWFuRCxNQUFNLHVCQUF1QixHQUFHLGdDQUFnQyxDQUFDO0FBQ2pFLE1BQU0sMkJBQTJCLEdBQUcsMEJBQTBCLENBQUM7QUFDL0QsTUFBTSxxQkFBcUIsR0FBRyxrQkFBa0IsQ0FBQztBQUVwQyxRQUFBLG9CQUFvQixHQUFpQztJQUNoRSxlQUFlLEVBQUUscUJBQXFCO0lBQ3RDLGVBQWUsRUFBRSxvQkFBb0I7SUFDckMsaUJBQWlCLEVBQUUsaUJBQWlCO0lBQ3BDLGNBQWMsRUFBRSxjQUFjO0lBQzlCLGFBQWEsRUFBRSxjQUFjO0lBQzdCLGtCQUFrQixFQUFFLGtCQUFrQjtJQUN0QyxvQkFBb0IsRUFBRSxzQkFBc0I7Q0FDN0MsQ0FBQztBQUVGLE1BQU0sdUJBQXVCLEdBQWlDO0lBQzVELEdBQUcsRUFBRSxvQkFBb0I7SUFDekIsR0FBRyxFQUFFLGlCQUFpQjtJQUN0QixHQUFHLEVBQUUsY0FBYztJQUNuQixHQUFHLEVBQUUsY0FBYztJQUNuQixHQUFHLEVBQUUsa0JBQWtCO0lBQ3ZCLEdBQUcsRUFBRSxzQkFBc0I7Q0FDNUIsQ0FBQztBQVVGLFNBQVMsWUFBWSxDQUFDLE1BQW1DLEVBQUUsUUFBZ0I7SUFDekUsTUFBTSxNQUFNLEdBQUcsT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUVwRSxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQztBQUNuRixDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxNQUFjO0lBQzFDLE9BQU8sdUJBQXVCLENBQUMsTUFBTSxDQUFDLElBQUksb0JBQW9CLENBQUM7QUFDakUsQ0FBQztBQUVELFNBQVMsZ0JBQWdCO0lBQ3ZCLE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSxzQkFBc0IsRUFBRSwyQkFBMkIsQ0FBQyxDQUFDO0FBQ3BGLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLElBQWE7SUFDdEMsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUk7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUVoRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsSUFBNEIsQ0FBQztJQUVoRCxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFFLE1BQU0sQ0FBQyxDQUFDLENBQXVCLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUM5RSxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQ3RCLFVBQTZCLEVBQzdCLGNBQXNCLEVBQ3RCLE1BQWM7SUFFZCxNQUFNLFVBQVUsR0FBRyxZQUFZLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxjQUFjLENBQUMsQ0FBQztJQUNuRSxrRkFBa0Y7SUFDbEYsTUFBTSxNQUFNLEdBQUcsVUFBVSxJQUFJLEdBQUcsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUM7SUFFL0QsNEZBQTRGO0lBQzVGLElBQUksTUFBTSxJQUFJLEdBQUc7UUFBRSxPQUFPLGdCQUFnQixFQUFFLENBQUM7SUFFN0MsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsT0FBTyxJQUFJLHFCQUFxQixDQUFDO0lBQ2pGLE1BQU0sVUFBVSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLDRCQUFvQixDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBRXZGLElBQUksVUFBVSxDQUFDLElBQUksSUFBSSxVQUFVLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLE1BQU0sRUFBRSxzREFBc0QsRUFBRTtZQUNyRSxJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7WUFDckIsTUFBTTtTQUNQLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxPQUFPLElBQUksNkJBQVksQ0FDckIsTUFBTSxFQUNOLFVBQVUsSUFBSSxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsRUFDMUMsT0FBTyxFQUNQLFVBQVUsQ0FBQyxJQUFJLENBQ2hCLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyx1QkFBdUIsQ0FBQyxLQUFjO0lBQzdDLElBQUksQ0FBQyxDQUFDLEtBQUssWUFBWSxLQUFLLENBQUM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUVoRCxJQUFJLENBQUM7UUFDSCxPQUFPLGlCQUFpQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsTUFBYyxFQUFFLElBQWEsRUFBRSxZQUFxQjtJQUN2RSxNQUFNLElBQUksR0FBRyxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FHbEUsQ0FBQztJQUNGLE1BQU0sT0FBTyxHQUNYLENBQUMsT0FBTyxJQUFJLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3pELENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzdELENBQUMsT0FBTyxZQUFZLEtBQUssUUFBUSxJQUFJLFlBQVksS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3BGLHFCQUFxQixDQUFDO0lBRXhCLE9BQU8sSUFBSSw2QkFBWSxDQUFDLE1BQU0sRUFBRSxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUN6RSxDQUFDO0FBRUQsU0FBZ0IsYUFBYSxDQUFDLEtBQWMsRUFBRSxFQUFFLE1BQU0sRUFBc0I7SUFDMUUsa0dBQWtHO0lBQ2xHLDBFQUEwRTtJQUMxRSxJQUFJLEtBQUssWUFBWSw2QkFBWTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBRWhELElBQUksQ0FBQyxDQUFDLEtBQUssWUFBWSw2QkFBYyxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLFVBQVUsR0FBRyx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsRCxJQUFJLFVBQVU7WUFBRSxPQUFPLGVBQWUsQ0FBQyxVQUFVLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRWhFLDhGQUE4RjtRQUM5RixnR0FBZ0c7UUFDaEcsMEZBQTBGO1FBQzFGLCtGQUErRjtRQUMvRixnR0FBZ0c7UUFDaEcseUVBQXlFO1FBQ3pFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsaURBQWlELEVBQUU7WUFDaEUsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7U0FDOUQsQ0FBQyxDQUFDO1FBRUgsT0FBTyxJQUFJLDZCQUFZLENBQUMsR0FBRyxFQUFFLGtCQUFrQixFQUFFLHVCQUF1QixDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVELElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHO1FBQUUsT0FBTyxnQkFBZ0IsRUFBRSxDQUFDO0lBRW5ELE1BQU0sVUFBVSxHQUFHLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxJQUFJLFVBQVU7UUFBRSxPQUFPLGVBQWUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUV6RSxPQUFPLFdBQVcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ25FLENBQUMifQ==

package/dist/http/agent-route-helpers.d.ts

@@ -0,0 +1,9 @@
+import type { Logger } from '../ports/logger-port';
+import type ReadModel from '../read-model/read-model';
+import type ReadModelStore from '../read-model/read-model-store';
+import type { Context } from 'koa';
+export declare function decodeSegment(raw: string, label: string): string;
+export declare function resolveReadModel(store: ReadModelStore): Promise<ReadModel>;
+export declare function requireAgentToken(ctx: Context): string;
+export declare function callAgent<T>(fn: () => Promise<T>, logger: Logger): Promise<T>;
+//# sourceMappingURL=agent-route-helpers.d.ts.map

package/dist/http/agent-route-helpers.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeSegment = decodeSegment;
+exports.resolveReadModel = resolveReadModel;
+exports.requireAgentToken = requireAgentToken;
+exports.callAgent = callAgent;
+const agent_error_mapper_1 = require("./agent-error-mapper");
+const bff_http_error_1 = require("./bff-http-error");
+const bff_local_errors_1 = require("./bff-local-errors");
+const errors_1 = __importDefault(require("../read-model/errors"));
+function decodeSegment(raw, label) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        throw (0, bff_local_errors_1.invalidRequest)(`Malformed ${label} in path`);
+    }
+}
+async function resolveReadModel(store) {
+    try {
+        return await store.getReadModel();
+    }
+    catch (error) {
+        if (error instanceof errors_1.default)
+            throw (0, bff_local_errors_1.schemaUnavailable)();
+        throw error;
+    }
+}
+// The agent token is minted only on the API-key path; the OAuth path sets a principal but no agent
+// token yet. Fail closed instead of calling the agent with `Bearer undefined`.
+// TODO(PRD-637): mint an agent token from the OAuth principal so agent routes work in OAuth mode.
+function requireAgentToken(ctx) {
+    const token = ctx.state.agentToken;
+    if (!token)
+        throw (0, bff_http_error_1.unauthorized)('No agent credentials for this request');
+    return token;
+}
+// Only the agent call is wrapped: guard, query-building and mapping errors are BFF-origin and must
+// keep their own type, not be recategorized as agent errors.
+async function callAgent(fn, logger) {
+    try {
+        return await fn();
+    }
+    catch (error) {
+        throw (0, agent_error_mapper_1.mapAgentError)(error, { logger });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtcm91dGUtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9odHRwL2FnZW50LXJvdXRlLWhlbHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFVQSxzQ0FNQztBQUVELDRDQU9DO0FBS0QsOENBS0M7QUFJRCw4QkFNQztBQXhDRCw2REFBcUQ7QUFDckQscURBQWdEO0FBQ2hELHlEQUF1RTtBQUN2RSxrRUFBMEQ7QUFFMUQsU0FBZ0IsYUFBYSxDQUFDLEdBQVcsRUFBRSxLQUFhO0lBQ3RELElBQUksQ0FBQztRQUNILE9BQU8sa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNyRCxDQUFDO0FBQ0gsQ0FBQztBQUVNLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxLQUFxQjtJQUMxRCxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksZ0JBQXNCO1lBQUUsTUFBTSxJQUFBLG9DQUFpQixHQUFFLENBQUM7UUFDdkUsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELG1HQUFtRztBQUNuRywrRUFBK0U7QUFDL0Usa0dBQWtHO0FBQ2xHLFNBQWdCLGlCQUFpQixDQUFDLEdBQVk7SUFDNUMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFnQyxDQUFDO0lBQ3pELElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFBLDZCQUFZLEVBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUV4RSxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxtR0FBbUc7QUFDbkcsNkRBQTZEO0FBQ3RELEtBQUssVUFBVSxTQUFTLENBQUksRUFBb0IsRUFBRSxNQUFjO0lBQ3JFLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxFQUFFLEVBQUUsQ0FBQztJQUNwQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBQSxrQ0FBYSxFQUFDLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDekMsQ0FBQztBQUNILENBQUMifQ==

package/dist/http/bff-local-errors.d.ts

@@ -0,0 +1,12 @@
+import { BffHttpError } from './bff-http-error';
+export declare function unknownCollection(message?: string): BffHttpError;
+export declare function unknownRelation(message?: string): BffHttpError;
+export declare function unknownAction(message?: string): BffHttpError;
+export declare function collectionNotAllowed(message?: string): BffHttpError;
+export declare function relationNotAllowed(message?: string): BffHttpError;
+export declare function actionNotAllowed(message?: string): BffHttpError;
+export declare function invalidRequest(message?: string, details?: unknown): BffHttpError;
+export declare function mappingError(message?: string): BffHttpError;
+export declare function schemaUnavailable(message?: string): BffHttpError;
+export declare function unsupportedActionResult(message?: string): BffHttpError;
+//# sourceMappingURL=bff-local-errors.d.ts.map

package/dist/http/bff-local-errors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unknownCollection = unknownCollection;
+exports.unknownRelation = unknownRelation;
+exports.unknownAction = unknownAction;
+exports.collectionNotAllowed = collectionNotAllowed;
+exports.relationNotAllowed = relationNotAllowed;
+exports.actionNotAllowed = actionNotAllowed;
+exports.invalidRequest = invalidRequest;
+exports.mappingError = mappingError;
+exports.schemaUnavailable = schemaUnavailable;
+exports.unsupportedActionResult = unsupportedActionResult;
+const bff_http_error_1 = require("./bff-http-error");
+function unknownCollection(message = 'Unknown collection') {
+    return new bff_http_error_1.BffHttpError(404, 'unknown_collection', message);
+}
+function unknownRelation(message = 'Unknown relation') {
+    return new bff_http_error_1.BffHttpError(404, 'unknown_relation', message);
+}
+function unknownAction(message = 'Unknown action') {
+    return new bff_http_error_1.BffHttpError(404, 'unknown_action', message);
+}
+function collectionNotAllowed(message = 'Collection is not allowed') {
+    return new bff_http_error_1.BffHttpError(403, 'collection_not_allowed', message);
+}
+function relationNotAllowed(message = 'Relation is not allowed') {
+    return new bff_http_error_1.BffHttpError(403, 'relation_not_allowed', message);
+}
+function actionNotAllowed(message = 'Action is not allowed') {
+    return new bff_http_error_1.BffHttpError(403, 'action_not_allowed', message);
+}
+function invalidRequest(message = 'Invalid request', details) {
+    return new bff_http_error_1.BffHttpError(400, 'invalid_request', message, details);
+}
+function mappingError(message = 'Failed to map the agent response') {
+    return new bff_http_error_1.BffHttpError(500, 'mapping_error', message);
+}
+function schemaUnavailable(message = 'The agent schema is unavailable') {
+    return new bff_http_error_1.BffHttpError(503, 'schema_unavailable', message);
+}
+function unsupportedActionResult(message = 'Unsupported action result') {
+    return new bff_http_error_1.BffHttpError(501, 'unsupported_action_result', message);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLWxvY2FsLWVycm9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9odHRwL2JmZi1sb2NhbC1lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFFQSw4Q0FFQztBQUVELDBDQUVDO0FBRUQsc0NBRUM7QUFFRCxvREFFQztBQUVELGdEQUVDO0FBRUQsNENBRUM7QUFFRCx3Q0FFQztBQUVELG9DQUVDO0FBRUQsOENBRUM7QUFFRCwwREFFQztBQXhDRCxxREFBZ0Q7QUFFaEQsU0FBZ0IsaUJBQWlCLENBQUMsT0FBTyxHQUFHLG9CQUFvQjtJQUM5RCxPQUFPLElBQUksNkJBQVksQ0FBQyxHQUFHLEVBQUUsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDOUQsQ0FBQztBQUVELFNBQWdCLGVBQWUsQ0FBQyxPQUFPLEdBQUcsa0JBQWtCO0lBQzFELE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUM1RCxDQUFDO0FBRUQsU0FBZ0IsYUFBYSxDQUFDLE9BQU8sR0FBRyxnQkFBZ0I7SUFDdEQsT0FBTyxJQUFJLDZCQUFZLENBQUMsR0FBRyxFQUFFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQzFELENBQUM7QUFFRCxTQUFnQixvQkFBb0IsQ0FBQyxPQUFPLEdBQUcsMkJBQTJCO0lBQ3hFLE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSx3QkFBd0IsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUNsRSxDQUFDO0FBRUQsU0FBZ0Isa0JBQWtCLENBQUMsT0FBTyxHQUFHLHlCQUF5QjtJQUNwRSxPQUFPLElBQUksNkJBQVksQ0FBQyxHQUFHLEVBQUUsc0JBQXNCLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDaEUsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLE9BQU8sR0FBRyx1QkFBdUI7SUFDaEUsT0FBTyxJQUFJLDZCQUFZLENBQUMsR0FBRyxFQUFFLG9CQUFvQixFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQzlELENBQUM7QUFFRCxTQUFnQixjQUFjLENBQUMsT0FBTyxHQUFHLGlCQUFpQixFQUFFLE9BQWlCO0lBQzNFLE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDcEUsQ0FBQztBQUVELFNBQWdCLFlBQVksQ0FBQyxPQUFPLEdBQUcsa0NBQWtDO0lBQ3ZFLE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSxlQUFlLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDekQsQ0FBQztBQUVELFNBQWdCLGlCQUFpQixDQUFDLE9BQU8sR0FBRyxpQ0FBaUM7SUFDM0UsT0FBTyxJQUFJLDZCQUFZLENBQUMsR0FBRyxFQUFFLG9CQUFvQixFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQzlELENBQUM7QUFFRCxTQUFnQix1QkFBdUIsQ0FBQyxPQUFPLEdBQUcsMkJBQTJCO0lBQzNFLE9BQU8sSUFBSSw2QkFBWSxDQUFDLEdBQUcsRUFBRSwyQkFBMkIsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUNyRSxDQUFDIn0=

package/dist/read-model/read-model.d.ts

@@ -10,6 +10,10 @@ export type RelationTarget = {
     polymorphic: true;
     targets: string[];
 };
+export type PrimaryKeyField = {
+    name: string;
+    type: string;
+};
 /**
  * The agent read-model derived from a schema. Names are collection-scoped: relations and actions
  * are keyed by `(collection, name)` so the same relation/action name on two collections stays
@@ -20,13 +24,16 @@ export default class ReadModel {
     private readonly collections;
     private readonly relations;
     private readonly actionEndpoints;
+    private readonly primaryKeys;
     constructor(collections: ForestSchemaCollection[]);
     private buildRelations;
     private buildActionEndpoints;
+    private buildPrimaryKeys;
     isCollectionAllowed(collection: string): boolean;
     isRelationAllowed(collection: string, relation: string): boolean;
     getRelationTarget(collection: string, relation: string): RelationTarget | undefined;
     isActionAllowed(collection: string, action: string): boolean;
     getActionEndpoints(): ActionEndpointsByCollection;
+    getPrimaryKeys(collection: string): PrimaryKeyField[];
 }
 //# sourceMappingURL=read-model.d.ts.map

package/dist/read-model/read-model.js

@@ -34,14 +34,17 @@ class ReadModel {
         // Null-prototype so an action/collection named like an Object.prototype member
         // (`toString`, `constructor`, `__proto__`, …) can't falsely pass the allow-list.
         this.actionEndpoints = Object.create(null);
+        this.primaryKeys = new Map();
         for (const collection of collections) {
             this.collections.add(collection.name);
             this.buildRelations(collection);
             this.buildActionEndpoints(collection);
+            this.buildPrimaryKeys(collection);
         }
         // Freeze the exposed structures so a consumer cannot mutate the shared cached read-model.
         deepFreeze(this.actionEndpoints);
         this.relations.forEach(byRelation => byRelation.forEach(deepFreeze));
+        this.primaryKeys.forEach(deepFreeze);
     }
     buildRelations(collection) {
         const relations = new Map();
@@ -71,6 +74,14 @@ class ReadModel {
             };
         }
     }
+    buildPrimaryKeys(collection) {
+        const keys = [];
+        for (const field of collection.fields ?? []) {
+            if (field.isPrimaryKey)
+                keys.push({ name: field.field, type: field.type });
+        }
+        this.primaryKeys.set(collection.name, keys);
+    }
     isCollectionAllowed(collection) {
         return this.collections.has(collection);
     }
@@ -86,6 +97,9 @@ class ReadModel {
     getActionEndpoints() {
         return this.actionEndpoints;
     }
+    getPrimaryKeys(collection) {
+        return this.primaryKeys.get(collection) ?? [];
+    }
 }
 exports.default = ReadModel;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVhZC1tb2RlbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9yZWFkLW1vZGVsL3JlYWQtbW9kZWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFTQSxTQUFTLGdCQUFnQixDQUFDLEtBQXdCO0lBQ2hELElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXJDLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7SUFFaEMsSUFBSSxLQUFLLENBQUMsMkJBQTJCLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RixPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsMkJBQTJCLENBQUMsRUFBRSxDQUFDO0lBQ3RGLENBQUM7SUFFRCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNwQiwwRkFBMEY7UUFDMUYseUZBQXlGO1FBQ3pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ2pHLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBSSxLQUFRO0lBQzdCLElBQUksS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBZ0MsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNwRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQXFCLFNBQVM7SUFLNUIsWUFBWSxXQUFxQztRQUMvQyxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUM7UUFDN0IsSUFBSSxDQUFDLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBRSxDQUFDO1FBQzNCLCtFQUErRTtRQUMvRSxpRkFBaUY7UUFDakYsSUFBSSxDQUFDLGVBQWUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBZ0MsQ0FBQztRQUUxRSxLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ3JDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN0QyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2hDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxDQUFDO1FBRUQsMEZBQTBGO1FBQzFGLFVBQVUsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUVPLGNBQWMsQ0FBQyxVQUFrQztRQUN2RCxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBMEIsQ0FBQztRQUVwRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFVBQVUsQ0FBQyxNQUFNLElBQUksRUFBRSxFQUFFLENBQUM7WUFDNUMsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDdkMsSUFBSSxNQUFNO2dCQUFFLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNqRCxDQUFDO1FBRUQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxTQUFTLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRU8sb0JBQW9CLENBQUMsVUFBa0M7UUFDN0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDekMsTUFBTSxZQUFZLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUV4RSxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU87UUFFdEMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUU1RCxLQUFLLE1BQU0sTUFBTSxJQUFJLFlBQVksRUFBRSxDQUFDO1lBQ2xDLHVGQUF1RjtZQUN2RixvRkFBb0Y7WUFDcEYseUVBQXlFO1lBQ3pFLElBQUksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRztnQkFDbkQsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFO2dCQUNiLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTtnQkFDakIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO2dCQUN6QixLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLElBQUksS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyxFQUFFO2dCQUN2RixNQUFNLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLEtBQUssRUFBRSxDQUFDLENBQUM7YUFDM0QsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsbUJBQW1CLENBQUMsVUFBa0I7UUFDcEMsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQsaUJBQWlCLENBQUMsVUFBa0IsRUFBRSxRQUFnQjtRQUNwRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLENBQUM7SUFDaEUsQ0FBQztJQUVELGlCQUFpQixDQUFDLFVBQWtCLEVBQUUsUUFBZ0I7UUFDcEQsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELGVBQWUsQ0FBQyxVQUFrQixFQUFFLE1BQWM7UUFDaEQsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssU0FBUyxDQUFDO0lBQ2xFLENBQUM7SUFFRCxrQkFBa0I7UUFDaEIsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDO0lBQzlCLENBQUM7Q0FDRjtBQTNFRCw0QkEyRUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVhZC1tb2RlbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9yZWFkLW1vZGVsL3JlYWQtbW9kZWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFXQSxTQUFTLGdCQUFnQixDQUFDLEtBQXdCO0lBQ2hELElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXJDLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7SUFFaEMsSUFBSSxLQUFLLENBQUMsMkJBQTJCLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RixPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsMkJBQTJCLENBQUMsRUFBRSxDQUFDO0lBQ3RGLENBQUM7SUFFRCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNwQiwwRkFBMEY7UUFDMUYseUZBQXlGO1FBQ3pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ2pHLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBSSxLQUFRO0lBQzdCLElBQUksS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBZ0MsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNwRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQXFCLFNBQVM7SUFNNUIsWUFBWSxXQUFxQztRQUMvQyxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUM7UUFDN0IsSUFBSSxDQUFDLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBRSxDQUFDO1FBQzNCLCtFQUErRTtRQUMvRSxpRkFBaUY7UUFDakYsSUFBSSxDQUFDLGVBQWUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBZ0MsQ0FBQztRQUMxRSxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUM7UUFFN0IsS0FBSyxNQUFNLFVBQVUsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNyQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDdEMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNoQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdEMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3BDLENBQUM7UUFFRCwwRkFBMEY7UUFDMUYsVUFBVSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRU8sY0FBYyxDQUFDLFVBQWtDO1FBQ3ZELE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUEwQixDQUFDO1FBRXBELEtBQUssTUFBTSxLQUFLLElBQUksVUFBVSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUM1QyxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN2QyxJQUFJLE1BQU07Z0JBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFFRCxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFTyxvQkFBb0IsQ0FBQyxVQUFrQztRQUM3RCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztRQUN6QyxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBRXhFLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTztRQUV0QyxJQUFJLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRTVELEtBQUssTUFBTSxNQUFNLElBQUksWUFBWSxFQUFFLENBQUM7WUFDbEMsdUZBQXVGO1lBQ3ZGLG9GQUFvRjtZQUNwRix5RUFBeUU7WUFDekUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHO2dCQUNuRCxFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUU7Z0JBQ2IsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJO2dCQUNqQixRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7Z0JBQ3pCLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLElBQUksSUFBSSxLQUFLLEVBQUUsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQUU7Z0JBQ3ZGLE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsS0FBSyxFQUFFLENBQUMsQ0FBQzthQUMzRCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxVQUFrQztRQUN6RCxNQUFNLElBQUksR0FBc0IsRUFBRSxDQUFDO1FBRW5DLEtBQUssTUFBTSxLQUFLLElBQUksVUFBVSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUM1QyxJQUFJLEtBQUssQ0FBQyxZQUFZO2dCQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDN0UsQ0FBQztRQUVELElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVELG1CQUFtQixDQUFDLFVBQWtCO1FBQ3BDLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVELGlCQUFpQixDQUFDLFVBQWtCLEVBQUUsUUFBZ0I7UUFDcEQsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxDQUFDO0lBQ2hFLENBQUM7SUFFRCxpQkFBaUIsQ0FBQyxVQUFrQixFQUFFLFFBQWdCO1FBQ3BELE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRCxlQUFlLENBQUMsVUFBa0IsRUFBRSxNQUFjO1FBQ2hELE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLFNBQVMsQ0FBQztJQUNsRSxDQUFDO0lBRUQsa0JBQWtCO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQztJQUM5QixDQUFDO0lBRUQsY0FBYyxDQUFDLFVBQWtCO1FBQy9CLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hELENBQUM7Q0FDRjtBQTdGRCw0QkE2RkMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent-bff",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "main": "dist/index.js",
   "bin": {
     "forest-bff": "dist/cli.js"