@forestadmin/agent 1.99.2 → 1.100.0

package/dist/agent.d.ts

@@ -1,5 +1,5 @@
 import type { ForestAdminHttpDriverServices } from './services';
-import type { AgentOptions, AgentOptionsWithDefaults, WorkflowExecutorEmbedOptions } from './types';
+import type { AgentOptions, AgentOptionsWithDefaults, BffEmbedOptions, WorkflowExecutorEmbedOptions } from './types';
 import type { CollectionCustomizer, DataSourceChartDefinition, DataSourceOptions, Plugin, TCollectionName, TSchema } from '@forestadmin/datasource-customizer';
 import type { DataSource, DataSourceFactory } from '@forestadmin/datasource-toolkit';
 import type { FileUploadsOptions, TokenTtlOptions, ToolName } from '@forestadmin/mcp-server';
@@ -32,7 +32,15 @@ export default class Agent<S extends TSchema = TSchema> extends FrameworkMounter
     private mcpFileUploads?;
     /** In-process workflow executor, created only when addWorkflowExecutor() is called. */
     private embeddedExecutor;
+    /** In-process BFF, created only when addBff() is called. */
+    private embeddedBff;
     private isRestarting;
+    /**
+     * Set as soon as start() begins, not once it finishes: mount() drains the `onFirstStart` hooks
+     * partway through, so a builder call landing mid-startup is already too late. Cleared again when
+     * startup fails, which leaves nothing mounted and makes the agent configurable once more.
+     */
+    private startupBegun;
     /**
      * Create a new Agent Builder.
      * If any options are missing, the default will be applied:
@@ -179,6 +187,31 @@ export default class Agent<S extends TSchema = TSchema> extends FrameworkMounter
      *   .start();
      */
     addWorkflowExecutor(options?: WorkflowExecutorEmbedOptions): this;
+    /**
+     * Serve a BFF in-process, alongside the agent, at `/bff` — no second deployment, no second port.
+     * The agent builds it on start(), stops it on stop(), and hands it a dispatcher that reaches its
+     * own stack without a socket, so this works the same on every mount target.
+     *
+     * Requires the `@forestadmin/agent-bff` package to be installed:
+     * ```bash
+     * npm install @forestadmin/agent-bff
+     * ```
+     *
+     * The secrets, the Forest urls and the logger are inherited from the agent. Everything left is
+     * a feature the BFF switches on when configured: `tokenEncryptionKey` enables OAuth (and with it
+     * the AI relay), `allowedOrigins` enables browser access, `openapiEnabled` serves the docs.
+     *
+     * @param options embedded BFF options
+     * @returns the agent instance for chaining
+     * @throws Error if called more than once, or if the MCP server already claims `/bff`
+     *
+     * @example
+     * createAgent(options)
+     *   .addDataSource(...)
+     *   .addBff({ allowedOrigins: ['https://my-app.com'] })
+     *   .start();
+     */
+    addBff(options?: BffEmbedOptions): this;
     protected getRoutes(dataSource: DataSource, services: ForestAdminHttpDriverServices): import("./routes/base-route").default[];
     /**
      * Create an http handler which can respond to all queries which are expected from an agent.

package/dist/agent.js

@@ -43,6 +43,8 @@ const router_1 = __importDefault(require("@koa/router"));
 const promises_1 = require("fs/promises");
 const json_stringify_pretty_compact_1 = __importDefault(require("json-stringify-pretty-compact"));
 const audit_trail_1 = require("./audit-trail");
+const bff_routes_1 = require("./bff-routes");
+const embedded_bff_1 = __importDefault(require("./embedded-bff"));
 const embedded_workflow_executor_1 = __importDefault(require("./embedded-workflow-executor"));
 const framework_mounter_1 = __importDefault(require("./framework-mounter"));
 const routes_1 = __importDefault(require("./routes"));
@@ -51,6 +53,12 @@ const customization_1 = __importDefault(require("./services/model-customizations
 const correlation_id_1 = require("./utils/correlation-id");
 const generator_1 = __importDefault(require("./utils/forest-schema/generator"));
 const options_validator_1 = __importDefault(require("./utils/options-validator"));
+// Whichever is registered second raises it. `addBff()` registers at builder time and the MCP
+// server only at start(), and the root middleware answers with the first handler whose matcher
+// claims the url — so the BFF wins and the whole MCP surface would go silently dark.
+const bffMcpCollision = (mcpBasePath) => `Cannot use addBff together with mountAiMcpServer({ basePath: '${mcpBasePath}' }): the MCP ` +
+    `server would claim ${bff_routes_1.BFF_PREFIX} paths the embedded BFF answers on (${bff_routes_1.BFF_PREFIX}/oauth, ` +
+    `${bff_routes_1.BFF_PREFIX}/mcp). Mount the MCP server elsewhere.`;
 /**
  * Allow to create a new Forest Admin agent from scratch.
  * Builds the application by composing and configuring all the collection decorators.
@@ -85,7 +93,15 @@ class Agent extends framework_mounter_1.default {
         this.mcpEnabled = false;
         /** In-process workflow executor, created only when addWorkflowExecutor() is called. */
         this.embeddedExecutor = null;
+        /** In-process BFF, created only when addBff() is called. */
+        this.embeddedBff = null;
         this.isRestarting = false;
+        /**
+         * Set as soon as start() begins, not once it finishes: mount() drains the `onFirstStart` hooks
+         * partway through, so a builder call landing mid-startup is already too late. Cleared again when
+         * startup fails, which leaves nothing mounted and makes the agent configurable once more.
+         */
+        this.startupBegun = false;
         this.options = allOptions;
         this.customizer = new datasource_customizer_1.DataSourceCustomizer({
             ignoreMissingSchemaElementErrors: options.ignoreMissingSchemaElementErrors || false,
@@ -98,18 +114,31 @@ class Agent extends framework_mounter_1.default {
      */
     async start() {
         let mounted = false;
+        this.startupBegun = true;
         try {
-            const { router, mcpHttpCallback, mcpIsMcpRoute } = await this.buildRouterAndSendSchema();
+            // First, before anything is mounted or subscribed: everything it validates is what the caller
+            // handed to addBff(), so a mistyped key must fail on that line rather than leave the host
+            // serving /forest with a permanently bricked /bff.
+            await this.embeddedBff?.prepare();
+            const { router, mcp } = await this.buildRouterAndSendSchema();
             await this.options.forestAdminClient.subscribeToServerEvents();
             this.options.forestAdminClient.onRefreshCustomizations(this.restart.bind(this));
-            this.setMcpCallback(mcpHttpCallback ?? null, mcpIsMcpRoute);
+            this.setMcpCallback(mcp ?? null);
             await this.mount(router);
             mounted = true;
             // Boot after mount(): the embedded executor reaches the agent over HTTP, and the
             // standalone server's host/port (used to derive that URL) are only known once mounted.
             await this.embeddedExecutor?.start(this.standaloneServerHost, this.standaloneServerPort);
+            // Same reason, without the socket: the dispatcher injects into the stack mount() just built.
+            await this.embeddedBff?.start(this.getInProcessDispatcher());
         }
         catch (error) {
+            // Only when nothing was mounted. Past mount() the host framework is already serving this
+            // agent, so it is not configurable again: clearing the flag would let a later addBff() past
+            // its guard and register a BFF whose start() nothing calls — /bff would answer 503 for the
+            // rest of the process, and restart() only invalidates, it never starts it.
+            if (!mounted)
+                this.startupBegun = false;
             const { message } = error;
             this.options.logger('Error', `Forest Admin agent startup failure: ${message}`);
             // buildRouterAndSendSchema() may already have opened the audit-trail connection even
@@ -133,7 +162,10 @@ class Agent extends framework_mounter_1.default {
      * Stop the agent.
      */
     async stop() {
-        // Drain the embedded executor first, while the agent it depends on is still serving.
+        // Stop answering before the stack it dispatches into goes away: the host application keeps
+        // whatever middleware it registered, so a stopped agent would otherwise still serve BFF data.
+        this.embeddedBff?.stop();
+        // Drain the embedded executor next, while the agent it depends on is still serving.
         await this.embeddedExecutor?.stop();
         // Close anything related to ForestAdmin client
         this.options.forestAdminClient.close();
@@ -163,9 +195,11 @@ class Agent extends framework_mounter_1.default {
         this.isRestarting = true;
         try {
             // We force sending schema when restarting
-            const { router, mcpHttpCallback, mcpIsMcpRoute } = await this.buildRouterAndSendSchema();
-            this.setMcpCallback(mcpHttpCallback ?? null, mcpIsMcpRoute);
+            const { router, mcp } = await this.buildRouterAndSendSchema();
+            this.setMcpCallback(mcp ?? null);
             await this.remount(router);
+            // A restart means the customizations changed, so the schema the BFF read is stale.
+            this.embeddedBff?.invalidate();
         }
         finally {
             this.isRestarting = false;
@@ -277,6 +311,9 @@ class Agent extends framework_mounter_1.default {
      * agent.mountAiMcpServer({ fileUploads: false });
      */
     mountAiMcpServer(options) {
+        if (this.embeddedBff && (0, bff_routes_1.collidesWithBff)(options?.basePath)) {
+            throw new Error(bffMcpCollision(options?.basePath));
+        }
         this.mcpEnabled = true;
         this.mcpEnabledTools = options?.enabledTools;
         this.mcpBasePath = options?.basePath;
@@ -320,6 +357,54 @@ class Agent extends framework_mounter_1.default {
         this.embeddedExecutor = executor;
         return this;
     }
+    /**
+     * Serve a BFF in-process, alongside the agent, at `/bff` — no second deployment, no second port.
+     * The agent builds it on start(), stops it on stop(), and hands it a dispatcher that reaches its
+     * own stack without a socket, so this works the same on every mount target.
+     *
+     * Requires the `@forestadmin/agent-bff` package to be installed:
+     * ```bash
+     * npm install @forestadmin/agent-bff
+     * ```
+     *
+     * The secrets, the Forest urls and the logger are inherited from the agent. Everything left is
+     * a feature the BFF switches on when configured: `tokenEncryptionKey` enables OAuth (and with it
+     * the AI relay), `allowedOrigins` enables browser access, `openapiEnabled` serves the docs.
+     *
+     * @param options embedded BFF options
+     * @returns the agent instance for chaining
+     * @throws Error if called more than once, or if the MCP server already claims `/bff`
+     *
+     * @example
+     * createAgent(options)
+     *   .addDataSource(...)
+     *   .addBff({ allowedOrigins: ['https://my-app.com'] })
+     *   .start();
+     */
+    addBff(options = {}) {
+        if (this.embeddedBff) {
+            throw new Error('addBff can only be called once.');
+        }
+        // Refused rather than accepted and left dark: once startup has begun the dispatcher hook has no
+        // mount left to attach to and nothing calls the BFF's own start(), so `/bff` would answer 503
+        // for the rest of the process while every other route works. A throw on the line the developer
+        // wrote instead. Refused from the first line of start(), not from its last: `start()` is async,
+        // so a call made while it is still in flight is just as late.
+        if (this.startupBegun) {
+            throw new Error('addBff must be called before start(): the agent is already starting.');
+        }
+        if ((0, bff_routes_1.collidesWithBff)(this.mcpBasePath)) {
+            throw new Error(bffMcpCollision(this.mcpBasePath));
+        }
+        const bff = new embedded_bff_1.default(this.options, options);
+        this.embeddedBff = bff;
+        // Registered now rather than at start(): getInProcessDispatcher() pushes its hook the first
+        // time it is called, and mount() only runs the hooks registered before it — asked for later,
+        // the dispatcher would have no handler until the first restart.
+        this.getInProcessDispatcher();
+        this.setBffCallback(bff.handle);
+        return this;
+    }
     getRoutes(dataSource, services) {
         return (0, routes_1.default)(dataSource, this.options, services);
     }
@@ -333,11 +418,9 @@ class Agent extends framework_mounter_1.default {
         const routes = this.getRoutes(dataSource, services);
         await Promise.all(routes.map(route => route.bootstrap()));
         // Initialize MCP server if enabled via mountAiMcpServer()
-        let mcpHttpCallback;
-        let mcpIsMcpRoute;
+        let mcp;
         if (this.mcpEnabled) {
-            ({ httpCallback: mcpHttpCallback, isMcpRoute: mcpIsMcpRoute } =
-                await this.initializeMcpServer());
+            mcp = await this.initializeMcpServer();
         }
         // Build main router
         const router = new router_1.default();
@@ -355,7 +438,7 @@ class Agent extends framework_mounter_1.default {
         }));
         router.use(correlation_id_1.correlationIdMiddleware);
         routes.forEach(route => route.setupRoutes(router));
-        return { router, mcpHttpCallback, mcpIsMcpRoute };
+        return { router, mcp };
     }
     /**
      * Initialize the MCP server.
@@ -382,11 +465,11 @@ class Agent extends framework_mounter_1.default {
                 fileUploads: this.mcpFileUploads,
                 agentDispatcher: this.getInProcessDispatcher(),
             });
-            const httpCallback = await mcpServer.getHttpCallback();
-            const isMcpRoute = makeIsMcpRoute(this.mcpBasePath);
+            const callback = await mcpServer.getHttpCallback();
+            const matches = makeIsMcpRoute(this.mcpBasePath);
             mcpLogger('Info', 'Server initialized successfully');
             mcpLogger('Info', 'Tool calls dispatch in-process and skip any middleware mounted in front of the agent');
-            return { httpCallback, isMcpRoute };
+            return { callback, matches };
         }
         catch (error) {
             const { message } = error;
@@ -507,4 +590,4 @@ class Agent extends framework_mounter_1.default {
     }
 }
 exports.default = Agent;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvYWdlbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFxQkEsOEVBQTBFO0FBQzFFLGlFQUF5QztBQUN6QyxxREFBNkI7QUFDN0IseURBQWlDO0FBQ2pDLDBDQUFrRDtBQUNsRCxrR0FBc0Q7QUFFdEQsK0NBQXVEO0FBQ3ZELDhGQUFvRTtBQUNwRSw0RUFBbUQ7QUFDbkQsc0RBQWtDO0FBQ2xDLDBEQUFzQztBQUN0QyxrR0FBaUY7QUFDakYsMkRBQXdGO0FBQ3hGLGdGQUE4RDtBQUM5RCxrRkFBeUQ7QUFFekQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBcUIsS0FBbUMsU0FBUSwyQkFBZ0I7SUFvQjlFOzs7Ozs7Ozs7Ozs7Ozs7T0FlRztJQUNILFlBQVksT0FBcUI7UUFDL0IsTUFBTSxVQUFVLEdBQUcsMkJBQWdCLENBQUMsUUFBUSxDQUFDLDJCQUFnQixDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ3JGLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQS9COUMsMkNBQTJDO1FBQ25DLGVBQVUsR0FBRyxLQUFLLENBQUM7UUFPM0IsdUZBQXVGO1FBQy9FLHFCQUFnQixHQUFvQyxJQUFJLENBQUM7UUFFekQsaUJBQVksR0FBRyxLQUFLLENBQUM7UUFzQjNCLElBQUksQ0FBQyxPQUFPLEdBQUcsVUFBVSxDQUFDO1FBQzFCLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSw0Q0FBb0IsQ0FBSTtZQUM1QyxnQ0FBZ0MsRUFBRSxPQUFPLENBQUMsZ0NBQWdDLElBQUksS0FBSztTQUNwRixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsb0JBQW9CLEdBQUcsSUFBSSx1QkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNqRSxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksbUJBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsS0FBSztRQUNULElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztRQUVwQixJQUFJLENBQUM7WUFDSCxNQUFNLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1lBRXpGLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQy9ELElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztZQUVoRixJQUFJLENBQUMsY0FBYyxDQUFDLGVBQWUsSUFBSSxJQUFJLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDNUQsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3pCLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFFZixpRkFBaUY7WUFDakYsdUZBQXVGO1lBQ3ZGLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDM0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsS0FBYyxDQUFDO1lBQ25DLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSx1Q0FBdUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUUvRSxxRkFBcUY7WUFDckYsdUZBQXVGO1lBQ3ZGLDJGQUEyRjtZQUMzRiwwRkFBMEY7WUFDMUYsdUZBQXVGO1lBQ3ZGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDYixJQUFJLENBQUM7b0JBQ0gsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxLQUFLLEVBQUUsQ0FBQztnQkFDekMsQ0FBQztnQkFBQyxPQUFPLFVBQVUsRUFBRSxDQUFDO29CQUNwQixNQUFNLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQW1CLENBQUM7b0JBQ3RELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUNqQixPQUFPLEVBQ1Asd0RBQXdELFlBQVksRUFBRSxDQUN2RSxDQUFDO2dCQUNKLENBQUM7WUFDSCxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ00sS0FBSyxDQUFDLElBQUk7UUFDakIscUZBQXFGO1FBQ3JGLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixFQUFFLElBQUksRUFBRSxDQUFDO1FBQ3BDLCtDQUErQztRQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ3ZDLDRGQUE0RjtRQUM1RiwwRkFBMEY7UUFDMUYsMkZBQTJGO1FBQzNGLHVGQUF1RjtRQUN2RixNQUFNLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUVuQixzRkFBc0Y7UUFDdEYsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUN6QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxLQUFjLENBQUM7WUFDbkMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQ2pCLE9BQU8sRUFDUCx3REFBd0QsT0FBTyxFQUFFLENBQ2xFLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLE9BQU87UUFDWCxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMENBQTBDLENBQUMsQ0FBQztZQUV6RSxPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx3QkFBd0IsQ0FBQyxDQUFDO1FBRXRELElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQztZQUNILDBDQUEwQztZQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1lBRXpGLElBQUksQ0FBQyxjQUFjLENBQUMsZUFBZSxJQUFJLElBQUksRUFBRSxhQUFhLENBQUMsQ0FBQztZQUM1RCxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0IsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxDQUFDLFlBQVksR0FBRyxLQUFLLENBQUM7UUFDNUIsQ0FBQztJQUNILENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILGFBQWEsQ0FBQyxPQUEwQixFQUFFLE9BQTJCO1FBQ25FLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUV6RSxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILEtBQUssQ0FBQyx1QkFBdUIsQ0FBQyxXQUFtQixFQUFFLGVBQXVCO1FBQ3hFLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO1FBQ2hDLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDNUMsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLHVCQUF1QixDQUFDLFdBQVcsRUFBRSxlQUFlLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNILFFBQVEsQ0FBQyxJQUFZLEVBQUUsVUFBd0M7UUFDN0QsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBRTNDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSCxtQkFBbUIsQ0FDakIsSUFBTyxFQUNQLE1BQTJEO1FBRTNELElBQUksQ0FBQyxVQUFVLENBQUMsbUJBQW1CLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRWxELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsZ0JBQWdCLENBQUMsR0FBRyxLQUEyQjtRQUM3QyxJQUFJLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUM7UUFFM0MsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0gsR0FBRyxDQUFVLE1BQXVCLEVBQUUsT0FBaUI7UUFDckQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRXJDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQTZCRztJQUNILGdCQUFnQixDQUFDLE9BTWhCO1FBQ0MsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDdkIsSUFBSSxDQUFDLGVBQWUsR0FBRyxPQUFPLEVBQUUsWUFBWSxDQUFDO1FBQzdDLElBQUksQ0FBQyxXQUFXLEdBQUcsT0FBTyxFQUFFLFFBQVEsQ0FBQztRQUNyQyxJQUFJLENBQUMsV0FBVyxHQUFHLE9BQU8sRUFBRSxRQUFRLENBQUM7UUFDckMsSUFBSSxDQUFDLHNCQUFzQixHQUFHLE9BQU8sRUFBRSxtQkFBbUIsQ0FBQztRQUMzRCxJQUFJLENBQUMsY0FBYyxHQUFHLE9BQU8sRUFBRSxXQUFXLENBQUM7UUFFM0MsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FzQkc7SUFDSCxtQkFBbUIsQ0FBQyxVQUF3QyxFQUFFO1FBQzVELElBQUksSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLG9DQUF3QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1RCw4RkFBOEY7UUFDOUYsd0ZBQXdGO1FBQ3hGLGlGQUFpRjtRQUNoRixJQUFJLENBQUMsT0FBd0IsQ0FBQyxtQkFBbUIsR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pGLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxRQUFRLENBQUM7UUFFakMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRVMsU0FBUyxDQUFDLFVBQXNCLEVBQUUsUUFBdUM7UUFDakYsT0FBTyxJQUFBLGdCQUFVLEVBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVEOzs7T0FHRztJQUNLLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBc0I7UUFLNUMsZ0JBQWdCO1FBQ2hCLE1BQU0sUUFBUSxHQUFHLElBQUEsa0JBQVksRUFBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDNUMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFFcEQsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFELDBEQUEwRDtRQUMxRCxJQUFJLGVBQXlDLENBQUM7UUFDOUMsSUFBSSxhQUEwQyxDQUFDO1FBRS9DLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3BCLENBQUMsRUFBRSxZQUFZLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUU7Z0JBQzNELE1BQU0sSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQztRQUN0QyxDQUFDO1FBRUQsb0JBQW9CO1FBQ3BCLE1BQU0sTUFBTSxHQUFHLElBQUksZ0JBQU0sRUFBRSxDQUFDO1FBQzVCLE1BQU0sQ0FBQyxHQUFHLENBQ1IsTUFBTSxFQUNOLElBQUEsY0FBSSxFQUFDO1lBQ0gsV0FBVyxFQUFFLElBQUk7WUFDakIsTUFBTSxFQUFFLEVBQUUsR0FBRyxJQUFJO1lBQ2pCLG9CQUFvQixFQUFFLElBQUk7WUFDMUIsYUFBYSxFQUFFLENBQUMsc0NBQXFCLENBQUM7U0FDdkMsQ0FBQyxDQUNILENBQUM7UUFDRixNQUFNLENBQUMsR0FBRyxDQUNSLElBQUEsb0JBQVUsRUFBQztZQUNULFFBQVEsRUFBRSxPQUFPO1lBQ2pCLFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVc7WUFDbkMsYUFBYSxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDO1lBQ2pELEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUI7U0FDbEMsQ0FBQyxDQUNILENBQUM7UUFDRixNQUFNLENBQUMsR0FBRyxDQUFDLHdDQUF1QixDQUFDLENBQUM7UUFDcEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUVuRCxPQUFPLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLEtBQUssQ0FBQyxtQkFBbUI7UUFJL0IsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBRXJGLElBQUksQ0FBQztZQUNILHdEQUF3RDtZQUN4RCxNQUFNLEVBQUUsZUFBZSxFQUFFLHNCQUFzQixFQUFFLGNBQWMsRUFBRSxHQUFHLHdEQUNsRSx5QkFBeUIsR0FDMUIsQ0FBQztZQUVGLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxzQkFBc0IsQ0FDbkQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxhQUFhLEVBQzVDLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsbUJBQW1CLEVBQ2xELElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsZ0JBQWdCLEVBQy9DLElBQUksQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUM3QixDQUFDO1lBRUYsTUFBTSxTQUFTLEdBQUcsSUFBSSxlQUFlLENBQUM7Z0JBQ3BDLGVBQWUsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWU7Z0JBQzdDLFlBQVksRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVk7Z0JBQ3ZDLFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVM7Z0JBQ2pDLFVBQVUsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVU7Z0JBQ25DLE1BQU0sRUFBRSxTQUFTO2dCQUNqQixrQkFBa0I7Z0JBQ2xCLFlBQVksRUFBRSxJQUFJLENBQUMsZUFBZTtnQkFDbEMsUUFBUSxFQUFFLElBQUksQ0FBQyxXQUFXO2dCQUMxQixRQUFRLEVBQUUsSUFBSSxDQUFDLFdBQVc7Z0JBQzFCLG1CQUFtQixFQUFFLElBQUksQ0FBQyxzQkFBc0I7Z0JBQ2hELFdBQVcsRUFBRSxJQUFJLENBQUMsY0FBYztnQkFDaEMsZUFBZSxFQUFFLElBQUksQ0FBQyxzQkFBc0IsRUFBRTthQUMvQyxDQUFDLENBQUM7WUFFSCxNQUFNLFlBQVksR0FBRyxNQUFNLFNBQVMsQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUN2RCxNQUFNLFVBQVUsR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBRXBELFNBQVMsQ0FBQyxNQUFNLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztZQUNyRCxTQUFTLENBQ1AsTUFBTSxFQUNOLHNGQUFzRixDQUN2RixDQUFDO1lBRUYsT0FBTyxFQUFFLFlBQVksRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUN0QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxLQUFjLENBQUM7WUFDbkMsU0FBUyxDQUFDLE9BQU8sRUFBRSxvQ0FBb0MsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUNsRSxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQsMEZBQTBGO0lBQzFGLDBGQUEwRjtJQUMxRix1RUFBdUU7SUFDL0QsS0FBSyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsaUJBQWlCLEdBQUcsSUFBSSxFQUFFLEdBQUcsRUFBRTtRQUNuRSxnRkFBZ0Y7UUFDaEYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLElBQUksNENBQW9CLENBQUk7WUFDbEQsZ0NBQWdDLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQ0FBZ0MsSUFBSSxLQUFLO1lBQ3hGLFFBQVEsRUFBRSxRQUFRO1NBQ25CLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQ2xFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFFdkUsSUFBSSxpQkFBaUIsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2pELE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO1lBQzVELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsb0NBQXNCLEVBQUU7Z0JBQ2hELEtBQUs7Z0JBQ0wsTUFBTTtnQkFDTixRQUFRO2dCQUNSLE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU07YUFDNUIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFTyxlQUFlO1FBQ3JCLE9BQU8sbUJBQWUsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDO0lBQ3ZGLENBQUM7SUFFTyxLQUFLLENBQUMsd0JBQXdCO1FBS3BDLE1BQU0sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO1FBRTVFLE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztZQUNsQyxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQztZQUMxQixJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztZQUMzQixDQUFDLFlBQVksSUFBSSxXQUFXO2dCQUMxQixDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLE1BQU0sQ0FBQztnQkFDL0UsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUU7U0FDdEIsQ0FBQyxDQUFDO1FBRUgsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVEOztPQUVHO0lBQ08sS0FBSyxDQUFDLFVBQVUsQ0FBQyxVQUFzQjtRQUMvQyxNQUFNLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO1FBRWxGLG1EQUFtRDtRQUNuRCxJQUFJLGdCQUFnQixFQUFFLENBQUM7WUFDckIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQ2pCLE1BQU0sRUFDTixxRUFBcUUsQ0FDdEUsQ0FBQztZQUVGLE9BQU87UUFDVCxDQUFDO1FBRUQsMERBQTBEO1FBQzFELElBQUksTUFBeUMsQ0FBQztRQUM5QyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFFcEMsNEZBQTRGO1FBQzVGLElBQUksQ0FBQyxZQUFZLEVBQUUsb0JBQW9CLElBQUksWUFBWSxFQUFFLENBQUM7WUFDeEQsSUFBSSxDQUFDO2dCQUNILE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBQSxtQkFBUSxFQUFDLFVBQVUsRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDekUsQ0FBQztZQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7Z0JBQ1gsTUFBTSxJQUFJLEtBQUssQ0FBQyxjQUFjLFVBQVUsa0RBQWtELENBQUMsQ0FBQztZQUM5RixDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUU1RCxNQUFNLE1BQU0sR0FBRyxJQUFBLHVDQUFTLEVBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLE1BQU0sSUFBQSxvQkFBUyxFQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBRUQsZ0NBQWdDO1FBQ2hDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0F1Qkc7SUFDSCxLQUFLLENBQUMsa0JBQWtCO1FBQ3RCLE1BQU0sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO1FBRTFFLElBQUksQ0FBQztZQUNILE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixDQUFDLEVBQUUsaUJBQWlCLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNsRixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUVwQyxNQUFNLElBQUEsb0JBQVMsRUFBQyxVQUFVLEVBQUUsSUFBQSx1Q0FBUyxFQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRTtnQkFDOUUsUUFBUSxFQUFFLE9BQU87YUFDbEIsQ0FBQyxDQUFDO1lBRUgsSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDaEIsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLHVCQUF1QixDQUFDLFdBQVcsRUFBRSxlQUFlLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUVELE1BQU0sQ0FBQyxNQUFNLEVBQUUscUJBQXFCLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsS0FBYyxDQUFDO1lBQ25DLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMENBQTBDLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDckUsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBL2lCRCx3QkEraUJDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvYWdlbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFxQkEsOEVBQTBFO0FBQzFFLGlFQUF5QztBQUN6QyxxREFBNkI7QUFDN0IseURBQWlDO0FBQ2pDLDBDQUFrRDtBQUNsRCxrR0FBc0Q7QUFFdEQsK0NBQXVEO0FBQ3ZELDZDQUEyRDtBQUMzRCxrRUFBeUM7QUFDekMsOEZBQW9FO0FBQ3BFLDRFQUFtRDtBQUNuRCxzREFBa0M7QUFDbEMsMERBQXNDO0FBQ3RDLGtHQUFpRjtBQUNqRiwyREFBd0Y7QUFDeEYsZ0ZBQThEO0FBQzlELGtGQUF5RDtBQUV6RCw2RkFBNkY7QUFDN0YsK0ZBQStGO0FBQy9GLHFGQUFxRjtBQUNyRixNQUFNLGVBQWUsR0FBRyxDQUFDLFdBQW1CLEVBQUUsRUFBRSxDQUM5QyxpRUFBaUUsV0FBVyxnQkFBZ0I7SUFDNUYsc0JBQXNCLHVCQUFVLHVDQUF1Qyx1QkFBVSxVQUFVO0lBQzNGLEdBQUcsdUJBQVUsd0NBQXdDLENBQUM7QUFFeEQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBcUIsS0FBbUMsU0FBUSwyQkFBZ0I7SUE4QjlFOzs7Ozs7Ozs7Ozs7Ozs7T0FlRztJQUNILFlBQVksT0FBcUI7UUFDL0IsTUFBTSxVQUFVLEdBQUcsMkJBQWdCLENBQUMsUUFBUSxDQUFDLDJCQUFnQixDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ3JGLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQXpDOUMsMkNBQTJDO1FBQ25DLGVBQVUsR0FBRyxLQUFLLENBQUM7UUFPM0IsdUZBQXVGO1FBQy9FLHFCQUFnQixHQUFvQyxJQUFJLENBQUM7UUFFakUsNERBQTREO1FBQ3BELGdCQUFXLEdBQXVCLElBQUksQ0FBQztRQUV2QyxpQkFBWSxHQUFHLEtBQUssQ0FBQztRQUU3Qjs7OztXQUlHO1FBQ0ssaUJBQVksR0FBRyxLQUFLLENBQUM7UUFzQjNCLElBQUksQ0FBQyxPQUFPLEdBQUcsVUFBVSxDQUFDO1FBQzFCLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSw0Q0FBb0IsQ0FBSTtZQUM1QyxnQ0FBZ0MsRUFBRSxPQUFPLENBQUMsZ0NBQWdDLElBQUksS0FBSztTQUNwRixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsb0JBQW9CLEdBQUcsSUFBSSx1QkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNqRSxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksbUJBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsS0FBSztRQUNULElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztRQUNwQixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQztRQUV6QixJQUFJLENBQUM7WUFDSCw4RkFBOEY7WUFDOUYsMEZBQTBGO1lBQzFGLG1EQUFtRDtZQUNuRCxNQUFNLElBQUksQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFFbEMsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1lBRTlELE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQy9ELElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztZQUVoRixJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsQ0FBQztZQUNqQyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDekIsT0FBTyxHQUFHLElBQUksQ0FBQztZQUVmLGlGQUFpRjtZQUNqRix1RkFBdUY7WUFDdkYsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxJQUFJLENBQUMsb0JBQW9CLENBQUMsQ0FBQztZQUN6Riw2RkFBNkY7WUFDN0YsTUFBTSxJQUFJLENBQUMsV0FBVyxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YseUZBQXlGO1lBQ3pGLDRGQUE0RjtZQUM1RiwyRkFBMkY7WUFDM0YsMkVBQTJFO1lBQzNFLElBQUksQ0FBQyxPQUFPO2dCQUFFLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDO1lBQ3hDLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxLQUFjLENBQUM7WUFDbkMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHVDQUF1QyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBRS9FLHFGQUFxRjtZQUNyRix1RkFBdUY7WUFDdkYsMkZBQTJGO1lBQzNGLDBGQUEwRjtZQUMxRix1RkFBdUY7WUFDdkYsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLElBQUksQ0FBQztvQkFDSCxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLEtBQUssRUFBRSxDQUFDO2dCQUN6QyxDQUFDO2dCQUFDLE9BQU8sVUFBVSxFQUFFLENBQUM7b0JBQ3BCLE1BQU0sRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLEdBQUcsVUFBbUIsQ0FBQztvQkFDdEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQ2pCLE9BQU8sRUFDUCx3REFBd0QsWUFBWSxFQUFFLENBQ3ZFLENBQUM7Z0JBQ0osQ0FBQztZQUNILENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDTSxLQUFLLENBQUMsSUFBSTtRQUNqQiwyRkFBMkY7UUFDM0YsOEZBQThGO1FBQzlGLElBQUksQ0FBQyxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDekIsb0ZBQW9GO1FBQ3BGLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixFQUFFLElBQUksRUFBRSxDQUFDO1FBQ3BDLCtDQUErQztRQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ3ZDLDRGQUE0RjtRQUM1RiwwRkFBMEY7UUFDMUYsMkZBQTJGO1FBQzNGLHVGQUF1RjtRQUN2RixNQUFNLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUVuQixzRkFBc0Y7UUFDdEYsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUN6QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxLQUFjLENBQUM7WUFDbkMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQ2pCLE9BQU8sRUFDUCx3REFBd0QsT0FBTyxFQUFFLENBQ2xFLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLE9BQU87UUFDWCxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMENBQTBDLENBQUMsQ0FBQztZQUV6RSxPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx3QkFBd0IsQ0FBQyxDQUFDO1FBRXRELElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBRXpCLElBQUksQ0FBQztZQUNILDBDQUEwQztZQUMxQyxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7WUFFOUQsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLENBQUM7WUFDakMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzNCLG1GQUFtRjtZQUNuRixJQUFJLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQ2pDLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDO1FBQzVCLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSCxhQUFhLENBQUMsT0FBMEIsRUFBRSxPQUEyQjtRQUNuRSxJQUFJLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFFekUsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSCxLQUFLLENBQUMsdUJBQXVCLENBQUMsV0FBbUIsRUFBRSxlQUF1QjtRQUN4RSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUNoQyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxXQUFXLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUVEOzs7Ozs7Ozs7Ozs7O09BYUc7SUFDSCxRQUFRLENBQUMsSUFBWSxFQUFFLFVBQXdDO1FBQzdELElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsQ0FBQztRQUUzQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0gsbUJBQW1CLENBQ2pCLElBQU8sRUFDUCxNQUEyRDtRQUUzRCxJQUFJLENBQUMsVUFBVSxDQUFDLG1CQUFtQixDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUVsRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNILGdCQUFnQixDQUFDLEdBQUcsS0FBMkI7UUFDN0MsSUFBSSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDO1FBRTNDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUNILEdBQUcsQ0FBVSxNQUF1QixFQUFFLE9BQWlCO1FBQ3JELElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUVyQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0E2Qkc7SUFDSCxnQkFBZ0IsQ0FBQyxPQU1oQjtRQUNDLElBQUksSUFBSSxDQUFDLFdBQVcsSUFBSSxJQUFBLDRCQUFlLEVBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDM0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxlQUFlLENBQUMsT0FBTyxFQUFFLFFBQWtCLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFFRCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQztRQUN2QixJQUFJLENBQUMsZUFBZSxHQUFHLE9BQU8sRUFBRSxZQUFZLENBQUM7UUFDN0MsSUFBSSxDQUFDLFdBQVcsR0FBRyxPQUFPLEVBQUUsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxXQUFXLEdBQUcsT0FBTyxFQUFFLFFBQVEsQ0FBQztRQUNyQyxJQUFJLENBQUMsc0JBQXNCLEdBQUcsT0FBTyxFQUFFLG1CQUFtQixDQUFDO1FBQzNELElBQUksQ0FBQyxjQUFjLEdBQUcsT0FBTyxFQUFFLFdBQVcsQ0FBQztRQUUzQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQXNCRztJQUNILG1CQUFtQixDQUFDLFVBQXdDLEVBQUU7UUFDNUQsSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxQixNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELE1BQU0sUUFBUSxHQUFHLElBQUksb0NBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVELDhGQUE4RjtRQUM5Rix3RkFBd0Y7UUFDeEYsaUZBQWlGO1FBQ2hGLElBQUksQ0FBQyxPQUF3QixDQUFDLG1CQUFtQixHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDakYsSUFBSSxDQUFDLGdCQUFnQixHQUFHLFFBQVEsQ0FBQztRQUVqQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0F1Qkc7SUFDSCxNQUFNLENBQUMsVUFBMkIsRUFBRTtRQUNsQyxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNyQixNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7UUFDckQsQ0FBQztRQUVELGdHQUFnRztRQUNoRyw4RkFBOEY7UUFDOUYsK0ZBQStGO1FBQy9GLGdHQUFnRztRQUNoRyw4REFBOEQ7UUFDOUQsSUFBSSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFFRCxJQUFJLElBQUEsNEJBQWUsRUFBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsV0FBcUIsQ0FBQyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFHLElBQUksc0JBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ25ELElBQUksQ0FBQyxXQUFXLEdBQUcsR0FBRyxDQUFDO1FBQ3ZCLDRGQUE0RjtRQUM1Riw2RkFBNkY7UUFDN0YsZ0VBQWdFO1FBQ2hFLElBQUksQ0FBQyxzQkFBc0IsRUFBRSxDQUFDO1FBQzlCLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRWhDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVTLFNBQVMsQ0FBQyxVQUFzQixFQUFFLFFBQXVDO1FBQ2pGLE9BQU8sSUFBQSxnQkFBVSxFQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFRDs7O09BR0c7SUFDSyxLQUFLLENBQUMsU0FBUyxDQUFDLFVBQXNCO1FBSTVDLGdCQUFnQjtRQUNoQixNQUFNLFFBQVEsR0FBRyxJQUFBLGtCQUFZLEVBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBRXBELE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUUxRCwwREFBMEQ7UUFDMUQsSUFBSSxHQUE0QixDQUFDO1FBRWpDLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3BCLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQ3pDLENBQUM7UUFFRCxvQkFBb0I7UUFDcEIsTUFBTSxNQUFNLEdBQUcsSUFBSSxnQkFBTSxFQUFFLENBQUM7UUFDNUIsTUFBTSxDQUFDLEdBQUcsQ0FDUixNQUFNLEVBQ04sSUFBQSxjQUFJLEVBQUM7WUFDSCxXQUFXLEVBQUUsSUFBSTtZQUNqQixNQUFNLEVBQUUsRUFBRSxHQUFHLElBQUk7WUFDakIsb0JBQW9CLEVBQUUsSUFBSTtZQUMxQixhQUFhLEVBQUUsQ0FBQyxzQ0FBcUIsQ0FBQztTQUN2QyxDQUFDLENBQ0gsQ0FBQztRQUNGLE1BQU0sQ0FBQyxHQUFHLENBQ1IsSUFBQSxvQkFBVSxFQUFDO1lBQ1QsUUFBUSxFQUFFLE9BQU87WUFDakIsU0FBUyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVztZQUNuQyxhQUFhLEVBQUUsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUM7WUFDakQsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQjtTQUNsQyxDQUFDLENBQ0gsQ0FBQztRQUNGLE1BQU0sQ0FBQyxHQUFHLENBQUMsd0NBQXVCLENBQUMsQ0FBQztRQUNwQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBRW5ELE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxLQUFLLENBQUMsbUJBQW1CO1FBQy9CLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUVyRixJQUFJLENBQUM7WUFDSCx3REFBd0Q7WUFDeEQsTUFBTSxFQUFFLGVBQWUsRUFBRSxzQkFBc0IsRUFBRSxjQUFjLEVBQUUsR0FBRyx3REFDbEUseUJBQXlCLEdBQzFCLENBQUM7WUFFRixNQUFNLGtCQUFrQixHQUFHLElBQUksc0JBQXNCLENBQ25ELElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsYUFBYSxFQUM1QyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLG1CQUFtQixFQUNsRCxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLGdCQUFnQixFQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FDN0IsQ0FBQztZQUVGLE1BQU0sU0FBUyxHQUFHLElBQUksZUFBZSxDQUFDO2dCQUNwQyxlQUFlLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlO2dCQUM3QyxZQUFZLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZO2dCQUN2QyxTQUFTLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTO2dCQUNqQyxVQUFVLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVO2dCQUNuQyxNQUFNLEVBQUUsU0FBUztnQkFDakIsa0JBQWtCO2dCQUNsQixZQUFZLEVBQUUsSUFBSSxDQUFDLGVBQWU7Z0JBQ2xDLFFBQVEsRUFBRSxJQUFJLENBQUMsV0FBVztnQkFDMUIsUUFBUSxFQUFFLElBQUksQ0FBQyxXQUFXO2dCQUMxQixtQkFBbUIsRUFBRSxJQUFJLENBQUMsc0JBQXNCO2dCQUNoRCxXQUFXLEVBQUUsSUFBSSxDQUFDLGNBQWM7Z0JBQ2hDLGVBQWUsRUFBRSxJQUFJLENBQUMsc0JBQXNCLEVBQUU7YUFDL0MsQ0FBQyxDQUFDO1lBRUgsTUFBTSxRQUFRLEdBQUcsTUFBTSxTQUFTLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDbkQsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUVqRCxTQUFTLENBQUMsTUFBTSxFQUFFLGlDQUFpQyxDQUFDLENBQUM7WUFDckQsU0FBUyxDQUNQLE1BQU0sRUFDTixzRkFBc0YsQ0FDdkYsQ0FBQztZQUVGLE9BQU8sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDL0IsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsS0FBYyxDQUFDO1lBQ25DLFNBQVMsQ0FBQyxPQUFPLEVBQUUsb0NBQW9DLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDbEUsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVELDBGQUEwRjtJQUMxRiwwRkFBMEY7SUFDMUYsdUVBQXVFO0lBQy9ELEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLGlCQUFpQixHQUFHLElBQUksRUFBRSxHQUFHLEVBQUU7UUFDbkUsZ0ZBQWdGO1FBQ2hGLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLDRDQUFvQixDQUFJO1lBQ2xELGdDQUFnQyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsZ0NBQWdDLElBQUksS0FBSztZQUN4RixRQUFRLEVBQUUsUUFBUTtTQUNuQixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNsRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBRXZFLElBQUksaUJBQWlCLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNqRCxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztZQUM1RCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLG9DQUFzQixFQUFFO2dCQUNoRCxLQUFLO2dCQUNMLE1BQU07Z0JBQ04sUUFBUTtnQkFDUixNQUFNLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNO2FBQzVCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRU8sZUFBZTtRQUNyQixPQUFPLG1CQUFlLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxhQUFhLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUN2RixDQUFDO0lBRU8sS0FBSyxDQUFDLHdCQUF3QjtRQUlwQyxNQUFNLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUU1RSxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ3RELE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7WUFDbEMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUM7WUFDMUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7WUFDM0IsQ0FBQyxZQUFZLElBQUksV0FBVztnQkFDMUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsdUJBQXVCLENBQUMsV0FBVyxFQUFFLGVBQWUsRUFBRSxNQUFNLENBQUM7Z0JBQy9FLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFO1NBQ3RCLENBQUMsQ0FBQztRQUVILE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7T0FFRztJQUNPLEtBQUssQ0FBQyxVQUFVLENBQUMsVUFBc0I7UUFDL0MsTUFBTSxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUVsRixtREFBbUQ7UUFDbkQsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUNqQixNQUFNLEVBQ04scUVBQXFFLENBQ3RFLENBQUM7WUFFRixPQUFPO1FBQ1QsQ0FBQztRQUVELDBEQUEwRDtRQUMxRCxJQUFJLE1BQXlDLENBQUM7UUFDOUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBRXBDLDRGQUE0RjtRQUM1RixJQUFJLENBQUMsWUFBWSxFQUFFLG9CQUFvQixJQUFJLFlBQVksRUFBRSxDQUFDO1lBQ3hELElBQUksQ0FBQztnQkFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUEsbUJBQVEsRUFBQyxVQUFVLEVBQUUsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3pFLENBQUM7WUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUNYLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxVQUFVLGtEQUFrRCxDQUFDLENBQUM7WUFDOUYsQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7WUFFNUQsTUFBTSxNQUFNLEdBQUcsSUFBQSx1Q0FBUyxFQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUNsRSxNQUFNLElBQUEsb0JBQVMsRUFBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELGdDQUFnQztRQUNoQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O09BdUJHO0lBQ0gsS0FBSyxDQUFDLGtCQUFrQjtRQUN0QixNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUUxRSxJQUFJLENBQUM7WUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLGlCQUFpQixFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDbEYsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNsRSxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFFcEMsTUFBTSxJQUFBLG9CQUFTLEVBQUMsVUFBVSxFQUFFLElBQUEsdUNBQVMsRUFBQyxFQUFFLEdBQUcsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUU7Z0JBQzlFLFFBQVEsRUFBRSxPQUFPO2FBQ2xCLENBQUMsQ0FBQztZQUVILElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3RGLENBQUM7WUFFRCxNQUFNLENBQUMsTUFBTSxFQUFFLHFCQUFxQixVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLEtBQWMsQ0FBQztZQUNuQyxNQUFNLENBQUMsT0FBTyxFQUFFLDBDQUEwQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7Q0FDRjtBQTduQkQsd0JBNm5CQyJ9

package/dist/bff-routes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Where an embedded BFF answers, at the root of the host application. Fixed: the BFF serves its own
+ * `/oauth/*` and `/docs`, which would otherwise collide with the MCP server's root paths and with
+ * whatever the host already serves.
+ */
+export declare const BFF_PREFIX = "/bff";
+/**
+ * Matches on the pathname and on a segment boundary, so `/bff?x=1` is claimed and `/bffalo` is not.
+ */
+export declare function isBffRoute(url: string): boolean;
+/**
+ * The url the BFF itself expects: it knows nothing of the prefix the host serves it under, and its
+ * routes are absolute (`/agent/v1/…`, `/health`). Never yields an empty string — Koa would read that
+ * as a malformed request rather than as the root.
+ */
+export declare function stripBffPrefix(url: string): string;
+/**
+ * Whether an MCP mount path would land inside `/bff`. The MCP server normalizes its `basePath`
+ * (trim, leading slash, collapsed and stripped trailing slashes) before deriving
+ * `<basePath>/oauth/` and `<basePath>/mcp`, so comparing the raw option to `/bff` would let `bff`,
+ * `/bff/` and `/bff/ai` through — each of which claims paths the BFF answers on. The normalization
+ * is mirrored rather than imported: mcp-server keeps it internal.
+ */
+export declare function collidesWithBff(mcpBasePath?: string): boolean;
+//# sourceMappingURL=bff-routes.d.ts.map

package/dist/bff-routes.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BFF_PREFIX = void 0;
+exports.isBffRoute = isBffRoute;
+exports.stripBffPrefix = stripBffPrefix;
+exports.collidesWithBff = collidesWithBff;
+/**
+ * Where an embedded BFF answers, at the root of the host application. Fixed: the BFF serves its own
+ * `/oauth/*` and `/docs`, which would otherwise collide with the MCP server's root paths and with
+ * whatever the host already serves.
+ */
+exports.BFF_PREFIX = '/bff';
+/**
+ * Matches on the pathname and on a segment boundary, so `/bff?x=1` is claimed and `/bffalo` is not.
+ */
+function isBffRoute(url) {
+    const [pathname] = url.split(/[?#]/, 1);
+    return pathname === exports.BFF_PREFIX || pathname.startsWith(`${exports.BFF_PREFIX}/`);
+}
+/**
+ * The url the BFF itself expects: it knows nothing of the prefix the host serves it under, and its
+ * routes are absolute (`/agent/v1/…`, `/health`). Never yields an empty string — Koa would read that
+ * as a malformed request rather than as the root.
+ */
+function stripBffPrefix(url) {
+    const remainder = url.slice(exports.BFF_PREFIX.length);
+    if (remainder === '')
+        return '/';
+    return remainder.startsWith('/') ? remainder : `/${remainder}`;
+}
+/**
+ * Whether an MCP mount path would land inside `/bff`. The MCP server normalizes its `basePath`
+ * (trim, leading slash, collapsed and stripped trailing slashes) before deriving
+ * `<basePath>/oauth/` and `<basePath>/mcp`, so comparing the raw option to `/bff` would let `bff`,
+ * `/bff/` and `/bff/ai` through — each of which claims paths the BFF answers on. The normalization
+ * is mirrored rather than imported: mcp-server keeps it internal.
+ */
+function collidesWithBff(mcpBasePath) {
+    if (!mcpBasePath)
+        return false;
+    const trimmed = mcpBasePath.trim();
+    if (trimmed === '' || trimmed === '/')
+        return false;
+    const normalized = (trimmed.startsWith('/') ? trimmed : `/${trimmed}`)
+        .replace(/\/+/g, '/')
+        .replace(/\/+$/, '');
+    return isBffRoute(`${normalized}/mcp`);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLXJvdXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9iZmYtcm91dGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQVVBLGdDQUlDO0FBT0Qsd0NBTUM7QUFTRCwwQ0FZQztBQWhERDs7OztHQUlHO0FBQ1UsUUFBQSxVQUFVLEdBQUcsTUFBTSxDQUFDO0FBRWpDOztHQUVHO0FBQ0gsU0FBZ0IsVUFBVSxDQUFDLEdBQVc7SUFDcEMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBRXhDLE9BQU8sUUFBUSxLQUFLLGtCQUFVLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLGtCQUFVLEdBQUcsQ0FBQyxDQUFDO0FBQzFFLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0IsY0FBYyxDQUFDLEdBQVc7SUFDeEMsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxrQkFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRS9DLElBQUksU0FBUyxLQUFLLEVBQUU7UUFBRSxPQUFPLEdBQUcsQ0FBQztJQUVqQyxPQUFPLFNBQVMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxTQUFTLEVBQUUsQ0FBQztBQUNqRSxDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsU0FBZ0IsZUFBZSxDQUFDLFdBQW9CO0lBQ2xELElBQUksQ0FBQyxXQUFXO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFFL0IsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDO0lBRW5DLElBQUksT0FBTyxLQUFLLEVBQUUsSUFBSSxPQUFPLEtBQUssR0FBRztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBRXBELE1BQU0sVUFBVSxHQUFHLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sRUFBRSxDQUFDO1NBQ25FLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDO1NBQ3BCLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFFdkIsT0FBTyxVQUFVLENBQUMsR0FBRyxVQUFVLE1BQU0sQ0FBQyxDQUFDO0FBQ3pDLENBQUMifQ==

package/dist/embedded-bff.d.ts

@@ -0,0 +1,61 @@
+import type { AgentOptionsWithDefaults, BffEmbedOptions, HttpCallback } from './types';
+import type { AgentDispatcher } from '@forestadmin/agent-bff';
+/**
+ * Owns the lifecycle of a BFF embedded in the agent process: configuration, dynamic loading of the
+ * optional package, build, and the request handler the agent mounts at `/bff`. The agent only wires
+ * the callback and delegates start/stop.
+ */
+export default class EmbeddedBff {
+    private readonly options;
+    private readonly embedOptions;
+    private config;
+    private bff;
+    private stopped;
+    constructor(options: AgentOptionsWithDefaults, embedOptions: BffEmbedOptions);
+    /**
+     * Load the package and validate the options the caller handed to `addBff()`. Called before the
+     * agent mounts anything: everything checked here is caller input, and `parseConfig` throws on a
+     * mistyped `tokenEncryptionKey`, timezone, timeout or url. Failing here leaves nothing serving,
+     * where failing after mount() would leave the host with a live `/forest` and a bricked `/bff`.
+     */
+    prepare(): Promise<void>;
+    /**
+     * Build the BFF. Called from agent.start() after mount(), because the dispatcher only reaches the
+     * agent's own stack once that stack is mounted.
+     */
+    start(dispatcher: AgentDispatcher): Promise<void>;
+    /**
+     * The whitelist exempts a caller arriving over a loopback socket with no proxy hop, which is
+     * exactly what the in-process transport looks like — so every BFF request escapes it. That is the
+     * decision, not an oversight: propagating the caller's ip would make the embedded mode stricter
+     * than the standalone one, where the whitelist only ever sees the BFF's own host, and would refuse
+     * the browsers a third-party UI is made of. What it must not be is silent — an operator who turned
+     * the whitelist on to close a door has no other way to learn this door is not part of it.
+     *
+     * Reads the configuration itself rather than borrowing the one `IpWhitelist` already fetched: that
+     * route keeps it private, and reaching into it would put BFF concerns in an unrelated part of the
+     * agent. Costs one round-trip at boot. Never fails the boot: a warning is not worth refusing to
+     * serve over, and this is the same posture as the rest of the BFF's startup.
+     */
+    private warnIfExemptFromIpWhitelist;
+    /** Drop what the BFF read from the SaaS. Called on a restart, which means the schema moved. */
+    invalidate(): void;
+    /**
+     * Stop answering. The host application keeps whatever middleware it registered, so without this
+     * a stopped agent would go on serving BFF data through a dispatcher pointing at a dead stack.
+     */
+    stop(): void;
+    /**
+     * The callback the agent registers at `/bff`. Answers 503 rather than falling through while the
+     * BFF is not serving: a 404 from the host would read as "wrong url" instead of "not available".
+     * Boot and shutdown are told apart, because a probe should wait on the first and drain on the
+     * second.
+     */
+    readonly handle: HttpCallback;
+    /**
+     * Dynamically load the optional @forestadmin/agent-bff package. Deferred so agents that embed no
+     * BFF never load its code at startup.
+     */
+    private importPackage;
+}
+//# sourceMappingURL=embedded-bff.d.ts.map

package/dist/embedded-bff.js

@@ -0,0 +1,220 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const bff_routes_1 = require("./bff-routes");
+/**
+ * Serialize the BFF's structured log context onto the message: the agent's logger only accepts an
+ * Error as its third argument, so the context would be dropped otherwise. Errors are unfolded by
+ * hand — their `message` and `stack` are not enumerable, so `JSON.stringify` alone turns the one
+ * value worth logging into `{}`. Never throws — logging must not break a request.
+ */
+function formatLog(message, context) {
+    if (!context || Object.keys(context).length === 0)
+        return `[BFF] ${message}`;
+    try {
+        const serialized = JSON.stringify(context, (_key, value) => value instanceof Error
+            ? { name: value.name, message: value.message, stack: value.stack }
+            : value);
+        return `[BFF] ${message} ${serialized}`;
+    }
+    catch {
+        return `[BFF] ${message} [unserializable context]`;
+    }
+}
+/**
+ * Owns the lifecycle of a BFF embedded in the agent process: configuration, dynamic loading of the
+ * optional package, build, and the request handler the agent mounts at `/bff`. The agent only wires
+ * the callback and delegates start/stop.
+ */
+class EmbeddedBff {
+    constructor(options, embedOptions) {
+        this.options = options;
+        this.embedOptions = embedOptions;
+        this.config = null;
+        this.bff = null;
+        this.stopped = false;
+        /**
+         * The callback the agent registers at `/bff`. Answers 503 rather than falling through while the
+         * BFF is not serving: a 404 from the host would read as "wrong url" instead of "not available".
+         * Boot and shutdown are told apart, because a probe should wait on the first and drain on the
+         * second.
+         */
+        this.handle = (req, res) => {
+            if (!this.bff) {
+                const type = this.stopped ? 'bff_stopped' : 'bff_not_started';
+                const message = this.stopped
+                    ? 'The embedded BFF was stopped with the agent.'
+                    : 'The embedded BFF is not started yet.';
+                res.statusCode = 503;
+                res.setHeader('Content-Type', 'application/json');
+                res.end(JSON.stringify({ error: { type, status: 503, message } }));
+                return;
+            }
+            // The BFF knows nothing of the prefix it is served under. `originalUrl` is claimed before the
+            // rewrite so a host logger reading it still reports the url the client asked for.
+            const bffReq = req;
+            bffReq.originalUrl ?? (bffReq.originalUrl = bffReq.url);
+            req.url = (0, bff_routes_1.stripBffPrefix)(req.url ?? bff_routes_1.BFF_PREFIX);
+            this.bff.callback(req, res);
+        };
+    }
+    /**
+     * Load the package and validate the options the caller handed to `addBff()`. Called before the
+     * agent mounts anything: everything checked here is caller input, and `parseConfig` throws on a
+     * mistyped `tokenEncryptionKey`, timezone, timeout or url. Failing here leaves nothing serving,
+     * where failing after mount() would leave the host with a live `/forest` and a bricked `/bff`.
+     */
+    async prepare() {
+        const { parseConfig, IN_PROCESS_AGENT_URL } = await this.importPackage();
+        const { embedOptions } = this;
+        this.config = parseConfig({
+            FOREST_AUTH_SECRET: this.options.authSecret,
+            FOREST_ENV_SECRET: this.options.envSecret,
+            FOREST_SERVER_URL: this.options.forestServerUrl,
+            FOREST_APP_URL: this.options.forestAppUrl,
+            // Names where the agent answers, never how it is reached: the dispatcher is the transport.
+            AGENT_URL: IN_PROCESS_AGENT_URL,
+            BFF_TOKEN_ENCRYPTION_KEY: embedOptions.tokenEncryptionKey,
+            BFF_ALLOWED_ORIGINS: embedOptions.allowedOrigins?.join(','),
+            BFF_DEFAULT_TIMEZONE: embedOptions.defaultTimezone,
+            BFF_AGENT_TIMEOUT_MS: embedOptions.agentTimeoutMs?.toString(),
+            BFF_AI_TIMEOUT_MS: embedOptions.aiTimeoutMs?.toString(),
+            // Off unless asked for: the document is not filtered per caller, so mounting a BFF must not
+            // publish the name of every exposed collection and field on an already-open port.
+            BFF_OPENAPI_ENABLED: String(embedOptions.openapiEnabled ?? false),
+        });
+    }
+    /**
+     * Build the BFF. Called from agent.start() after mount(), because the dispatcher only reaches the
+     * agent's own stack once that stack is mounted.
+     */
+    async start(dispatcher) {
+        if (!this.config)
+            await this.prepare();
+        // Cleared before the await, not after it: a start() following a stop() has to drop the previous
+        // shutdown's flag, while a stop() landing DURING the await must still be seen by the guard below.
+        this.stopped = false;
+        const { buildBff } = await this.importPackage();
+        const bff = await buildBff({
+            config: this.config,
+            dispatcher,
+            basePath: bff_routes_1.BFF_PREFIX,
+            // Counters are the schema cache's and the action-endpoint resolver's only channel — they take
+            // no logger — and every one of them reports a failure, so they go to the host's logs. Gauges
+            // do not: they are periodic cache sizes, and the default console sink reports them at Info,
+            // which would flood a host that only asked for a BFF.
+            metrics: {
+                // Tags carried through: `action_endpoint_error` and `action_endpoint_miss` name the
+                // rendering, collection and action that failed, which is the whole of what makes the line
+                // actionable — the metric name alone says only that something, somewhere, did not resolve.
+                increment: (name, tags) => this.options.logger('Warn', formatLog(`metric ${name}`, tags)),
+                gauge: () => undefined,
+            },
+            logger: (level, message, context) => this.options.logger(level, formatLog(message, context)),
+        });
+        // stop() may have landed while buildBff() was in flight. Assigning anyway would resurrect a
+        // stopped agent's /bff — dispatching into the stack it just tore down instead of answering 503.
+        if (this.stopped)
+            return;
+        this.bff = bff;
+        this.options.logger('Info', formatLog(`Embedded BFF mounted on ${bff_routes_1.BFF_PREFIX}`));
+        await this.warnIfExemptFromIpWhitelist();
+    }
+    /**
+     * The whitelist exempts a caller arriving over a loopback socket with no proxy hop, which is
+     * exactly what the in-process transport looks like — so every BFF request escapes it. That is the
+     * decision, not an oversight: propagating the caller's ip would make the embedded mode stricter
+     * than the standalone one, where the whitelist only ever sees the BFF's own host, and would refuse
+     * the browsers a third-party UI is made of. What it must not be is silent — an operator who turned
+     * the whitelist on to close a door has no other way to learn this door is not part of it.
+     *
+     * Reads the configuration itself rather than borrowing the one `IpWhitelist` already fetched: that
+     * route keeps it private, and reaching into it would put BFF concerns in an unrelated part of the
+     * agent. Costs one round-trip at boot. Never fails the boot: a warning is not worth refusing to
+     * serve over, and this is the same posture as the rest of the BFF's startup.
+     */
+    async warnIfExemptFromIpWhitelist() {
+        try {
+            const { isFeatureEnabled } = await this.options.forestAdminClient.getIpWhitelistConfiguration();
+            if (!isFeatureEnabled)
+                return;
+            this.options.logger('Warn', formatLog(`The IP whitelist is enabled for this environment, but requests served under ` +
+                `${bff_routes_1.BFF_PREFIX} are not subject to it: they reach the agent in-process, which the ` +
+                `whitelist exempts as a trusted loopback caller. A resolved API key or a valid OAuth ` +
+                `session is still required.`));
+        }
+        catch (error) {
+            this.options.logger('Debug', formatLog('Could not read the IP whitelist configuration', {
+                cause: error instanceof Error ? error.message : String(error),
+            }));
+        }
+    }
+    /** Drop what the BFF read from the SaaS. Called on a restart, which means the schema moved. */
+    invalidate() {
+        this.bff?.invalidate();
+    }
+    /**
+     * Stop answering. The host application keeps whatever middleware it registered, so without this
+     * a stopped agent would go on serving BFF data through a dispatcher pointing at a dead stack.
+     */
+    stop() {
+        this.bff = null;
+        this.stopped = true;
+    }
+    /**
+     * Dynamically load the optional @forestadmin/agent-bff package. Deferred so agents that embed no
+     * BFF never load its code at startup.
+     */
+    async importPackage() {
+        try {
+            return await Promise.resolve().then(() => __importStar(require('@forestadmin/agent-bff')));
+        }
+        catch (error) {
+            // The original reason is kept: the package resolves from the host's own node_modules, so this
+            // also fires on a broken transitive dependency, a SyntaxError from a partial install, or a
+            // throw during the package's own evaluation — none of which "install it" would fix.
+            const { message } = error;
+            const wrapped = new Error(`The embedded BFF requires the \`@forestadmin/agent-bff\` package, which failed to ` +
+                `load: ${message}. Install it with \`npm install @forestadmin/agent-bff\`.`);
+            // Assigned rather than passed to the constructor: the repo targets ES2020, whose lib types no
+            // options bag on Error. A plain assignment carries the cause on every runtime, and the reason
+            // is in the message regardless of what reads it.
+            wrapped.cause = error;
+            throw wrapped;
+        }
+    }
+}
+exports.default = EmbeddedBff;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW1iZWRkZWQtYmZmLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2VtYmVkZGVkLWJmZi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUdBLDZDQUEwRDtBQUUxRDs7Ozs7R0FLRztBQUNILFNBQVMsU0FBUyxDQUFDLE9BQWUsRUFBRSxPQUFpQztJQUNuRSxJQUFJLENBQUMsT0FBTyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxPQUFPLFNBQVMsT0FBTyxFQUFFLENBQUM7SUFFN0UsSUFBSSxDQUFDO1FBQ0gsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FDekQsS0FBSyxZQUFZLEtBQUs7WUFDcEIsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUU7WUFDbEUsQ0FBQyxDQUFDLEtBQUssQ0FDVixDQUFDO1FBRUYsT0FBTyxTQUFTLE9BQU8sSUFBSSxVQUFVLEVBQUUsQ0FBQztJQUMxQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLE9BQU8sMkJBQTJCLENBQUM7SUFDckQsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBcUIsV0FBVztJQUs5QixZQUNtQixPQUFpQyxFQUNqQyxZQUE2QjtRQUQ3QixZQUFPLEdBQVAsT0FBTyxDQUEwQjtRQUNqQyxpQkFBWSxHQUFaLFlBQVksQ0FBaUI7UUFOeEMsV0FBTSxHQUFxQixJQUFJLENBQUM7UUFDaEMsUUFBRyxHQUFlLElBQUksQ0FBQztRQUN2QixZQUFPLEdBQUcsS0FBSyxDQUFDO1FBa0l4Qjs7Ozs7V0FLRztRQUNNLFdBQU0sR0FBaUIsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUU7WUFDM0MsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDZCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixDQUFDO2dCQUM5RCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTztvQkFDMUIsQ0FBQyxDQUFDLDhDQUE4QztvQkFDaEQsQ0FBQyxDQUFDLHNDQUFzQyxDQUFDO2dCQUUzQyxHQUFHLENBQUMsVUFBVSxHQUFHLEdBQUcsQ0FBQztnQkFDckIsR0FBRyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztnQkFDbEQsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBRW5FLE9BQU87WUFDVCxDQUFDO1lBRUQsOEZBQThGO1lBQzlGLGtGQUFrRjtZQUNsRixNQUFNLE1BQU0sR0FBRyxHQUE0QyxDQUFDO1lBQzVELE1BQU0sQ0FBQyxXQUFXLEtBQWxCLE1BQU0sQ0FBQyxXQUFXLEdBQUssTUFBTSxDQUFDLEdBQUcsRUFBQztZQUNsQyxHQUFHLENBQUMsR0FBRyxHQUFHLElBQUEsMkJBQWMsRUFBQyxHQUFHLENBQUMsR0FBRyxJQUFJLHVCQUFVLENBQUMsQ0FBQztZQUNoRCxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDOUIsQ0FBQyxDQUFDO0lBdkpDLENBQUM7SUFFSjs7Ozs7T0FLRztJQUNILEtBQUssQ0FBQyxPQUFPO1FBQ1gsTUFBTSxFQUFFLFdBQVcsRUFBRSxvQkFBb0IsRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3pFLE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxJQUFJLENBQUM7UUFFOUIsSUFBSSxDQUFDLE1BQU0sR0FBRyxXQUFXLENBQUM7WUFDeEIsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVO1lBQzNDLGlCQUFpQixFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUztZQUN6QyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWU7WUFDL0MsY0FBYyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWTtZQUN6QywyRkFBMkY7WUFDM0YsU0FBUyxFQUFFLG9CQUFvQjtZQUMvQix3QkFBd0IsRUFBRSxZQUFZLENBQUMsa0JBQWtCO1lBQ3pELG1CQUFtQixFQUFFLFlBQVksQ0FBQyxjQUFjLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQztZQUMzRCxvQkFBb0IsRUFBRSxZQUFZLENBQUMsZUFBZTtZQUNsRCxvQkFBb0IsRUFBRSxZQUFZLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRTtZQUM3RCxpQkFBaUIsRUFBRSxZQUFZLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRTtZQUN2RCw0RkFBNEY7WUFDNUYsa0ZBQWtGO1lBQ2xGLG1CQUFtQixFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsY0FBYyxJQUFJLEtBQUssQ0FBQztTQUNsRSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsS0FBSyxDQUFDLEtBQUssQ0FBQyxVQUEyQjtRQUNyQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUV2QyxnR0FBZ0c7UUFDaEcsa0dBQWtHO1FBQ2xHLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBRXJCLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUVoRCxNQUFNLEdBQUcsR0FBRyxNQUFNLFFBQVEsQ0FBQztZQUN6QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQW1CO1lBQ2hDLFVBQVU7WUFDVixRQUFRLEVBQUUsdUJBQVU7WUFDcEIsOEZBQThGO1lBQzlGLDZGQUE2RjtZQUM3Riw0RkFBNEY7WUFDNUYsc0RBQXNEO1lBQ3RELE9BQU8sRUFBRTtnQkFDUCxvRkFBb0Y7Z0JBQ3BGLDBGQUEwRjtnQkFDMUYsMkZBQTJGO2dCQUMzRixTQUFTLEVBQUUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLFVBQVUsSUFBSSxFQUFFLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3pGLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxTQUFTO2FBQ3ZCO1lBQ0QsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxTQUFTLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1NBQzdGLENBQUMsQ0FBQztRQUVILDRGQUE0RjtRQUM1RixnR0FBZ0c7UUFDaEcsSUFBSSxJQUFJLENBQUMsT0FBTztZQUFFLE9BQU87UUFFekIsSUFBSSxDQUFDLEdBQUcsR0FBRyxHQUFHLENBQUM7UUFFZixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLDJCQUEyQix1QkFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRWhGLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixFQUFFLENBQUM7SUFDM0MsQ0FBQztJQUVEOzs7Ozs7Ozs7Ozs7T0FZRztJQUNLLEtBQUssQ0FBQywyQkFBMkI7UUFDdkMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEdBQ3hCLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQywyQkFBMkIsRUFBRSxDQUFDO1lBRXJFLElBQUksQ0FBQyxnQkFBZ0I7Z0JBQUUsT0FBTztZQUU5QixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FDakIsTUFBTSxFQUNOLFNBQVMsQ0FDUCw4RUFBOEU7Z0JBQzVFLEdBQUcsdUJBQVUscUVBQXFFO2dCQUNsRixzRkFBc0Y7Z0JBQ3RGLDRCQUE0QixDQUMvQixDQUNGLENBQUM7UUFDSixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUNqQixPQUFPLEVBQ1AsU0FBUyxDQUFDLCtDQUErQyxFQUFFO2dCQUN6RCxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQzthQUM5RCxDQUFDLENBQ0gsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsK0ZBQStGO0lBQy9GLFVBQVU7UUFDUixJQUFJLENBQUMsR0FBRyxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRDs7O09BR0c7SUFDSCxJQUFJO1FBQ0YsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLENBQUM7UUFDaEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7SUFDdEIsQ0FBQztJQThCRDs7O09BR0c7SUFDSyxLQUFLLENBQUMsYUFBYTtRQUN6QixJQUFJLENBQUM7WUFDSCxPQUFPLHdEQUFhLHdCQUF3QixHQUFDLENBQUM7UUFDaEQsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZiw4RkFBOEY7WUFDOUYsMkZBQTJGO1lBQzNGLG9GQUFvRjtZQUNwRixNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsS0FBYyxDQUFDO1lBQ25DLE1BQU0sT0FBTyxHQUFHLElBQUksS0FBSyxDQUN2QixvRkFBb0Y7Z0JBQ2xGLFNBQVMsT0FBTywyREFBMkQsQ0FDOUUsQ0FBQztZQUNGLDhGQUE4RjtZQUM5Riw4RkFBOEY7WUFDOUYsaURBQWlEO1lBQ2hELE9BQXVDLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztZQUV2RCxNQUFNLE9BQU8sQ0FBQztRQUNoQixDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBekxELDhCQXlMQyJ9

package/dist/framework-mounter.d.ts

@@ -1,4 +1,4 @@
-import type { HttpCallback, McpRouteMatcher } from './types';
+import type { HttpCallback, RootHandler } from './types';
 import type { Logger } from '@forestadmin/datasource-toolkit';
 import Router from '@koa/router';
 import InProcessDispatcher from './mcp-in-process-dispatcher';
@@ -11,16 +11,20 @@ export default class FrameworkMounter {
     protected readonly prefix: string;
     private readonly logger;
     private readonly fastifyAdapter;
-    private readonly mcpMiddleware;
+    private readonly rootMiddleware;
     private readonly inProcessDispatcher;
     private inProcessHookRegistered;
     /** Compute the prefix that the main router should be mounted at in the client's application */
     private get completeMountPrefix();
     constructor(prefix: string, logger: Logger);
     /**
-     * Set the MCP HTTP callback. Call this before mount() or remount().
+     * Register the MCP server at the root of the host application, or `null` to unregister it. The
+     * matcher comes with the callback: there is no default pattern set, so nothing can claim host
+     * urls by accident. Call this before mount() or remount().
      */
-    protected setMcpCallback(callback: HttpCallback | null, routeMatcher?: McpRouteMatcher): void;
+    protected setMcpCallback(handler: RootHandler | null): void;
+    /** Serve an embedded BFF at `/bff`. Pass null to stop answering there. */
+    protected setBffCallback(callback: HttpCallback | null): void;
     /**
      * Dispatcher that runs agent-client requests against the agent's own `/forest` stack in-memory.
      * The handler is rebuilt on every (re)mount so a captured reference never goes stale.

package/dist/framework-mounter.js

@@ -7,9 +7,10 @@ const router_1 = __importDefault(require("@koa/router"));
 const http_1 = require("http");
 const koa_1 = __importDefault(require("koa"));
 const path_1 = __importDefault(require("path"));
+const bff_routes_1 = require("./bff-routes");
 const fastify_adapter_1 = __importDefault(require("./fastify-adapter"));
 const mcp_in_process_dispatcher_1 = __importDefault(require("./mcp-in-process-dispatcher"));
-const mcp_middleware_1 = __importDefault(require("./mcp-middleware"));
+const root_middleware_1 = __importDefault(require("./root-middleware"));
 class FrameworkMounter {
     /** Compute the prefix that the main router should be mounted at in the client's application */
     get completeMountPrefix() {
@@ -23,14 +24,20 @@ class FrameworkMounter {
         this.prefix = prefix;
         this.logger = logger;
         this.fastifyAdapter = new fastify_adapter_1.default(logger);
-        this.mcpMiddleware = new mcp_middleware_1.default();
+        this.rootMiddleware = new root_middleware_1.default(logger);
         this.inProcessDispatcher = new mcp_in_process_dispatcher_1.default(logger);
     }
     /**
-     * Set the MCP HTTP callback. Call this before mount() or remount().
+     * Register the MCP server at the root of the host application, or `null` to unregister it. The
+     * matcher comes with the callback: there is no default pattern set, so nothing can claim host
+     * urls by accident. Call this before mount() or remount().
      */
-    setMcpCallback(callback, routeMatcher) {
-        this.mcpMiddleware.setCallback(callback, routeMatcher);
+    setMcpCallback(handler) {
+        this.rootMiddleware.set('mcp', handler);
+    }
+    /** Serve an embedded BFF at `/bff`. Pass null to stop answering there. */
+    setBffCallback(callback) {
+        this.rootMiddleware.set('bff', callback && { callback, matches: bff_routes_1.isBffRoute });
     }
     /**
      * Dispatcher that runs agent-client requests against the agent's own `/forest` stack in-memory.
@@ -101,7 +108,7 @@ class FrameworkMounter {
      */
     mountOnExpress(express) {
         // MCP middleware - the callback handles its own path filtering and calls next() for non-MCP routes
-        express.use(this.mcpMiddleware.getExpressMiddleware());
+        express.use(this.rootMiddleware.getExpressMiddleware());
         // Mount main forest routes at /{prefix}/forest
         express.use(this.completeMountPrefix, this.getConnectCallback(false));
         this.logger('Info', `Successfully mounted on Express.js`);
@@ -113,7 +120,7 @@ class FrameworkMounter {
      */
     mountOnFastify(fastify) {
         // MCP middleware at root - the callback handles its own path filtering
-        this.fastifyAdapter.useCallback(fastify, this.mcpMiddleware.getExpressMiddleware(), '/');
+        this.fastifyAdapter.useCallback(fastify, this.rootMiddleware.getExpressMiddleware(), '/');
         // Mount main forest routes
         const callback = this.getConnectCallback(false);
         this.fastifyAdapter.useCallback(fastify, callback, this.completeMountPrefix);
@@ -138,7 +145,7 @@ class FrameworkMounter {
             parentRouter.use(driverRouter.routes());
         });
         // MCP middleware - intercepts MCP routes before they reach Koa's body parser
-        koa.use(this.mcpMiddleware.getKoaMiddleware());
+        koa.use(this.rootMiddleware.getKoaMiddleware());
         koa.use(parentRouter.routes());
         this.logger('Info', `Successfully mounted on Koa`);
         return this;
@@ -152,13 +159,13 @@ class FrameworkMounter {
         const callback = this.getConnectCallback(false);
         if (adapter.constructor.name === 'ExpressAdapter') {
             // MCP middleware at root - the callback handles its own path filtering
-            nestJs.use(this.mcpMiddleware.getExpressMiddleware());
+            nestJs.use(this.rootMiddleware.getExpressMiddleware());
             // Mount main forest routes
             nestJs.use(this.completeMountPrefix, callback);
         }
         else {
             // Fastify adapter - MCP middleware at root
-            this.fastifyAdapter.useCallback(nestJs, this.mcpMiddleware.getExpressMiddleware(), '/');
+            this.fastifyAdapter.useCallback(nestJs, this.rootMiddleware.getExpressMiddleware(), '/');
             this.fastifyAdapter.useCallback(nestJs, callback, this.completeMountPrefix);
         }
         this.logger('Info', `Successfully mounted on NestJS`);
@@ -176,9 +183,9 @@ class FrameworkMounter {
         return (req, res) => {
             // For standalone server (nested), check MCP callback first
             // The MCP callback handles its own path filtering
-            const mcpCallback = this.mcpMiddleware.getCallback();
-            if (nested && mcpCallback) {
-                mcpCallback(req, res, () => {
+            const rootCallback = this.rootMiddleware.getCallback();
+            if (nested && rootCallback) {
+                rootCallback(req, res, () => {
                     // next() called means not an MCP route - forward to main handler
                     if (handler) {
                         handler(req, res);
@@ -201,4 +208,4 @@ class FrameworkMounter {
     }
 }
 exports.default = FrameworkMounter;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnJhbWV3b3JrLW1vdW50ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZnJhbWV3b3JrLW1vdW50ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFLQSx5REFBaUM7QUFDakMsK0JBQW9DO0FBQ3BDLDhDQUFzQjtBQUN0QixnREFBd0I7QUFFeEIsd0VBQStDO0FBQy9DLDRGQUE4RDtBQUM5RCxzRUFBNkM7QUFFN0MsTUFBcUIsZ0JBQWdCO0lBZ0JuQywrRkFBK0Y7SUFDL0YsSUFBWSxtQkFBbUI7UUFDN0IsT0FBTyxjQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBRUQsWUFBWSxNQUFjLEVBQUUsTUFBYztRQWpCekIsaUJBQVksR0FBNEIsRUFBRSxDQUFDO1FBQzNDLGdCQUFXLEdBQTBDLEVBQUUsQ0FBQztRQUV4RCxXQUFNLEdBQTRCLEVBQUUsQ0FBQztRQU85Qyw0QkFBdUIsR0FBRyxLQUFLLENBQUM7UUFRdEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHlCQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakQsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLHdCQUFhLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxtQ0FBbUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQ7O09BRUc7SUFDTyxjQUFjLENBQUMsUUFBNkIsRUFBRSxZQUE4QjtRQUNwRixJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVEOzs7T0FHRztJQUNPLHNCQUFzQjtRQUM5QixJQUFJLENBQUMsSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDbEMsSUFBSSxDQUFDLHVCQUF1QixHQUFHLElBQUksQ0FBQztZQUNwQyxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUMsWUFBWSxFQUFDLEVBQUU7Z0JBQ3pDLE1BQU0sTUFBTSxHQUFHLElBQUksZ0JBQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDNUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxJQUFJLGFBQUcsRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ2pGLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLG1CQUFtQixDQUFDO0lBQ2xDLENBQUM7SUFFUyxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQWM7UUFDbEMsS0FBSyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsWUFBWTtZQUFFLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyx1Q0FBdUM7UUFFM0YsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFFUyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQWM7UUFDcEMsS0FBSyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsV0FBVztZQUFFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsdUNBQXVDO0lBQ2xHLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsdUNBQXVDO0lBQ3ZGLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCx1QkFBdUIsQ0FBQyxJQUFhLEVBQUUsSUFBYTtRQUNsRCxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxTQUFTLENBQUM7UUFDMUQsTUFBTSxVQUFVLEdBQUcsSUFBSSxJQUFJLFdBQVcsSUFBSSxJQUFJLENBQUM7UUFDL0MsSUFBSSxDQUFDLG9CQUFvQixHQUFHLElBQUksQ0FBQztRQUNqQyxNQUFNLE1BQU0sR0FBRyxJQUFBLG1CQUFZLEVBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFFM0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO1lBQzFCLE9BQU8sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7Z0JBQzNDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUU7b0JBQ25DLElBQUksQ0FBQyxvQkFBb0IsR0FBSSxNQUFNLENBQUMsT0FBTyxFQUFzQixDQUFDLElBQUksQ0FBQztvQkFDdkUsSUFBSSxDQUFDLE1BQU0sQ0FDVCxNQUFNLEVBQ04scURBQXFELElBQUksSUFBSSxTQUFTLElBQ3BFLElBQUksQ0FBQyxvQkFDUCxHQUFHLENBQ0osQ0FBQztvQkFFRixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLElBQUksRUFBRTt3QkFDMUIsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLFdBQVcsRUFBRSxVQUFVLEVBQUUsRUFBRTs0QkFDbEQsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQVEsRUFBRSxFQUFFO2dDQUN4QixJQUFJLEdBQUcsRUFBRSxDQUFDO29DQUNSLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztnQ0FDbEIsQ0FBQztxQ0FBTSxDQUFDO29DQUNOLFdBQVcsRUFBRSxDQUFDO2dDQUNoQixDQUFDOzRCQUNILENBQUMsQ0FBQyxDQUFDO3dCQUNMLENBQUMsQ0FBQyxDQUFDO29CQUNMLENBQUMsQ0FBQyxDQUFDO29CQUVILE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUMsQ0FBQyxDQUFDO2dCQUNILE1BQU0sQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQyxDQUFDLENBQUM7UUFFSCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7O09BR0c7SUFDSCxjQUFjLENBQUMsT0FBWTtRQUN6QixtR0FBbUc7UUFDbkcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLG9CQUFvQixFQUFFLENBQUMsQ0FBQztRQUV2RCwrQ0FBK0M7UUFDL0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFFdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsb0NBQW9DLENBQUMsQ0FBQztRQUUxRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7O09BR0c7SUFDSCxjQUFjLENBQUMsT0FBWTtRQUN6Qix1RUFBdUU7UUFDdkUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUV6RiwyQkFBMkI7UUFDM0IsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2hELElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFFN0UsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztRQUV2RCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7O09BR0c7SUFDSCxVQUFVLENBQUMsR0FBUTtRQUNqQixNQUFNLFlBQVksR0FBRyxJQUFJLGdCQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQztRQUV0RSx3RUFBd0U7UUFDeEUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLEVBQUU7WUFDMUIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1lBQzFCLEdBQUcsQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLHNCQUFzQixFQUFFLENBQUM7UUFDeEQsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUMsWUFBWSxFQUFDLEVBQUU7WUFDekMsMkJBQTJCO1lBQzNCLFlBQVksQ0FBQyxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQ3hCLGtCQUFrQjtZQUNsQixZQUFZLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzFDLENBQUMsQ0FBQyxDQUFDO1FBRUgsNkVBQTZFO1FBQzdFLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7UUFDL0MsR0FBRyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSw2QkFBNkIsQ0FBQyxDQUFDO1FBRW5ELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILGFBQWEsQ0FBQyxNQUFXO1FBQ3ZCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUN4QyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFaEQsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ2xELHVFQUF1RTtZQUN2RSxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxDQUFDO1lBQ3RELDJCQUEyQjtZQUMzQixNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUNqRCxDQUFDO2FBQU0sQ0FBQztZQUNOLDJDQUEyQztZQUMzQyxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3hGLElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLGdDQUFnQyxDQUFDLENBQUM7UUFFdEQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sa0JBQWtCLENBQUMsTUFBZTtRQUN4QyxJQUFJLE9BQU8sR0FBMEMsSUFBSSxDQUFDO1FBRTFELElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBQyxZQUFZLEVBQUMsRUFBRTtZQUN6QyxJQUFJLE1BQU0sR0FBRyxZQUFZLENBQUM7WUFFMUIsSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDWCxNQUFNLEdBQUcsSUFBSSxnQkFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQ2pGLENBQUM7WUFFRCxPQUFPLEdBQUcsSUFBSSxhQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDdEQsQ0FBQyxDQUFDLENBQUM7UUFFSCxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFO1lBQ2xCLDJEQUEyRDtZQUMzRCxrREFBa0Q7WUFDbEQsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUVyRCxJQUFJLE1BQU0sSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDMUIsV0FBVyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFO29CQUN6QixpRUFBaUU7b0JBQ2pFLElBQUksT0FBTyxFQUFFLENBQUM7d0JBQ1osT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztvQkFDcEIsQ0FBQzt5QkFBTSxDQUFDO3dCQUNOLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQzt3QkFDM0QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDO29CQUM3RCxDQUFDO2dCQUNILENBQUMsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDWixPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3BCLENBQUM7aUJBQU0sQ0FBQztnQkFDTixHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQUM7Z0JBQzNELEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxzQkFBc0IsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUM3RCxDQUFDO1FBQ0gsQ0FBQyxDQUFDO0lBQ0osQ0FBQztDQUNGO0FBNU9ELG1DQTRPQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnJhbWV3b3JrLW1vdW50ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZnJhbWV3b3JrLW1vdW50ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFLQSx5REFBaUM7QUFDakMsK0JBQW9DO0FBQ3BDLDhDQUFzQjtBQUN0QixnREFBd0I7QUFFeEIsNkNBQTBDO0FBQzFDLHdFQUErQztBQUMvQyw0RkFBOEQ7QUFDOUQsd0VBQStDO0FBRS9DLE1BQXFCLGdCQUFnQjtJQWdCbkMsK0ZBQStGO0lBQy9GLElBQVksbUJBQW1CO1FBQzdCLE9BQU8sY0FBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVELFlBQVksTUFBYyxFQUFFLE1BQWM7UUFqQnpCLGlCQUFZLEdBQTRCLEVBQUUsQ0FBQztRQUMzQyxnQkFBVyxHQUEwQyxFQUFFLENBQUM7UUFFeEQsV0FBTSxHQUE0QixFQUFFLENBQUM7UUFPOUMsNEJBQXVCLEdBQUcsS0FBSyxDQUFDO1FBUXRDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxjQUFjLEdBQUcsSUFBSSx5QkFBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxjQUFjLEdBQUcsSUFBSSx5QkFBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxtQkFBbUIsR0FBRyxJQUFJLG1DQUFtQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFFRDs7OztPQUlHO0lBQ08sY0FBYyxDQUFDLE9BQTJCO1FBQ2xELElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQsMEVBQTBFO0lBQ2hFLGNBQWMsQ0FBQyxRQUE2QjtRQUNwRCxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsUUFBUSxJQUFJLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSx1QkFBVSxFQUFFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBRUQ7OztPQUdHO0lBQ08sc0JBQXNCO1FBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztZQUNsQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsSUFBSSxDQUFDO1lBQ3BDLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBQyxZQUFZLEVBQUMsRUFBRTtnQkFDekMsTUFBTSxNQUFNLEdBQUcsSUFBSSxnQkFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RSxJQUFJLENBQUMsbUJBQW1CLENBQUMsVUFBVSxDQUFDLElBQUksYUFBRyxFQUFFLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7WUFDakYsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUMsbUJBQW1CLENBQUM7SUFDbEMsQ0FBQztJQUVTLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBYztRQUNsQyxLQUFLLE1BQU0sSUFBSSxJQUFJLElBQUksQ0FBQyxZQUFZO1lBQUUsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLHVDQUF1QztRQUUzRixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUVTLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBYztRQUNwQyxLQUFLLE1BQU0sSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXO1lBQUUsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyx1Q0FBdUM7SUFDbEcsQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsS0FBSyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyx1Q0FBdUM7SUFDdkYsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNILHVCQUF1QixDQUFDLElBQWEsRUFBRSxJQUFhO1FBQ2xELE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLFNBQVMsQ0FBQztRQUMxRCxNQUFNLFVBQVUsR0FBRyxJQUFJLElBQUksV0FBVyxJQUFJLElBQUksQ0FBQztRQUMvQyxJQUFJLENBQUMsb0JBQW9CLEdBQUcsSUFBSSxDQUFDO1FBQ2pDLE1BQU0sTUFBTSxHQUFHLElBQUEsbUJBQVksRUFBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUUzRCxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7WUFDMUIsT0FBTyxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtnQkFDM0MsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRTtvQkFDbkMsSUFBSSxDQUFDLG9CQUFvQixHQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQXNCLENBQUMsSUFBSSxDQUFDO29CQUN2RSxJQUFJLENBQUMsTUFBTSxDQUNULE1BQU0sRUFDTixxREFBcUQsSUFBSSxJQUFJLFNBQVMsSUFDcEUsSUFBSSxDQUFDLG9CQUNQLEdBQUcsQ0FDSixDQUFDO29CQUVGLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssSUFBSSxFQUFFO3dCQUMxQixNQUFNLElBQUksT0FBTyxDQUFPLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxFQUFFOzRCQUNsRCxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBUSxFQUFFLEVBQUU7Z0NBQ3hCLElBQUksR0FBRyxFQUFFLENBQUM7b0NBQ1IsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dDQUNsQixDQUFDO3FDQUFNLENBQUM7b0NBQ04sV0FBVyxFQUFFLENBQUM7Z0NBQ2hCLENBQUM7NEJBQ0gsQ0FBQyxDQUFDLENBQUM7d0JBQ0wsQ0FBQyxDQUFDLENBQUM7b0JBQ0wsQ0FBQyxDQUFDLENBQUM7b0JBRUgsT0FBTyxFQUFFLENBQUM7Z0JBQ1osQ0FBQyxDQUFDLENBQUM7Z0JBQ0gsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDN0IsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUVILE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILGNBQWMsQ0FBQyxPQUFZO1FBQ3pCLG1HQUFtRztRQUNuRyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxDQUFDO1FBRXhELCtDQUErQztRQUMvQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUV0RSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDO1FBRTFELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILGNBQWMsQ0FBQyxPQUFZO1FBQ3pCLHVFQUF1RTtRQUN2RSxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxvQkFBb0IsRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBRTFGLDJCQUEyQjtRQUMzQixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUU3RSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxpQ0FBaUMsQ0FBQyxDQUFDO1FBRXZELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILFVBQVUsQ0FBQyxHQUFRO1FBQ2pCLE1BQU0sWUFBWSxHQUFHLElBQUksZ0JBQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxDQUFDO1FBRXRFLHdFQUF3RTtRQUN4RSxZQUFZLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsRUFBRTtZQUMxQixHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7WUFDMUIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztRQUN4RCxDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBQyxZQUFZLEVBQUMsRUFBRTtZQUN6QywyQkFBMkI7WUFDM0IsWUFBWSxDQUFDLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDeEIsa0JBQWtCO1lBQ2xCLFlBQVksQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDMUMsQ0FBQyxDQUFDLENBQUM7UUFFSCw2RUFBNkU7UUFDN0UsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0FBQztRQUNoRCxHQUFHLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLDZCQUE2QixDQUFDLENBQUM7UUFFbkQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsYUFBYSxDQUFDLE1BQVc7UUFDdkIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVoRCxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxLQUFLLGdCQUFnQixFQUFFLENBQUM7WUFDbEQsdUVBQXVFO1lBQ3ZFLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLENBQUM7WUFDdkQsMkJBQTJCO1lBQzNCLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2pELENBQUM7YUFBTSxDQUFDO1lBQ04sMkNBQTJDO1lBQzNDLElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsY0FBYyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDekYsSUFBSSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUM5RSxDQUFDO1FBRUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsZ0NBQWdDLENBQUMsQ0FBQztRQUV0RCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFTyxrQkFBa0IsQ0FBQyxNQUFlO1FBQ3hDLElBQUksT0FBTyxHQUEwQyxJQUFJLENBQUM7UUFFMUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFDLFlBQVksRUFBQyxFQUFFO1lBQ3pDLElBQUksTUFBTSxHQUFHLFlBQVksQ0FBQztZQUUxQixJQUFJLE1BQU0sRUFBRSxDQUFDO2dCQUNYLE1BQU0sR0FBRyxJQUFJLGdCQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDakYsQ0FBQztZQUVELE9BQU8sR0FBRyxJQUFJLGFBQUcsRUFBRSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN0RCxDQUFDLENBQUMsQ0FBQztRQUVILE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUU7WUFDbEIsMkRBQTJEO1lBQzNELGtEQUFrRDtZQUNsRCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBRXZELElBQUksTUFBTSxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUMzQixZQUFZLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUU7b0JBQzFCLGlFQUFpRTtvQkFDakUsSUFBSSxPQUFPLEVBQUUsQ0FBQzt3QkFDWixPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDO29CQUNwQixDQUFDO3lCQUFNLENBQUM7d0JBQ04sR0FBRyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO3dCQUMzRCxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDLENBQUM7b0JBQzdELENBQUM7Z0JBQ0gsQ0FBQyxDQUFDLENBQUM7Z0JBRUgsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLE9BQU8sRUFBRSxDQUFDO2dCQUNaLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDcEIsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztnQkFDM0QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDLENBQUM7SUFDSixDQUFDO0NBQ0Y7QUFuUEQsbUNBbVBDIn0=

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import type { TSchema } from '@forestadmin/datasource-customizer';
 import Agent from './agent';
 export declare function createAgent<S extends TSchema = TSchema>(options: AgentOptions): Agent<S>;
 export { Agent };
-export { AgentOptions, WorkflowExecutorEmbedOptions } from './types';
+export { AgentOptions, BffEmbedOptions, WorkflowExecutorEmbedOptions } from './types';
 export * from '@forestadmin/datasource-customizer';
 export { default as SchemaGenerator } from './utils/forest-schema/generator';
 //# sourceMappingURL=index.d.ts.map

package/dist/root-middleware.d.ts

@@ -0,0 +1,33 @@
+import type { HttpCallback, RootHandler } from './types';
+import type { Logger } from '@forestadmin/datasource-toolkit';
+import type Koa from 'koa';
+/**
+ * Handlers the agent serves at the root of the host application rather than under its own router
+ * prefix — the MCP server, the embedded BFF. Each one claims a set of paths through its matcher;
+ * anything else falls through to the host, untouched.
+ *
+ * Registered by name so a handler can be replaced or removed on a restart without the mount points
+ * having to know what is registered.
+ */
+export default class RootMiddleware {
+    private readonly handlers;
+    private readonly logger;
+    constructor(logger: Logger);
+    set(name: string, handler: RootHandler | null): void;
+    private entryFor;
+    /**
+     * First registered matcher wins. Overlapping matchers cannot be caught at registration — the
+     * predicates are opaque — so the winner is named here instead: a request answered by the wrong
+     * handler is otherwise indistinguishable from one whose route was never registered.
+     */
+    private handlerFor;
+    /**
+     * Connect-style middleware. A handler that decides not to answer calls `next()`, which passes the
+     * request on to the host exactly as if nothing had been registered.
+     */
+    getExpressMiddleware(): HttpCallback;
+    getKoaMiddleware(): Koa.Middleware;
+    /** The combined callback, or null when nothing is registered and the host needs no detour. */
+    getCallback(): HttpCallback | null;
+}
+//# sourceMappingURL=root-middleware.d.ts.map

package/dist/root-middleware.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_to_koa_1 = __importDefault(require("./utils/express-to-koa"));
+/**
+ * Handlers the agent serves at the root of the host application rather than under its own router
+ * prefix — the MCP server, the embedded BFF. Each one claims a set of paths through its matcher;
+ * anything else falls through to the host, untouched.
+ *
+ * Registered by name so a handler can be replaced or removed on a restart without the mount points
+ * having to know what is registered.
+ */
+class RootMiddleware {
+    constructor(logger) {
+        this.handlers = new Map();
+        this.logger = logger;
+    }
+    set(name, handler) {
+        if (handler)
+            this.handlers.set(name, handler);
+        else
+            this.handlers.delete(name);
+    }
+    entryFor(url) {
+        for (const entry of this.handlers) {
+            if (entry[1].matches(url))
+                return entry;
+        }
+        return null;
+    }
+    /**
+     * First registered matcher wins. Overlapping matchers cannot be caught at registration — the
+     * predicates are opaque — so the winner is named here instead: a request answered by the wrong
+     * handler is otherwise indistinguishable from one whose route was never registered.
+     */
+    handlerFor(url) {
+        const entry = this.entryFor(url);
+        if (!entry)
+            return null;
+        this.logger('Debug', `Root middleware: '${entry[0]}' claims ${url}`);
+        return entry[1].callback;
+    }
+    /**
+     * Connect-style middleware. A handler that decides not to answer calls `next()`, which passes the
+     * request on to the host exactly as if nothing had been registered.
+     */
+    getExpressMiddleware() {
+        return (req, res, next) => {
+            const handler = this.handlerFor(req.url ?? '/');
+            if (handler) {
+                handler(req, res, next);
+                return;
+            }
+            next?.();
+        };
+    }
+    getKoaMiddleware() {
+        return (0, express_to_koa_1.default)(this.getExpressMiddleware(), url => this.entryFor(url) !== null);
+    }
+    /** The combined callback, or null when nothing is registered and the host needs no detour. */
+    getCallback() {
+        if (this.handlers.size === 0)
+            return null;
+        return this.getExpressMiddleware();
+    }
+}
+exports.default = RootMiddleware;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdC1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3Jvb3QtbWlkZGxld2FyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUlBLDRFQUFrRDtBQUVsRDs7Ozs7OztHQU9HO0FBQ0gsTUFBcUIsY0FBYztJQUlqQyxZQUFZLE1BQWM7UUFIVCxhQUFRLEdBQUcsSUFBSSxHQUFHLEVBQXVCLENBQUM7UUFJekQsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7SUFDdkIsQ0FBQztJQUVELEdBQUcsQ0FBQyxJQUFZLEVBQUUsT0FBMkI7UUFDM0MsSUFBSSxPQUFPO1lBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDOztZQUN6QyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNsQyxDQUFDO0lBRU8sUUFBUSxDQUFDLEdBQVc7UUFDMUIsS0FBSyxNQUFNLEtBQUssSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEMsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQztnQkFBRSxPQUFPLEtBQUssQ0FBQztRQUMxQyxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLFVBQVUsQ0FBQyxHQUFXO1FBQzVCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7UUFFakMsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLElBQUksQ0FBQztRQUV4QixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsS0FBSyxDQUFDLENBQUMsQ0FBQyxZQUFZLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFFckUsT0FBTyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQzNCLENBQUM7SUFFRDs7O09BR0c7SUFDSCxvQkFBb0I7UUFDbEIsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDeEIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDO1lBRWhELElBQUksT0FBTyxFQUFFLENBQUM7Z0JBQ1osT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBRXhCLE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUNYLENBQUMsQ0FBQztJQUNKLENBQUM7SUFFRCxnQkFBZ0I7UUFDZCxPQUFPLElBQUEsd0JBQVksRUFBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUVELDhGQUE4RjtJQUM5RixXQUFXO1FBQ1QsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxDQUFDO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFFMUMsT0FBTyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0NBQ0Y7QUFoRUQsaUNBZ0VDIn0=

package/dist/types.d.ts

@@ -151,6 +151,47 @@ export type WorkflowExecutorEmbedOptions = Omit<WorkflowExecutorTuningOptions, '
      */
     encryptionKey?: string;
 };
+/**
+ * Options of an embedded BFF. Everything the BFF shares with the agent — the secrets, the Forest
+ * urls, the logger — is inherited rather than repeated: a divergent `authSecret` would make the
+ * agent reject the very tokens the BFF mints, as an opaque 401.
+ */
+export type BffEmbedOptions = {
+    /**
+     * Base64-encoded 32-byte AES-256 key encrypting stored refresh tokens. Gates the OAuth
+     * login/refresh flow (mode 1) and, with it, the AI relay.
+     *
+     * It is not an access control. The data routes accept a `bff_access` bearer whether or not this
+     * is set, because that token is verified against the agent's `authSecret` alone. Omitting it
+     * closes the login flow, not the session-bearer path — what protects that path is `authSecret`.
+     */
+    tokenEncryptionKey?: string;
+    /**
+     * Exact origins (scheme + host + port) allowed to call the BFF from a browser. No wildcard.
+     * Empty means no cross-origin browser access at all, which for a backend-for-frontend is
+     * almost always a mistake — the BFF warns about it at startup.
+     */
+    allowedOrigins?: string[];
+    /** Fallback IANA timezone for a request that carries none. */
+    defaultTimezone?: string;
+    /**
+     * How long a call to the agent may take. Defaults to 10s.
+     *
+     * It bounds how long the BFF waits, and cancels nothing: an action or a write cut off at the
+     * deadline keeps running inside the agent and still commits, so a client retrying on the timeout
+     * can double the mutation. Raise it rather than relying on a retry for operations that are not
+     * idempotent.
+     */
+    agentTimeoutMs?: number;
+    /** How long the AI relay waits for the Forest server. Defaults to 120s. */
+    aiTimeoutMs?: number;
+    /**
+     * Serve `/bff/docs` and `/bff/agent/openapi.json`. Defaults to `false` when embedded: the
+     * document is not filtered per caller, so any authenticated caller reads the name of every
+     * exposed collection, relation and field.
+     */
+    openapiEnabled?: boolean;
+};
 export type AuditTrailRuntime = AuditTrailConfig & {
     store: AuditStore;
     close: () => Promise<void>;
@@ -159,7 +200,12 @@ export type AgentOptionsWithDefaults = Readonly<Required<Omit<AgentOptions, 'aud
     auditTrail: AuditTrailRuntime | null;
 }>;
 export type HttpCallback = (req: IncomingMessage, res: ServerResponse, next?: () => void) => void;
-export type McpRouteMatcher = (url: string) => boolean;
+export type RouteMatcher = (url: string) => boolean;
+/** A handler served at the root of the host application, with the urls it claims. */
+export type RootHandler = {
+    callback: HttpCallback;
+    matches: RouteMatcher;
+};
 export declare enum HttpCode {
     BadRequest = 400,
     Unauthorized = 401,

package/dist/types.js

@@ -22,4 +22,4 @@ var RouteType;
     RouteType[RouteType["Authentication"] = 3] = "Authentication";
     RouteType[RouteType["PrivateRoute"] = 4] = "PrivateRoute";
 })(RouteType || (exports.RouteType = RouteType = {}));
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBc0tBLElBQVksUUFVWDtBQVZELFdBQVksUUFBUTtJQUNsQixxREFBZ0IsQ0FBQTtJQUNoQix5REFBa0IsQ0FBQTtJQUNsQixtREFBZSxDQUFBO0lBQ2YsaURBQWMsQ0FBQTtJQUNkLDJEQUFtQixDQUFBO0lBQ25CLCtEQUFxQixDQUFBO0lBQ3JCLHVFQUF5QixDQUFBO0lBQ3pCLG1EQUFlLENBQUE7SUFDZixxQ0FBUSxDQUFBO0FBQ1YsQ0FBQyxFQVZXLFFBQVEsd0JBQVIsUUFBUSxRQVVuQjtBQUVELElBQVksU0FPWDtBQVBELFdBQVksU0FBUztJQUNuQixpR0FBaUc7SUFDakcsMkRBQWlCLENBQUE7SUFDakIseURBQWdCLENBQUE7SUFDaEIsdURBQWUsQ0FBQTtJQUNmLDZEQUFrQixDQUFBO0lBQ2xCLHlEQUFnQixDQUFBO0FBQ2xCLENBQUMsRUFQVyxTQUFTLHlCQUFULFNBQVMsUUFPcEIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBbU5BLElBQVksUUFVWDtBQVZELFdBQVksUUFBUTtJQUNsQixxREFBZ0IsQ0FBQTtJQUNoQix5REFBa0IsQ0FBQTtJQUNsQixtREFBZSxDQUFBO0lBQ2YsaURBQWMsQ0FBQTtJQUNkLDJEQUFtQixDQUFBO0lBQ25CLCtEQUFxQixDQUFBO0lBQ3JCLHVFQUF5QixDQUFBO0lBQ3pCLG1EQUFlLENBQUE7SUFDZixxQ0FBUSxDQUFBO0FBQ1YsQ0FBQyxFQVZXLFFBQVEsd0JBQVIsUUFBUSxRQVVuQjtBQUVELElBQVksU0FPWDtBQVBELFdBQVksU0FBUztJQUNuQixpR0FBaUc7SUFDakcsMkRBQWlCLENBQUE7SUFDakIseURBQWdCLENBQUE7SUFDaEIsdURBQWUsQ0FBQTtJQUNmLDZEQUFrQixDQUFBO0lBQ2xCLHlEQUFnQixDQUFBO0FBQ2xCLENBQUMsRUFQVyxTQUFTLHlCQUFULFNBQVMsUUFPcEIifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent",
-  "version": "1.99.2",
+  "version": "1.100.0",
   "main": "dist/index.js",
   "license": "GPL-3.0",
   "publishConfig": {
@@ -49,6 +49,7 @@
   },
   "devDependencies": {
     "@fastify/express": "^1.1.0",
+    "@forestadmin/agent-bff": "1.29.0",
     "@forestadmin/datasource-sql": "1.17.14",
     "@forestadmin/workflow-executor": "1.28.0",
     "@nestjs/common": "^11.1.24",
@@ -56,28 +57,34 @@
     "@nestjs/platform-express": "^11.1.24",
     "@nestjs/platform-fastify": "^11.1.24",
     "@shopify/jest-koa-mocks": "^3.1.0",
-    "sqlite3": "^5.1.7",
     "@types/json-api-serializer": "^2.6.3",
     "@types/jsonwebtoken": "^9.0.1",
     "@types/koa": "^2.13.5",
     "@types/koa__cors": "^3.3.0",
     "@types/superagent": "^8.1.9",
+    "@types/supertest": "^6.0.2",
     "express": "^4.18.2",
     "fastify": "^3.29.0",
     "fastify2": "npm:fastify@^2.15.3",
     "fastify4": "npm:fastify@^4.28.0",
     "openid-client": "^5.7.1",
     "reflect-metadata": "^0.1.13",
-    "rxjs": "^7.8.0"
+    "rxjs": "^7.8.0",
+    "sqlite3": "^5.1.7",
+    "supertest": "^7.1.3"
   },
   "peerDependencies": {
     "@fastify/express": "^1.1.0 || ^2.0.0 || ^3.0.0 || ^4.0.0",
+    "@forestadmin/agent-bff": "1.29.0",
     "@forestadmin/workflow-executor": "1.28.0"
   },
   "peerDependenciesMeta": {
     "@fastify/express": {
       "optional": true
     },
+    "@forestadmin/agent-bff": {
+      "optional": true
+    },
     "@forestadmin/workflow-executor": {
       "optional": true
     }

package/dist/mcp-middleware.d.ts

@@ -1,27 +0,0 @@
-import type { HttpCallback, McpRouteMatcher } from './types';
-import type Koa from 'koa';
-/**
- * Factory functions for creating MCP middleware for different frameworks.
- * MCP middleware intercepts MCP-specific routes (/.well-known/*, /oauth/*, /mcp)
- * and forwards them to the MCP callback, while passing through other routes.
- */
-export default class McpMiddleware {
-    private mcpHttpCallback;
-    private routeMatcher;
-    setCallback(callback: HttpCallback | null, routeMatcher?: McpRouteMatcher): void;
-    /**
-     * Get the current MCP HTTP callback.
-     */
-    getCallback(): HttpCallback | null;
-    /**
-     * Get an Express/Connect-style middleware that forwards requests to the MCP callback.
-     * The MCP callback handles path filtering and calls next() for non-MCP routes.
-     */
-    getExpressMiddleware(): HttpCallback;
-    /**
-     * Get a Koa middleware that forwards requests to the MCP callback.
-     * Uses expressToKoa wrapper for proper Koa integration.
-     */
-    getKoaMiddleware(): Koa.Middleware;
-}
-//# sourceMappingURL=mcp-middleware.d.ts.map

package/dist/mcp-middleware.js

@@ -1,67 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const express_to_koa_1 = __importDefault(require("./utils/express-to-koa"));
-/**
- * MCP route patterns that should be intercepted by the MCP middleware.
- */
-const MCP_ROUTE_PATTERNS = ['/.well-known/', '/oauth/', '/mcp'];
-/**
- * Check if a URL matches any MCP route pattern.
- */
-function isMcpRoute(url) {
-    return MCP_ROUTE_PATTERNS.some(pattern => url.startsWith(pattern));
-}
-/**
- * Factory functions for creating MCP middleware for different frameworks.
- * MCP middleware intercepts MCP-specific routes (/.well-known/*, /oauth/*, /mcp)
- * and forwards them to the MCP callback, while passing through other routes.
- */
-class McpMiddleware {
-    constructor() {
-        this.mcpHttpCallback = null;
-        this.routeMatcher = isMcpRoute;
-    }
-    setCallback(callback, routeMatcher) {
-        this.mcpHttpCallback = callback;
-        this.routeMatcher = routeMatcher ?? isMcpRoute;
-    }
-    /**
-     * Get the current MCP HTTP callback.
-     */
-    getCallback() {
-        return this.mcpHttpCallback;
-    }
-    /**
-     * Get an Express/Connect-style middleware that forwards requests to the MCP callback.
-     * The MCP callback handles path filtering and calls next() for non-MCP routes.
-     */
-    getExpressMiddleware() {
-        return (req, res, next) => {
-            if (this.mcpHttpCallback) {
-                this.mcpHttpCallback(req, res, next);
-            }
-            else if (next) {
-                next();
-            }
-        };
-    }
-    /**
-     * Get a Koa middleware that forwards requests to the MCP callback.
-     * Uses expressToKoa wrapper for proper Koa integration.
-     */
-    getKoaMiddleware() {
-        return (0, express_to_koa_1.default)((req, res, next) => {
-            if (this.mcpHttpCallback) {
-                this.mcpHttpCallback(req, res, next);
-            }
-            else if (next) {
-                next();
-            }
-        }, url => this.routeMatcher(url));
-    }
-}
-exports.default = McpMiddleware;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWNwLW1pZGRsZXdhcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvbWNwLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFHQSw0RUFBa0Q7QUFFbEQ7O0dBRUc7QUFDSCxNQUFNLGtCQUFrQixHQUFHLENBQUMsZUFBZSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztBQUVoRTs7R0FFRztBQUNILFNBQVMsVUFBVSxDQUFDLEdBQVc7SUFDN0IsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFxQixhQUFhO0lBQWxDO1FBQ1Usb0JBQWUsR0FBd0IsSUFBSSxDQUFDO1FBQzVDLGlCQUFZLEdBQW9CLFVBQVUsQ0FBQztJQTRDckQsQ0FBQztJQTFDQyxXQUFXLENBQUMsUUFBNkIsRUFBRSxZQUE4QjtRQUN2RSxJQUFJLENBQUMsZUFBZSxHQUFHLFFBQVEsQ0FBQztRQUNoQyxJQUFJLENBQUMsWUFBWSxHQUFHLFlBQVksSUFBSSxVQUFVLENBQUM7SUFDakQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsV0FBVztRQUNULE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQztJQUM5QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsb0JBQW9CO1FBQ2xCLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQ3hCLElBQUksSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO2dCQUN6QixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDdkMsQ0FBQztpQkFBTSxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUNoQixJQUFJLEVBQUUsQ0FBQztZQUNULENBQUM7UUFDSCxDQUFDLENBQUM7SUFDSixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsZ0JBQWdCO1FBQ2QsT0FBTyxJQUFBLHdCQUFZLEVBQ2pCLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUNqQixJQUFJLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDekIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3ZDLENBQUM7aUJBQU0sSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDaEIsSUFBSSxFQUFFLENBQUM7WUFDVCxDQUFDO1FBQ0gsQ0FBQyxFQUNELEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FDOUIsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQTlDRCxnQ0E4Q0MifQ==