@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts

@@ -3,7 +3,7 @@
  * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /
  * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +
  * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and
- * the instance-cached uid), and the 404-as-null read tolerance.
+ * the credential-keyed cached uid), and the 404-as-null read tolerance.
  *
  * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the
  * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is
@@ -32,15 +32,58 @@ export declare class HttpApiReadClient {
     private readonly fetchImpl;
     private readonly rateBudget;
     /**
-     * The authenticated uid for this binding's credentials, resolved once per client instance
-     * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —
-     * clients are constructed once per consumer and the credential set is instance-stable. A
-     * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation
-     * hook belongs with the runtime-proof work, measured against real session-expiry behavior).
+     * The authenticated uid, KEYED ON the credential it was minted under rather than merely
+     * remembered against this instance.
+     *
+     * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and
+     * is worth caching: the virtual repository builds ONE client per binding and keeps it for the
+     * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating
+     * per call would double every read's round trips.
+     *
+     * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads
+     * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation
+     * genuinely reaches this class — and a uid remembered against the instance would then be an
+     * identity minted under the retired credential, presented on every subsequent `execute_kw`.
+     *
+     * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately
+     * preferred over an `invalidate()` some rotation path has to remember to call: there is no
+     * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note
+     * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so
+     * repointing the binding at another host must not reuse it either.
+     *
+     * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held
+     * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`
+     * call and costs microseconds against a network round trip.
+     *
+     * ONE slot, not a map. A map would save a handshake when a credential the client has already
+     * seen comes back, at the cost of accumulating one secret-derived entry per retired credential
+     * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.
+     * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.
+     *
+     * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which
+     * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating
+     * tenants each miss the key and pay a handshake — slower, and never one tenant acting under
+     * another tenant's uid, which is what an instance-remembered uid would have become the moment the
+     * scope widened. The key is the credential, so the widening cost a round trip and no correctness.
+     *
+     * This replaces the slice-1 note that said a rotation needs a process restart, and with it the
+     * owed work to "measure against real session-expiry behavior". That measurement was owed for an
+     * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:
+     * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so
+     * there is no server-side session here whose lifetime we could be racing — the only thing that
+     * can retire the uid is the credential (or the instance) it names, which is exactly the key.
      */
-    private odooAuthenticatedUid?;
+    private odooAuthenticatedIdentity?;
     constructor(binding: HttpApiResourceBinding, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike);
-    resolveAccess(executionContext: ExecutionContext<any>): HttpApiProviderAccess;
+    /**
+     * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.
+     *
+     * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of
+     * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land
+     * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is
+     * the whole fix.
+     */
+    resolveAccess(executionContext: ExecutionContext<any>): Promise<HttpApiProviderAccess>;
     odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown>;
     odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null>;
     /**
@@ -69,6 +112,15 @@ export declare class HttpApiReadClient {
     restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null>;
     private buildRestJsonRequest;
     odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown>;
+    /**
+     * The identity a cached uid belongs to: the instance it was minted on, and the exact credential
+     * it was minted with.
+     *
+     * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,
+     * so no combination of separators inside a db name, a login or a key can make two different
+     * tuples produce one key.
+     */
+    private static odooCredentialKey;
     private executeOdooRpc;
     /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */
     odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void>;

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-read-client.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,gBAGjC,CAAC;AAEF,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAd5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;gBAGnB,OAAO,EAAE,sBAAsB,EAC/B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAK7D,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,qBAAqB;IAMvE,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnG,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS7H;;;;OAIG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc/F,OAAO,CAAC,iBAAiB;IAaZ,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBnH;;;;OAIG;IACU,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBpI,OAAO,CAAC,oBAAoB;IA6Bf,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAqC/F,cAAc;IA6B5B,8FAA8F;IACjF,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpG;;;;OAIG;IACU,uBAAuB,CAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,EAAE,8BAA8B,GACvC,OAAO,CAAC,IAAI,CAAC;IAuBhB,sEAAsE;IACzD,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE,0FAA0F;IAC7E,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;CAQtF"}
+{"version":3,"file":"http-api-read-client.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,OAAO,KAAK,EACV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,gBAGjC,CAAC;AAoEF,qBAAa,iBAAiB;IAgD1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAjD5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,yBAAyB,CAAC,CAAyC;gBAGxD,OAAO,EAAE,sBAAsB,EAC/B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAKpE;;;;;;;OAOG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUtF,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnG,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS7H;;;;OAIG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWlG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc/F,OAAO,CAAC,iBAAiB;IAcZ,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBnH;;;;OAIG;IACU,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBpI,OAAO,CAAC,oBAAoB;IAmCf,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmD7G;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;YASlB,cAAc;IAiC5B,8FAA8F;IACjF,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpG;;;;OAIG;IACU,uBAAuB,CAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,EAAE,8BAA8B,GACvC,OAAO,CAAC,IAAI,CAAC;IA0BhB,sEAAsE;IACzD,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE,0FAA0F;IAC7E,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;CAQtF"}

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js

@@ -3,7 +3,7 @@
  * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /
  * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +
  * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and
- * the instance-cached uid), and the 404-as-null read tolerance.
+ * the credential-keyed cached uid), and the 404-as-null read tolerance.
  *
  * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the
  * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is
@@ -17,7 +17,10 @@
  * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed
  * bodies.
  */
-import { HttpApiRateBudget, HttpApiTransportError, HttpApiTransportFailureKind, executeHttpApiTransportCall, } from './http-api-transport.backend.js';
+import { createHash } from 'node:crypto';
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, } from '@wildo-ai/external-connectors-models';
+import { ExternalProvider_ConnectionTargetSchema, } from '@wildo-ai/external-connectors-models';
+import { HttpApiRateBudget, HttpApiTransportBodyEncoding, HttpApiTransportError, HttpApiTransportFailureKind, executeHttpApiTransportCall, } from './http-api-transport.backend.js';
 import { HttpApiRemoteContractError, resolveHttpApiResultPath, } from './http-api-row-projection.backend.js';
 import { HttpApiProviderAccessError, } from './http-api-provider-access.backend.js';
 /** Default fetch over the platform global (Node ≥18); injectable for tests. */
@@ -25,31 +28,131 @@ export const defaultHttpApiFetch = async (url, init) => {
     const response = await fetch(url, init);
     return { status: response.status, ok: response.ok, text: () => response.text() };
 };
+/**
+ * The binding's declared connection SHAPE, plus the instance ids this execution supplies — ONE
+ * place, deliberately.
+ *
+ * ## What changed, and why the refusal that used to live here is gone
+ *
+ * This function used to refuse every delegated binding, naming a missing subsystem: "the engine has
+ * no outbound per-user token store". That was true when it was written and is not any more — the
+ * store exists, is bound, and serves the connection controller (#333). What actually blocked the
+ * lift was narrower: the binding carried a two-valued `identityMode`, and `USER_DELEGATED` cannot
+ * say WHOSE ACCOUNT is spent. A user's own grant (`USER × SERVICE`) and a tenant's registration
+ * acting for one of its members (`ORGANIZATION × USER`) are both "per-user OAuth" and resolve
+ * different credentials, so mapping the one field would have silently picked a lane. The binding
+ * now carries the shape itself, and this function only has to source the instances.
+ *
+ * ## The ids come from the EXECUTION, and that is not the resolver reading ambient context
+ *
+ * `ExternalProvider_ConnectionTarget`'s own contract says a target is supplied BY THE CALL and never
+ * invented by the resolver, because "the resolver cannot verify a target it also invented". This is
+ * the call side of that split: an httpApiBinding read is triggered by a resource operation, so the
+ * organization and the user it runs for ARE the execution's, and naming them here is what leaves the
+ * resolver free to authorize them. It refuses rather than falling back — an absent organization on a
+ * tenant-owned binding must not quietly become the application's account, which is the exact
+ * mis-attribution `resolveProviderSecretForConnection` exists to prevent.
+ *
+ * ## The rules are the SCHEMA's
+ *
+ * Every refusal below comes from `ExternalProvider_ConnectionTargetSchema`'s own refinements, which
+ * already say — better than a re-statement here would — that an instance-owned connection names
+ * which instance, that an application-owned one has no id to name, and that a delegated call must
+ * name the user it acts for. Re-deriving them here would be a second copy that drifts.
+ */
+function connectionTargetForBinding(binding, executionContext) {
+    const { ownerScope, delegation } = binding.connection;
+    const initiator = executionContext.initiatorIds;
+    const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION
+        ? initiator?.organizationId
+        : ownerScope === ExternalProvider_Connection_OwnerScope.USER
+            ? initiator?.userId
+            : undefined;
+    const candidate = {
+        ownerScope,
+        delegation,
+        ...(ownerId === undefined ? {} : { ownerId }),
+        ...(delegation === ExternalProvider_Connection_DelegationMode.USER && initiator?.userId !== undefined
+            ? { actingForUserId: initiator.userId }
+            : {}),
+    };
+    const parsed = ExternalProvider_ConnectionTargetSchema.safeParse(candidate);
+    if (!parsed.success) {
+        throw new HttpApiProviderAccessError(`The binding toward provider '${binding.providerRef}' declares a ${ownerScope} × ${delegation} connection, `
+            + 'and this execution cannot supply what that names: '
+            + parsed.error.issues.map((issue) => issue.message).join(' ')
+            + ' Either trigger the read from an execution that carries them, or declare a connection the application can satisfy alone.');
+    }
+    return parsed.data;
+}
 export class HttpApiReadClient {
     binding;
     providerAccessResolver;
     fetchImpl;
     rateBudget;
     /**
-     * The authenticated uid for this binding's credentials, resolved once per client instance
-     * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —
-     * clients are constructed once per consumer and the credential set is instance-stable. A
-     * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation
-     * hook belongs with the runtime-proof work, measured against real session-expiry behavior).
+     * The authenticated uid, KEYED ON the credential it was minted under rather than merely
+     * remembered against this instance.
+     *
+     * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and
+     * is worth caching: the virtual repository builds ONE client per binding and keeps it for the
+     * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating
+     * per call would double every read's round trips.
+     *
+     * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads
+     * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation
+     * genuinely reaches this class — and a uid remembered against the instance would then be an
+     * identity minted under the retired credential, presented on every subsequent `execute_kw`.
+     *
+     * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately
+     * preferred over an `invalidate()` some rotation path has to remember to call: there is no
+     * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note
+     * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so
+     * repointing the binding at another host must not reuse it either.
+     *
+     * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held
+     * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`
+     * call and costs microseconds against a network round trip.
+     *
+     * ONE slot, not a map. A map would save a handshake when a credential the client has already
+     * seen comes back, at the cost of accumulating one secret-derived entry per retired credential
+     * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.
+     * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.
+     *
+     * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which
+     * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating
+     * tenants each miss the key and pay a handshake — slower, and never one tenant acting under
+     * another tenant's uid, which is what an instance-remembered uid would have become the moment the
+     * scope widened. The key is the credential, so the widening cost a round trip and no correctness.
+     *
+     * This replaces the slice-1 note that said a rotation needs a process restart, and with it the
+     * owed work to "measure against real session-expiry behavior". That measurement was owed for an
+     * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:
+     * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so
+     * there is no server-side session here whose lifetime we could be racing — the only thing that
+     * can retire the uid is the credential (or the instance) it names, which is exactly the key.
      */
-    odooAuthenticatedUid;
+    odooAuthenticatedIdentity;
     constructor(binding, providerAccessResolver, fetchImpl = defaultHttpApiFetch) {
         this.binding = binding;
         this.providerAccessResolver = providerAccessResolver;
         this.fetchImpl = fetchImpl;
         this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);
     }
-    resolveAccess(executionContext) {
-        return this.providerAccessResolver.resolveAccess(this.binding, executionContext);
+    /**
+     * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.
+     *
+     * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of
+     * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land
+     * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is
+     * the whole fix.
+     */
+    async resolveAccess(executionContext) {
+        return this.providerAccessResolver.resolveAccess(this.binding.providerRef, connectionTargetForBinding(this.binding, executionContext), executionContext);
     }
     // ── OData ────────────────────────────────────────────────────────────────────
     async odataGet(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await executeHttpApiTransportCall(this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         return response.json;
     }
@@ -69,9 +172,11 @@ export class HttpApiReadClient {
      * service-relative) continuation URL; nothing is compiled locally.
      */
     async odataGetByUrl(executionContext, url) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;
-        const response = await executeHttpApiTransportCall({ method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers } }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
+        const response = await executeHttpApiTransportCall(
+        // A paging continuation is a read: safe to re-send after a timeout.
+        { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers }, retrySafe: true }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         return response.json;
     }
     /**
@@ -85,7 +190,7 @@ export class HttpApiReadClient {
      */
     async odataMetadataText(executionContext) {
         try {
-            const access = this.resolveAccess(executionContext);
+            const access = await this.resolveAccess(executionContext);
             const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {
                 method: 'GET',
                 headers: { Accept: 'application/xml', ...access.headers },
@@ -106,11 +211,12 @@ export class HttpApiReadClient {
             method: 'GET',
             url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,
             headers: { Accept: 'application/json', ...access.headers },
+            retrySafe: true,
         };
     }
     // ── REST_JSON ────────────────────────────────────────────────────────────────
     async restJson(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await executeHttpApiTransportCall(this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         if (compiled.jsonRpc) {
             const envelope = response.json;
@@ -149,7 +255,10 @@ export class HttpApiReadClient {
                 method: 'POST',
                 url: `${access.baseUrl}${compiled.path}`,
                 headers: { Accept: 'application/json', ...access.headers },
-                jsonBody: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 },
+                body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 } },
+                // POST-shaped, read by construction: the read compilers are the only producers of this
+                // request and they compile nothing but reads, so re-sending it cannot duplicate a write.
+                retrySafe: true,
             };
         }
         if (compiled.method === 'POST') {
@@ -157,7 +266,9 @@ export class HttpApiReadClient {
                 method: 'POST',
                 url: `${access.baseUrl}${compiled.path}`,
                 headers: { Accept: 'application/json', ...access.headers },
-                jsonBody: compiled.params,
+                body: { encoding: HttpApiTransportBodyEncoding.JSON, value: compiled.params },
+                // Same argument as the JSON-RPC branch above: a POST-shaped SEARCH is still a read.
+                retrySafe: true,
             };
         }
         const search = Object.entries(compiled.params)
@@ -167,11 +278,12 @@ export class HttpApiReadClient {
             method: 'GET',
             url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,
             headers: { Accept: 'application/json', ...access.headers },
+            retrySafe: true,
         };
     }
     // ── Odoo execute_kw ──────────────────────────────────────────────────────────
     async odooExecuteKw(executionContext, call) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const credentials = access.jsonRpcInArgsCredentials;
         if (!credentials) {
             // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot
@@ -179,20 +291,33 @@ export class HttpApiReadClient {
             throw new HttpApiProviderAccessError(`Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `
                 + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.');
         }
-        if (this.odooAuthenticatedUid === undefined) {
+        // Resolved from THIS call's access, so a rotated credential produces a different key and the
+        // cached identity below simply does not match — no invalidation call, and therefore no
+        // rotation path that can forget to make one.
+        const credentialKey = HttpApiReadClient.odooCredentialKey(access.baseUrl, credentials);
+        let authenticatedUid = this.odooAuthenticatedIdentity?.credentialKey === credentialKey
+            ? this.odooAuthenticatedIdentity.uid
+            : undefined;
+        if (authenticatedUid === undefined) {
             const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [
                 credentials.db, credentials.login, credentials.apiKey, {},
             ]);
             if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {
                 // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.
+                //
+                // The previously cached identity is left alone rather than dropped: it belongs to a
+                // DIFFERENT key (that is why we are here), so it can never be served for these
+                // credentials, and keeping it means a rotation that is rolled back does not pay a second
+                // handshake. Only a successful authenticate writes the field.
                 throw new HttpApiProviderAccessError(`Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `
                     + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`);
             }
-            this.odooAuthenticatedUid = uid;
+            authenticatedUid = uid;
+            this.odooAuthenticatedIdentity = { credentialKey, uid };
         }
         return this.executeOdooRpc(access, 'object', 'execute_kw', [
             credentials.db,
-            this.odooAuthenticatedUid,
+            authenticatedUid,
             credentials.apiKey,
             this.binding.entityRef,
             call.method,
@@ -200,12 +325,29 @@ export class HttpApiReadClient {
             call.kwargs,
         ]);
     }
+    /**
+     * The identity a cached uid belongs to: the instance it was minted on, and the exact credential
+     * it was minted with.
+     *
+     * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,
+     * so no combination of separators inside a db name, a login or a key can make two different
+     * tuples produce one key.
+     */
+    static odooCredentialKey(baseUrl, credentials) {
+        return createHash('sha256')
+            .update(JSON.stringify([baseUrl, credentials.db, credentials.login, credentials.apiKey]))
+            .digest('hex');
+    }
     async executeOdooRpc(access, service, method, args) {
         const response = await executeHttpApiTransportCall({
             method: 'POST',
             url: `${access.baseUrl}/jsonrpc`,
             headers: { Accept: 'application/json', ...access.headers },
-            jsonBody: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 },
+            body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 } },
+            // Two callers, both safe to repeat: `common.authenticate` (a pure question) and
+            // `object.execute_kw` with a read method — the Odoo compiler emits `search_read`/
+            // `search_count` and nothing that writes.
+            retrySafe: true,
         }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         const envelope = response.json;
         if (envelope && typeof envelope === 'object' && envelope.error) {
@@ -216,11 +358,14 @@ export class HttpApiReadClient {
     // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──
     /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */
     async odataDeleteByPath(executionContext, path) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         await this.rawCallTolerating404({
             method: 'DELETE',
             url: `${access.baseUrl}${path}`,
             headers: { Accept: 'application/json', ...access.headers },
+            // Idempotent by key: the second DELETE of a gone row answers 404, which this door reads as
+            // already-gone. That is what makes a retried timeout safe here and unsafe on a create.
+            retrySafe: true,
         });
     }
     /**
@@ -229,14 +374,17 @@ export class HttpApiReadClient {
      * transport error.
      */
     async restDeclaredErasureCall(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await this.rawCallTolerating404({
             method: compiled.method,
             url: `${access.baseUrl}${compiled.path}`,
             headers: { Accept: 'application/json', ...access.headers },
-            jsonBody: compiled.jsonRpc
-                ? { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 }
+            body: compiled.jsonRpc
+                ? { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 } }
                 : undefined,
+            // A declared erasure addresses ONE row by key and is idempotent for the same reason the
+            // OData delete above is; the repository's own remediation for a partial failure is a re-run.
+            retrySafe: true,
         });
         if (compiled.jsonRpc && response !== undefined) {
             const envelope = response;

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-read-client.backend.js","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,GAG3B,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAqB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,OAAO,iBAAiB;IAaT;IACA;IACA;IAdF,UAAU,CAAoB;IAE/C;;;;;;OAMG;IACK,oBAAoB,CAAU;IAEtC,YACmB,OAA+B,EAC/B,sBAAqD,EACrD,YAA8B,mBAAmB;QAFjD,YAAO,GAAP,OAAO,CAAwB;QAC/B,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAEM,aAAa,CAAC,gBAAuC;QAC1D,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnF,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAA8B;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC5G,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,gBAAuC,EAAE,QAA8B;QACjG,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,GAAW;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,EAC/F,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,gBAAuC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,YAAY,EAAE;gBACnE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAA4D,EAAE,QAA8B;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAAiC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC/G,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAyE,CAAC;YACpG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAC7G,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,EAAE,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,gBAAuC,EAAE,QAAiC;QACxG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,0BAA0B,CAClC,6DAA6D,QAAQ,CAAC,UAAU,IAAI,QAAQ,wBAAwB,CACrH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAA4D,EAAE,QAAiC;QAC1H,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,MAAM;aAC1B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,IAAsB;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uFAAuF;YACvF,uEAAuE;YACvE,MAAM,IAAI,0BAA0B,CAClC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,+FAA+F;kBAClI,iIAAiI,CACpI,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE;gBACtE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,MAAM,IAAI,0BAA0B,CAClC,+CAA+C,IAAI,CAAC,OAAO,CAAC,WAAW,UAAU,WAAW,CAAC,EAAE,aAAa,WAAW,CAAC,KAAK,MAAM;sBACjI,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzD,WAAW,CAAC,EAAE;YACd,IAAI,CAAC,oBAAoB;YACzB,WAAW,CAAC,MAAM;YAClB,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA4D,EAC5D,OAAe,EACf,MAAc,EACd,IAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;SACvF,EACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAsG,CAAC;QACjI,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAC7B,wBAAwB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAClI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC;IAED,oFAAoF;IAEpF,8FAA8F;IACvF,KAAK,CAAC,iBAAiB,CAAC,gBAAuC,EAAE,IAAY;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC9B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE;YAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,uBAAuB,CAClC,gBAAuC,EACvC,QAAwC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,QAAQ,EAAE,QAAQ,CAAC,OAAO;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;gBAC3E,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAA2D,CAAC;YAC7E,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EACjI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAEhF,sEAAsE;IAC/D,KAAK,CAAC,OAAO,CAAC,OAAgC;QACnD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC3E,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,oBAAoB,CAAC,OAAgC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * `HttpApiReadClient` — THE one implementation of the HTTP-API dialect mechanics\n * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /\n * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +\n * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and\n * the instance-cached uid), and the 404-as-null read tolerance.\n *\n * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the\n * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is\n * not a persistence adapter — but the runtime middle must be structurally un-duplicable: this\n * class is where \"same mechanism\" stops being a discipline and becomes a fact. The drift pin\n * (`http-api-read-client.single-authority.test.ts`) refuses a second `authenticate` handshake\n * anywhere in the directory.\n *\n * Everything above the wire stays with the consumer: T-set translation, projection, scope\n * checks, audit emission, erasure orchestration, mapping/loading. This class never widens or\n * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed\n * bodies.\n */\n\nimport type {\n  HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nimport {\n  HttpApiRateBudget,\n  HttpApiTransportError,\n  HttpApiTransportFailureKind,\n  executeHttpApiTransportCall,\n  type HttpApiFetchLike,\n  type HttpApiTransportRequest,\n} from './http-api-transport.backend';\nimport type { ODataCompiledRequest } from './odata-query-compiler.backend';\nimport type { RestJsonCompiledErasureRequest, RestJsonCompiledRequest } from './rest-json-query-compiler.backend';\nimport type { OdooCompiledCall } from './odoo-jsonrpc-compiler.backend';\nimport {\n  HttpApiRemoteContractError,\n  resolveHttpApiResultPath,\n} from './http-api-row-projection.backend';\nimport {\n  HttpApiProviderAccessError,\n  type HttpApiProviderAccess,\n  type HttpApiProviderAccessResolver,\n} from './http-api-provider-access.backend';\n\n/** Default fetch over the platform global (Node ≥18); injectable for tests. */\nexport const defaultHttpApiFetch: HttpApiFetchLike = async (url, init) => {\n  const response = await fetch(url, init as RequestInit);\n  return { status: response.status, ok: response.ok, text: () => response.text() };\n};\n\nexport class HttpApiReadClient {\n  private readonly rateBudget: HttpApiRateBudget;\n\n  /**\n   * The authenticated uid for this binding's credentials, resolved once per client instance\n   * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —\n   * clients are constructed once per consumer and the credential set is instance-stable. A\n   * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation\n   * hook belongs with the runtime-proof work, measured against real session-expiry behavior).\n   */\n  private odooAuthenticatedUid?: number;\n\n  constructor(\n    private readonly binding: HttpApiResourceBinding,\n    private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n    private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n  ) {\n    this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);\n  }\n\n  public resolveAccess(executionContext: ExecutionContext<any>): HttpApiProviderAccess {\n    return this.providerAccessResolver.resolveAccess(this.binding, executionContext);\n  }\n\n  // ── OData ────────────────────────────────────────────────────────────────────\n\n  public async odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  public async odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null> {\n    try {\n      return await this.odataGet(executionContext, compiled);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  /**\n   * Follow an OData server-driven paging link (`@odata.nextLink`) — the drift-safe extraction\n   * paging the v3.1 discipline mandates. The link is the server's own absolute (or\n   * service-relative) continuation URL; nothing is compiled locally.\n   */\n  public async odataGetByUrl(executionContext: ExecutionContext<any>, url: string): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;\n    const response = await executeHttpApiTransportCall(\n      { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers } },\n      this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /**\n   * `GET /$metadata` as raw XML text — the WARN-only schema-drift probe's input (partial-resource\n   * paper, PR-21). Deliberately OUTSIDE the JSON transport: the EDMX document is XML, and the\n   * transport treats a 2xx non-JSON body as a contract failure — correct for every data read,\n   * wrong for this one diagnostic document. One plain fetch, no retry, no rate-budget draw\n   * (a diagnostic must never spend the data path's budget), and EVERY failure — non-200, network\n   * error, a server that does not serve `$metadata` at all — answers `null`: the probe's caller\n   * treats null as \"nothing to compare\", never as drift.\n   */\n  public async odataMetadataText(executionContext: ExecutionContext<any>): Promise<string | null> {\n    try {\n      const access = this.resolveAccess(executionContext);\n      const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {\n        method: 'GET',\n        headers: { Accept: 'application/xml', ...access.headers },\n      });\n      if (response.status !== 200) return null;\n      return await response.text();\n    } catch {\n      return null;\n    }\n  }\n\n  private buildODataRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: ODataCompiledRequest): HttpApiTransportRequest {\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    };\n  }\n\n  // ── REST_JSON ────────────────────────────────────────────────────────────────\n\n  public async restJson(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    if (compiled.jsonRpc) {\n      const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the target: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n      return envelope?.result;\n    }\n    return response.json;\n  }\n\n  /**\n   * Single-row REST read with the dialect's no-row semantics: a remote 404, and a `null`/`false`\n   * payload at the declared resultPath, are the target's honest \"no row\"; an ABSENT leaf is a\n   * contract breach, never a silent not-found.\n   */\n  public async restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null> {\n    try {\n      const body = await this.restJson(executionContext, compiled);\n      const payload = resolveHttpApiResultPath(body, compiled.resultPath);\n      if (payload === null || payload === false) return null;\n      if (payload === undefined) {\n        throw new HttpApiRemoteContractError(\n          `The remote read answered 200 but the declared resultPath '${compiled.resultPath ?? '(body)'}' resolves to nothing.`,\n        );\n      }\n      return payload;\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  private buildRestJsonRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: RestJsonCompiledRequest): HttpApiTransportRequest {\n    if (compiled.jsonRpc) {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 },\n      };\n    }\n    if (compiled.method === 'POST') {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: compiled.params,\n      };\n    }\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    };\n  }\n\n  // ── Odoo execute_kw ──────────────────────────────────────────────────────────\n\n  public async odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const credentials = access.jsonRpcInArgsCredentials;\n    if (!credentials) {\n      // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot\n      // authenticate at all — the header credential is unread by `/jsonrpc`.\n      throw new HttpApiProviderAccessError(\n        `Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `\n        + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.',\n      );\n    }\n\n    if (this.odooAuthenticatedUid === undefined) {\n      const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [\n        credentials.db, credentials.login, credentials.apiKey, {},\n      ]);\n      if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {\n        // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.\n        throw new HttpApiProviderAccessError(\n          `Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `\n          + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`,\n        );\n      }\n      this.odooAuthenticatedUid = uid;\n    }\n\n    return this.executeOdooRpc(access, 'object', 'execute_kw', [\n      credentials.db,\n      this.odooAuthenticatedUid,\n      credentials.apiKey,\n      this.binding.entityRef,\n      call.method,\n      call.positionalArgs,\n      call.kwargs,\n    ]);\n  }\n\n  private async executeOdooRpc(\n    access: { baseUrl: string; headers: Record<string, string> },\n    service: string,\n    method: string,\n    args: unknown[],\n  ): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      {\n        method: 'POST',\n        url: `${access.baseUrl}/jsonrpc`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 },\n      },\n      this.binding.remoteCallSemantics,\n      this.fetchImpl,\n      this.rateBudget,\n    );\n    const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string; data?: { message?: string } } };\n    if (envelope && typeof envelope === 'object' && envelope.error) {\n      throw new HttpApiTransportError(\n        `Odoo JSON-RPC error: ${envelope.error.data?.message ?? envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n        { url: '/jsonrpc', method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n      );\n    }\n    return envelope?.result;\n  }\n\n  // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──\n\n  /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */\n  public async odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void> {\n    const access = this.resolveAccess(executionContext);\n    await this.rawCallTolerating404({\n      method: 'DELETE',\n      url: `${access.baseUrl}${path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    });\n  }\n\n  /**\n   * One declared REST_JSON erasure call (stance 6b explicit spec): frames method/path/RPC\n   * envelope, tolerates 404 as already-gone, and surfaces a JSON-RPC error envelope as a\n   * transport error.\n   */\n  public async restDeclaredErasureCall(\n    executionContext: ExecutionContext<any>,\n    compiled: RestJsonCompiledErasureRequest,\n  ): Promise<void> {\n    const access = this.resolveAccess(executionContext);\n    const response = await this.rawCallTolerating404({\n      method: compiled.method,\n      url: `${access.baseUrl}${compiled.path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      jsonBody: compiled.jsonRpc\n        ? { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 }\n        : undefined,\n    });\n    if (compiled.jsonRpc && response !== undefined) {\n      const envelope = response as { error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the declared erasure operation: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: compiled.method, attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n    }\n  }\n\n  // ── Generic transport ────────────────────────────────────────────────────────\n\n  /** One transport call, body parsed; the caller frames the request. */\n  public async rawCall(request: HttpApiTransportRequest): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      request, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /** As {@link rawCall}, tolerating a remote 404 as \"already gone\" (idempotent deletes). */\n  public async rawCallTolerating404(request: HttpApiTransportRequest): Promise<unknown> {\n    try {\n      return await this.rawCall(request);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return undefined;\n      throw error;\n    }\n  }\n}\n"]}
+{"version":3,"file":"http-api-read-client.backend.js","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,uCAAuC,GAExC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,GAG3B,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAqB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,0BAA0B,CACjC,OAAmE,EACnE,gBAAuC;IAEvC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC;IAEhD,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,YAAY;QAChF,CAAC,CAAC,SAAS,EAAE,cAAc;QAC3B,CAAC,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI;YAC1D,CAAC,CAAC,SAAS,EAAE,MAAM;YACnB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,SAAS,GAAG;QAChB,UAAU;QACV,UAAU;QACV,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS;YACnG,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,MAAM,GAAG,uCAAuC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAClC,gCAAgC,OAAO,CAAC,WAAW,gBAAgB,UAAU,MAAM,UAAU,eAAe;cAC1G,oDAAoD;cACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;cAC3D,0HAA0H,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAgDT;IACA;IACA;IAjDF,UAAU,CAAoB;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACK,yBAAyB,CAA0C;IAE3E,YACmB,OAA+B,EAC/B,sBAAqD,EACrD,YAA8B,mBAAmB;QAFjD,YAAO,GAAP,OAAO,CAAwB;QAC/B,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC;QAChE,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC9C,IAAI,CAAC,OAAO,CAAC,WAAW,EACxB,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAC1D,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAA8B;QAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC5G,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,gBAAuC,EAAE,QAA8B;QACjG,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,GAAW;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,2BAA2B;QAChD,oEAAoE;QACpE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAChH,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,gBAAuC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,YAAY,EAAE;gBACnE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAA4D,EAAE,QAA8B;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAAiC;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC/G,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAyE,CAAC;YACpG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAC7G,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,EAAE,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,gBAAuC,EAAE,QAAiC;QACxG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,0BAA0B,CAClC,6DAA6D,QAAQ,CAAC,UAAU,IAAI,QAAQ,wBAAwB,CACrH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAA4D,EAAE,QAAiC;QAC1H,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpJ,uFAAuF;gBACvF,yFAAyF;gBACzF,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE;gBAC7E,oFAAoF;gBACpF,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,IAAsB;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uFAAuF;YACvF,uEAAuE;YACvE,MAAM,IAAI,0BAA0B,CAClC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,+FAA+F;kBAClI,iIAAiI,CACpI,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,uFAAuF;QACvF,6CAA6C;QAC7C,MAAM,aAAa,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvF,IAAI,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,EAAE,aAAa,KAAK,aAAa;YACpF,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG;YACpC,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE;gBACtE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,EAAE;gBACF,oFAAoF;gBACpF,+EAA+E;gBAC/E,yFAAyF;gBACzF,8DAA8D;gBAC9D,MAAM,IAAI,0BAA0B,CAClC,+CAA+C,IAAI,CAAC,OAAO,CAAC,WAAW,UAAU,WAAW,CAAC,EAAE,aAAa,WAAW,CAAC,KAAK,MAAM;sBACjI,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CACnE,CAAC;YACJ,CAAC;YACD,gBAAgB,GAAG,GAAG,CAAC;YACvB,IAAI,CAAC,yBAAyB,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzD,WAAW,CAAC,EAAE;YACd,gBAAgB;YAChB,WAAW,CAAC,MAAM;YAClB,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,iBAAiB,CAC9B,OAAe,EACf,WAA0D;QAE1D,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;aACxF,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA4D,EAC5D,OAAe,EACf,MAAc,EACd,IAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;YAC1I,gFAAgF;YAChF,kFAAkF;YAClF,0CAA0C;YAC1C,SAAS,EAAE,IAAI;SAChB,EACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAsG,CAAC;QACjI,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAC7B,wBAAwB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAClI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC;IAED,oFAAoF;IAEpF,8FAA8F;IACvF,KAAK,CAAC,iBAAiB,CAAC,gBAAuC,EAAE,IAAY;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC9B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE;YAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,2FAA2F;YAC3F,uFAAuF;YACvF,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,uBAAuB,CAClC,gBAAuC,EACvC,QAAwC;QAExC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;gBACnI,CAAC,CAAC,SAAS;YACb,wFAAwF;YACxF,6FAA6F;YAC7F,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAA2D,CAAC;YAC7E,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EACjI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAEhF,sEAAsE;IAC/D,KAAK,CAAC,OAAO,CAAC,OAAgC;QACnD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC3E,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,oBAAoB,CAAC,OAAgC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * `HttpApiReadClient` — THE one implementation of the HTTP-API dialect mechanics\n * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /\n * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +\n * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and\n * the credential-keyed cached uid), and the 404-as-null read tolerance.\n *\n * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the\n * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is\n * not a persistence adapter — but the runtime middle must be structurally un-duplicable: this\n * class is where \"same mechanism\" stops being a discipline and becomes a fact. The drift pin\n * (`http-api-read-client.single-authority.test.ts`) refuses a second `authenticate` handshake\n * anywhere in the directory.\n *\n * Everything above the wire stays with the consumer: T-set translation, projection, scope\n * checks, audit emission, erasure orchestration, mapping/loading. This class never widens or\n * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed\n * bodies.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport {\n  ExternalProvider_ConnectionTargetSchema,\n  type ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n  HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nimport {\n  HttpApiRateBudget,\n  HttpApiTransportBodyEncoding,\n  HttpApiTransportError,\n  HttpApiTransportFailureKind,\n  executeHttpApiTransportCall,\n  type HttpApiFetchLike,\n  type HttpApiTransportRequest,\n} from './http-api-transport.backend';\nimport type { ODataCompiledRequest } from './odata-query-compiler.backend';\nimport type { RestJsonCompiledErasureRequest, RestJsonCompiledRequest } from './rest-json-query-compiler.backend';\nimport type { OdooCompiledCall } from './odoo-jsonrpc-compiler.backend';\nimport {\n  HttpApiRemoteContractError,\n  resolveHttpApiResultPath,\n} from './http-api-row-projection.backend';\nimport {\n  HttpApiProviderAccessError,\n  type HttpApiProviderAccess,\n  type HttpApiProviderAccessResolver,\n} from './http-api-provider-access.backend';\n\n/** Default fetch over the platform global (Node ≥18); injectable for tests. */\nexport const defaultHttpApiFetch: HttpApiFetchLike = async (url, init) => {\n  const response = await fetch(url, init as RequestInit);\n  return { status: response.status, ok: response.ok, text: () => response.text() };\n};\n\n/**\n * The binding's declared connection SHAPE, plus the instance ids this execution supplies — ONE\n * place, deliberately.\n *\n * ## What changed, and why the refusal that used to live here is gone\n *\n * This function used to refuse every delegated binding, naming a missing subsystem: \"the engine has\n * no outbound per-user token store\". That was true when it was written and is not any more — the\n * store exists, is bound, and serves the connection controller (#333). What actually blocked the\n * lift was narrower: the binding carried a two-valued `identityMode`, and `USER_DELEGATED` cannot\n * say WHOSE ACCOUNT is spent. A user's own grant (`USER × SERVICE`) and a tenant's registration\n * acting for one of its members (`ORGANIZATION × USER`) are both \"per-user OAuth\" and resolve\n * different credentials, so mapping the one field would have silently picked a lane. The binding\n * now carries the shape itself, and this function only has to source the instances.\n *\n * ## The ids come from the EXECUTION, and that is not the resolver reading ambient context\n *\n * `ExternalProvider_ConnectionTarget`'s own contract says a target is supplied BY THE CALL and never\n * invented by the resolver, because \"the resolver cannot verify a target it also invented\". This is\n * the call side of that split: an httpApiBinding read is triggered by a resource operation, so the\n * organization and the user it runs for ARE the execution's, and naming them here is what leaves the\n * resolver free to authorize them. It refuses rather than falling back — an absent organization on a\n * tenant-owned binding must not quietly become the application's account, which is the exact\n * mis-attribution `resolveProviderSecretForConnection` exists to prevent.\n *\n * ## The rules are the SCHEMA's\n *\n * Every refusal below comes from `ExternalProvider_ConnectionTargetSchema`'s own refinements, which\n * already say — better than a re-statement here would — that an instance-owned connection names\n * which instance, that an application-owned one has no id to name, and that a delegated call must\n * name the user it acts for. Re-deriving them here would be a second copy that drifts.\n */\nfunction connectionTargetForBinding(\n  binding: Pick<HttpApiResourceBinding, 'providerRef' | 'connection'>,\n  executionContext: ExecutionContext<any>,\n): ExternalProvider_ConnectionTarget {\n  const { ownerScope, delegation } = binding.connection;\n  const initiator = executionContext.initiatorIds;\n\n  const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n    ? initiator?.organizationId\n    : ownerScope === ExternalProvider_Connection_OwnerScope.USER\n      ? initiator?.userId\n      : undefined;\n\n  const candidate = {\n    ownerScope,\n    delegation,\n    ...(ownerId === undefined ? {} : { ownerId }),\n    ...(delegation === ExternalProvider_Connection_DelegationMode.USER && initiator?.userId !== undefined\n      ? { actingForUserId: initiator.userId }\n      : {}),\n  };\n\n  const parsed = ExternalProvider_ConnectionTargetSchema.safeParse(candidate);\n  if (!parsed.success) {\n    throw new HttpApiProviderAccessError(\n      `The binding toward provider '${binding.providerRef}' declares a ${ownerScope} × ${delegation} connection, `\n      + 'and this execution cannot supply what that names: '\n      + parsed.error.issues.map((issue) => issue.message).join(' ')\n      + ' Either trigger the read from an execution that carries them, or declare a connection the application can satisfy alone.',\n    );\n  }\n  return parsed.data;\n}\n\nexport class HttpApiReadClient {\n  private readonly rateBudget: HttpApiRateBudget;\n\n  /**\n   * The authenticated uid, KEYED ON the credential it was minted under rather than merely\n   * remembered against this instance.\n   *\n   * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and\n   * is worth caching: the virtual repository builds ONE client per binding and keeps it for the\n   * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating\n   * per call would double every read's round trips.\n   *\n   * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads\n   * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation\n   * genuinely reaches this class — and a uid remembered against the instance would then be an\n   * identity minted under the retired credential, presented on every subsequent `execute_kw`.\n   *\n   * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately\n   * preferred over an `invalidate()` some rotation path has to remember to call: there is no\n   * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note\n   * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so\n   * repointing the binding at another host must not reuse it either.\n   *\n   * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held\n   * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`\n   * call and costs microseconds against a network round trip.\n   *\n   * ONE slot, not a map. A map would save a handshake when a credential the client has already\n   * seen comes back, at the cost of accumulating one secret-derived entry per retired credential\n   * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.\n   * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.\n   *\n   * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which\n   * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating\n   * tenants each miss the key and pay a handshake — slower, and never one tenant acting under\n   * another tenant's uid, which is what an instance-remembered uid would have become the moment the\n   * scope widened. The key is the credential, so the widening cost a round trip and no correctness.\n   *\n   * This replaces the slice-1 note that said a rotation needs a process restart, and with it the\n   * owed work to \"measure against real session-expiry behavior\". That measurement was owed for an\n   * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:\n   * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so\n   * there is no server-side session here whose lifetime we could be racing — the only thing that\n   * can retire the uid is the credential (or the instance) it names, which is exactly the key.\n   */\n  private odooAuthenticatedIdentity?: { credentialKey: string; uid: number };\n\n  constructor(\n    private readonly binding: HttpApiResourceBinding,\n    private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n    private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n  ) {\n    this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);\n  }\n\n  /**\n   * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.\n   *\n   * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of\n   * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land\n   * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is\n   * the whole fix.\n   */\n  public async resolveAccess(executionContext: ExecutionContext<any>): Promise<HttpApiProviderAccess> {\n    return this.providerAccessResolver.resolveAccess(\n      this.binding.providerRef,\n      connectionTargetForBinding(this.binding, executionContext),\n      executionContext,\n    );\n  }\n\n  // ── OData ────────────────────────────────────────────────────────────────────\n\n  public async odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  public async odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null> {\n    try {\n      return await this.odataGet(executionContext, compiled);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  /**\n   * Follow an OData server-driven paging link (`@odata.nextLink`) — the drift-safe extraction\n   * paging the v3.1 discipline mandates. The link is the server's own absolute (or\n   * service-relative) continuation URL; nothing is compiled locally.\n   */\n  public async odataGetByUrl(executionContext: ExecutionContext<any>, url: string): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;\n    const response = await executeHttpApiTransportCall(\n      // A paging continuation is a read: safe to re-send after a timeout.\n      { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers }, retrySafe: true },\n      this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /**\n   * `GET /$metadata` as raw XML text — the WARN-only schema-drift probe's input (partial-resource\n   * paper, PR-21). Deliberately OUTSIDE the JSON transport: the EDMX document is XML, and the\n   * transport treats a 2xx non-JSON body as a contract failure — correct for every data read,\n   * wrong for this one diagnostic document. One plain fetch, no retry, no rate-budget draw\n   * (a diagnostic must never spend the data path's budget), and EVERY failure — non-200, network\n   * error, a server that does not serve `$metadata` at all — answers `null`: the probe's caller\n   * treats null as \"nothing to compare\", never as drift.\n   */\n  public async odataMetadataText(executionContext: ExecutionContext<any>): Promise<string | null> {\n    try {\n      const access = await this.resolveAccess(executionContext);\n      const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {\n        method: 'GET',\n        headers: { Accept: 'application/xml', ...access.headers },\n      });\n      if (response.status !== 200) return null;\n      return await response.text();\n    } catch {\n      return null;\n    }\n  }\n\n  private buildODataRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: ODataCompiledRequest): HttpApiTransportRequest {\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      retrySafe: true,\n    };\n  }\n\n  // ── REST_JSON ────────────────────────────────────────────────────────────────\n\n  public async restJson(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    if (compiled.jsonRpc) {\n      const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the target: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n      return envelope?.result;\n    }\n    return response.json;\n  }\n\n  /**\n   * Single-row REST read with the dialect's no-row semantics: a remote 404, and a `null`/`false`\n   * payload at the declared resultPath, are the target's honest \"no row\"; an ABSENT leaf is a\n   * contract breach, never a silent not-found.\n   */\n  public async restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null> {\n    try {\n      const body = await this.restJson(executionContext, compiled);\n      const payload = resolveHttpApiResultPath(body, compiled.resultPath);\n      if (payload === null || payload === false) return null;\n      if (payload === undefined) {\n        throw new HttpApiRemoteContractError(\n          `The remote read answered 200 but the declared resultPath '${compiled.resultPath ?? '(body)'}' resolves to nothing.`,\n        );\n      }\n      return payload;\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  private buildRestJsonRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: RestJsonCompiledRequest): HttpApiTransportRequest {\n    if (compiled.jsonRpc) {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 } },\n        // POST-shaped, read by construction: the read compilers are the only producers of this\n        // request and they compile nothing but reads, so re-sending it cannot duplicate a write.\n        retrySafe: true,\n      };\n    }\n    if (compiled.method === 'POST') {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: compiled.params },\n        // Same argument as the JSON-RPC branch above: a POST-shaped SEARCH is still a read.\n        retrySafe: true,\n      };\n    }\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      retrySafe: true,\n    };\n  }\n\n  // ── Odoo execute_kw ──────────────────────────────────────────────────────────\n\n  public async odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const credentials = access.jsonRpcInArgsCredentials;\n    if (!credentials) {\n      // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot\n      // authenticate at all — the header credential is unread by `/jsonrpc`.\n      throw new HttpApiProviderAccessError(\n        `Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `\n        + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.',\n      );\n    }\n\n    // Resolved from THIS call's access, so a rotated credential produces a different key and the\n    // cached identity below simply does not match — no invalidation call, and therefore no\n    // rotation path that can forget to make one.\n    const credentialKey = HttpApiReadClient.odooCredentialKey(access.baseUrl, credentials);\n    let authenticatedUid = this.odooAuthenticatedIdentity?.credentialKey === credentialKey\n      ? this.odooAuthenticatedIdentity.uid\n      : undefined;\n\n    if (authenticatedUid === undefined) {\n      const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [\n        credentials.db, credentials.login, credentials.apiKey, {},\n      ]);\n      if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {\n        // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.\n        //\n        // The previously cached identity is left alone rather than dropped: it belongs to a\n        // DIFFERENT key (that is why we are here), so it can never be served for these\n        // credentials, and keeping it means a rotation that is rolled back does not pay a second\n        // handshake. Only a successful authenticate writes the field.\n        throw new HttpApiProviderAccessError(\n          `Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `\n          + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`,\n        );\n      }\n      authenticatedUid = uid;\n      this.odooAuthenticatedIdentity = { credentialKey, uid };\n    }\n\n    return this.executeOdooRpc(access, 'object', 'execute_kw', [\n      credentials.db,\n      authenticatedUid,\n      credentials.apiKey,\n      this.binding.entityRef,\n      call.method,\n      call.positionalArgs,\n      call.kwargs,\n    ]);\n  }\n\n  /**\n   * The identity a cached uid belongs to: the instance it was minted on, and the exact credential\n   * it was minted with.\n   *\n   * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,\n   * so no combination of separators inside a db name, a login or a key can make two different\n   * tuples produce one key.\n   */\n  private static odooCredentialKey(\n    baseUrl: string,\n    credentials: { db: string; login: string; apiKey: string },\n  ): string {\n    return createHash('sha256')\n      .update(JSON.stringify([baseUrl, credentials.db, credentials.login, credentials.apiKey]))\n      .digest('hex');\n  }\n\n  private async executeOdooRpc(\n    access: { baseUrl: string; headers: Record<string, string> },\n    service: string,\n    method: string,\n    args: unknown[],\n  ): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      {\n        method: 'POST',\n        url: `${access.baseUrl}/jsonrpc`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 } },\n        // Two callers, both safe to repeat: `common.authenticate` (a pure question) and\n        // `object.execute_kw` with a read method — the Odoo compiler emits `search_read`/\n        // `search_count` and nothing that writes.\n        retrySafe: true,\n      },\n      this.binding.remoteCallSemantics,\n      this.fetchImpl,\n      this.rateBudget,\n    );\n    const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string; data?: { message?: string } } };\n    if (envelope && typeof envelope === 'object' && envelope.error) {\n      throw new HttpApiTransportError(\n        `Odoo JSON-RPC error: ${envelope.error.data?.message ?? envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n        { url: '/jsonrpc', method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n      );\n    }\n    return envelope?.result;\n  }\n\n  // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──\n\n  /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */\n  public async odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void> {\n    const access = await this.resolveAccess(executionContext);\n    await this.rawCallTolerating404({\n      method: 'DELETE',\n      url: `${access.baseUrl}${path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      // Idempotent by key: the second DELETE of a gone row answers 404, which this door reads as\n      // already-gone. That is what makes a retried timeout safe here and unsafe on a create.\n      retrySafe: true,\n    });\n  }\n\n  /**\n   * One declared REST_JSON erasure call (stance 6b explicit spec): frames method/path/RPC\n   * envelope, tolerates 404 as already-gone, and surfaces a JSON-RPC error envelope as a\n   * transport error.\n   */\n  public async restDeclaredErasureCall(\n    executionContext: ExecutionContext<any>,\n    compiled: RestJsonCompiledErasureRequest,\n  ): Promise<void> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await this.rawCallTolerating404({\n      method: compiled.method,\n      url: `${access.baseUrl}${compiled.path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      body: compiled.jsonRpc\n        ? { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 } }\n        : undefined,\n      // A declared erasure addresses ONE row by key and is idempotent for the same reason the\n      // OData delete above is; the repository's own remediation for a partial failure is a re-run.\n      retrySafe: true,\n    });\n    if (compiled.jsonRpc && response !== undefined) {\n      const envelope = response as { error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the declared erasure operation: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: compiled.method, attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n    }\n  }\n\n  // ── Generic transport ────────────────────────────────────────────────────────\n\n  /** One transport call, body parsed; the caller frames the request. */\n  public async rawCall(request: HttpApiTransportRequest): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      request, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /** As {@link rawCall}, tolerating a remote 404 as \"already gone\" (idempotent deletes). */\n  public async rawCallTolerating404(request: HttpApiTransportRequest): Promise<unknown> {\n    try {\n      return await this.rawCall(request);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return undefined;\n      throw error;\n    }\n  }\n}\n"]}