@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js

@@ -3,7 +3,7 @@
  * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /
  * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +
  * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and
- * the instance-cached uid), and the 404-as-null read tolerance.
+ * the credential-keyed cached uid), and the 404-as-null read tolerance.
  *
  * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the
  * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is
@@ -17,39 +17,146 @@
  * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed
  * bodies.
  */
-import { HttpApiRateBudget, HttpApiTransportError, HttpApiTransportFailureKind, executeHttpApiTransportCall, } from './http-api-transport.backend.js';
+import { createHash } from 'node:crypto';
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, } from '@wildo-ai/external-connectors-models';
+import { ExternalProvider_ConnectionTargetSchema, } from '@wildo-ai/external-connectors-models';
+import { HttpApiRateBudget, HttpApiTransportBodyEncoding, HttpApiTransportError, HttpApiTransportFailureKind, executeHttpApiTransportCall, } from './http-api-transport.backend.js';
 import { HttpApiRemoteContractError, resolveHttpApiResultPath, } from './http-api-row-projection.backend.js';
 import { HttpApiProviderAccessError, } from './http-api-provider-access.backend.js';
 /** Default fetch over the platform global (Node ≥18); injectable for tests. */
 export const defaultHttpApiFetch = async (url, init) => {
+    // outbound-deadline: a forwarding seam. `init.signal` is the caller's, and every caller reaches
+    // here through `executeHttpApiTransportCall`, which owns the binding's `remoteCallSemantics
+    // .timeoutMs` and its retry budget. Minting a second deadline here would put two competing
+    // timers on one request and hide which one fired.
     const response = await fetch(url, init);
     return { status: response.status, ok: response.ok, text: () => response.text() };
 };
+/**
+ * The binding's declared connection SHAPE, plus the instance ids this execution supplies — ONE
+ * place, deliberately.
+ *
+ * ## What changed, and why the refusal that used to live here is gone
+ *
+ * This function used to refuse every delegated binding, naming a missing subsystem: "the engine has
+ * no outbound per-user token store". That was true when it was written and is not any more — the
+ * store exists, is bound, and serves the connection controller (#333). What actually blocked the
+ * lift was narrower: the binding carried a two-valued `identityMode`, and `USER_DELEGATED` cannot
+ * say WHOSE ACCOUNT is spent. A user's own grant (`USER × SERVICE`) and a tenant's registration
+ * acting for one of its members (`ORGANIZATION × USER`) are both "per-user OAuth" and resolve
+ * different credentials, so mapping the one field would have silently picked a lane. The binding
+ * now carries the shape itself, and this function only has to source the instances.
+ *
+ * ## The ids come from the EXECUTION, and that is not the resolver reading ambient context
+ *
+ * `ExternalProvider_ConnectionTarget`'s own contract says a target is supplied BY THE CALL and never
+ * invented by the resolver, because "the resolver cannot verify a target it also invented". This is
+ * the call side of that split: an httpApiBinding read is triggered by a resource operation, so the
+ * organization and the user it runs for ARE the execution's, and naming them here is what leaves the
+ * resolver free to authorize them. It refuses rather than falling back — an absent organization on a
+ * tenant-owned binding must not quietly become the application's account, which is the exact
+ * mis-attribution `resolveProviderSecretForConnection` exists to prevent.
+ *
+ * ## The rules are the SCHEMA's
+ *
+ * Every refusal below comes from `ExternalProvider_ConnectionTargetSchema`'s own refinements, which
+ * already say — better than a re-statement here would — that an instance-owned connection names
+ * which instance, that an application-owned one has no id to name, and that a delegated call must
+ * name the user it acts for. Re-deriving them here would be a second copy that drifts.
+ */
+function connectionTargetForBinding(binding, executionContext) {
+    const { ownerScope, delegation } = binding.connection;
+    const initiator = executionContext.initiatorIds;
+    const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION
+        ? initiator?.organizationId
+        : ownerScope === ExternalProvider_Connection_OwnerScope.USER
+            ? initiator?.userId
+            : undefined;
+    const candidate = {
+        ownerScope,
+        delegation,
+        ...(ownerId === undefined ? {} : { ownerId }),
+        ...(delegation === ExternalProvider_Connection_DelegationMode.USER && initiator?.userId !== undefined
+            ? { actingForUserId: initiator.userId }
+            : {}),
+    };
+    const parsed = ExternalProvider_ConnectionTargetSchema.safeParse(candidate);
+    if (!parsed.success) {
+        throw new HttpApiProviderAccessError(`The binding toward provider '${binding.providerRef}' declares a ${ownerScope} × ${delegation} connection, `
+            + 'and this execution cannot supply what that names: '
+            + parsed.error.issues.map((issue) => issue.message).join(' ')
+            + ' Either trigger the read from an execution that carries them, or declare a connection the application can satisfy alone.');
+    }
+    return parsed.data;
+}
 export class HttpApiReadClient {
     binding;
     providerAccessResolver;
     fetchImpl;
     rateBudget;
     /**
-     * The authenticated uid for this binding's credentials, resolved once per client instance
-     * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —
-     * clients are constructed once per consumer and the credential set is instance-stable. A
-     * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation
-     * hook belongs with the runtime-proof work, measured against real session-expiry behavior).
+     * The authenticated uid, KEYED ON the credential it was minted under rather than merely
+     * remembered against this instance.
+     *
+     * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and
+     * is worth caching: the virtual repository builds ONE client per binding and keeps it for the
+     * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating
+     * per call would double every read's round trips.
+     *
+     * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads
+     * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation
+     * genuinely reaches this class — and a uid remembered against the instance would then be an
+     * identity minted under the retired credential, presented on every subsequent `execute_kw`.
+     *
+     * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately
+     * preferred over an `invalidate()` some rotation path has to remember to call: there is no
+     * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note
+     * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so
+     * repointing the binding at another host must not reuse it either.
+     *
+     * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held
+     * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`
+     * call and costs microseconds against a network round trip.
+     *
+     * ONE slot, not a map. A map would save a handshake when a credential the client has already
+     * seen comes back, at the cost of accumulating one secret-derived entry per retired credential
+     * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.
+     * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.
+     *
+     * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which
+     * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating
+     * tenants each miss the key and pay a handshake — slower, and never one tenant acting under
+     * another tenant's uid, which is what an instance-remembered uid would have become the moment the
+     * scope widened. The key is the credential, so the widening cost a round trip and no correctness.
+     *
+     * This replaces the slice-1 note that said a rotation needs a process restart, and with it the
+     * owed work to "measure against real session-expiry behavior". That measurement was owed for an
+     * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:
+     * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so
+     * there is no server-side session here whose lifetime we could be racing — the only thing that
+     * can retire the uid is the credential (or the instance) it names, which is exactly the key.
      */
-    odooAuthenticatedUid;
+    odooAuthenticatedIdentity;
     constructor(binding, providerAccessResolver, fetchImpl = defaultHttpApiFetch) {
         this.binding = binding;
         this.providerAccessResolver = providerAccessResolver;
         this.fetchImpl = fetchImpl;
         this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);
     }
-    resolveAccess(executionContext) {
-        return this.providerAccessResolver.resolveAccess(this.binding, executionContext);
+    /**
+     * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.
+     *
+     * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of
+     * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land
+     * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is
+     * the whole fix.
+     */
+    async resolveAccess(executionContext) {
+        return this.providerAccessResolver.resolveAccess(this.binding.providerRef, connectionTargetForBinding(this.binding, executionContext), executionContext);
     }
     // ── OData ────────────────────────────────────────────────────────────────────
     async odataGet(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await executeHttpApiTransportCall(this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         return response.json;
     }
@@ -69,9 +176,11 @@ export class HttpApiReadClient {
      * service-relative) continuation URL; nothing is compiled locally.
      */
     async odataGetByUrl(executionContext, url) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;
-        const response = await executeHttpApiTransportCall({ method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers } }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
+        const response = await executeHttpApiTransportCall(
+        // A paging continuation is a read: safe to re-send after a timeout.
+        { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers }, retrySafe: true }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         return response.json;
     }
     /**
@@ -85,10 +194,23 @@ export class HttpApiReadClient {
      */
     async odataMetadataText(executionContext) {
         try {
-            const access = this.resolveAccess(executionContext);
+            const access = await this.resolveAccess(executionContext);
+            /*
+             * The binding's OWN call budget, even though this probe steps outside the transport.
+             *
+             * Stepping outside `executeHttpApiTransportCall` for the XML framing also stepped outside its
+             * deadline, and the `catch` below turns every failure into `null` — so an unresponsive remote
+             * did not surface as drift, as an error, or as anything at all. It simply held the caller.
+             * That is the quietest shape this defect takes, and the reason a second MECHANISM for the same
+             * outbound work has to re-derive the bound rather than inherit it by proximity.
+             *
+             * The budget is the same because the REMOTE is the same. What this probe legitimately declines
+             * is the retry and the rate-budget draw, not the deadline.
+             */
             const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {
                 method: 'GET',
                 headers: { Accept: 'application/xml', ...access.headers },
+                signal: AbortSignal.timeout(this.binding.remoteCallSemantics.timeoutMs),
             });
             if (response.status !== 200)
                 return null;
@@ -106,11 +228,12 @@ export class HttpApiReadClient {
             method: 'GET',
             url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,
             headers: { Accept: 'application/json', ...access.headers },
+            retrySafe: true,
         };
     }
     // ── REST_JSON ────────────────────────────────────────────────────────────────
     async restJson(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await executeHttpApiTransportCall(this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         if (compiled.jsonRpc) {
             const envelope = response.json;
@@ -149,7 +272,10 @@ export class HttpApiReadClient {
                 method: 'POST',
                 url: `${access.baseUrl}${compiled.path}`,
                 headers: { Accept: 'application/json', ...access.headers },
-                jsonBody: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 },
+                body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 } },
+                // POST-shaped, read by construction: the read compilers are the only producers of this
+                // request and they compile nothing but reads, so re-sending it cannot duplicate a write.
+                retrySafe: true,
             };
         }
         if (compiled.method === 'POST') {
@@ -157,7 +283,9 @@ export class HttpApiReadClient {
                 method: 'POST',
                 url: `${access.baseUrl}${compiled.path}`,
                 headers: { Accept: 'application/json', ...access.headers },
-                jsonBody: compiled.params,
+                body: { encoding: HttpApiTransportBodyEncoding.JSON, value: compiled.params },
+                // Same argument as the JSON-RPC branch above: a POST-shaped SEARCH is still a read.
+                retrySafe: true,
             };
         }
         const search = Object.entries(compiled.params)
@@ -167,11 +295,12 @@ export class HttpApiReadClient {
             method: 'GET',
             url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,
             headers: { Accept: 'application/json', ...access.headers },
+            retrySafe: true,
         };
     }
     // ── Odoo execute_kw ──────────────────────────────────────────────────────────
     async odooExecuteKw(executionContext, call) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const credentials = access.jsonRpcInArgsCredentials;
         if (!credentials) {
             // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot
@@ -179,20 +308,33 @@ export class HttpApiReadClient {
             throw new HttpApiProviderAccessError(`Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `
                 + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.');
         }
-        if (this.odooAuthenticatedUid === undefined) {
+        // Resolved from THIS call's access, so a rotated credential produces a different key and the
+        // cached identity below simply does not match — no invalidation call, and therefore no
+        // rotation path that can forget to make one.
+        const credentialKey = HttpApiReadClient.odooCredentialKey(access.baseUrl, credentials);
+        let authenticatedUid = this.odooAuthenticatedIdentity?.credentialKey === credentialKey
+            ? this.odooAuthenticatedIdentity.uid
+            : undefined;
+        if (authenticatedUid === undefined) {
             const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [
                 credentials.db, credentials.login, credentials.apiKey, {},
             ]);
             if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {
                 // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.
+                //
+                // The previously cached identity is left alone rather than dropped: it belongs to a
+                // DIFFERENT key (that is why we are here), so it can never be served for these
+                // credentials, and keeping it means a rotation that is rolled back does not pay a second
+                // handshake. Only a successful authenticate writes the field.
                 throw new HttpApiProviderAccessError(`Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `
                     + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`);
             }
-            this.odooAuthenticatedUid = uid;
+            authenticatedUid = uid;
+            this.odooAuthenticatedIdentity = { credentialKey, uid };
         }
         return this.executeOdooRpc(access, 'object', 'execute_kw', [
             credentials.db,
-            this.odooAuthenticatedUid,
+            authenticatedUid,
             credentials.apiKey,
             this.binding.entityRef,
             call.method,
@@ -200,12 +342,29 @@ export class HttpApiReadClient {
             call.kwargs,
         ]);
     }
+    /**
+     * The identity a cached uid belongs to: the instance it was minted on, and the exact credential
+     * it was minted with.
+     *
+     * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,
+     * so no combination of separators inside a db name, a login or a key can make two different
+     * tuples produce one key.
+     */
+    static odooCredentialKey(baseUrl, credentials) {
+        return createHash('sha256')
+            .update(JSON.stringify([baseUrl, credentials.db, credentials.login, credentials.apiKey]))
+            .digest('hex');
+    }
     async executeOdooRpc(access, service, method, args) {
         const response = await executeHttpApiTransportCall({
             method: 'POST',
             url: `${access.baseUrl}/jsonrpc`,
             headers: { Accept: 'application/json', ...access.headers },
-            jsonBody: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 },
+            body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 } },
+            // Two callers, both safe to repeat: `common.authenticate` (a pure question) and
+            // `object.execute_kw` with a read method — the Odoo compiler emits `search_read`/
+            // `search_count` and nothing that writes.
+            retrySafe: true,
         }, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget);
         const envelope = response.json;
         if (envelope && typeof envelope === 'object' && envelope.error) {
@@ -216,11 +375,14 @@ export class HttpApiReadClient {
     // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──
     /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */
     async odataDeleteByPath(executionContext, path) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         await this.rawCallTolerating404({
             method: 'DELETE',
             url: `${access.baseUrl}${path}`,
             headers: { Accept: 'application/json', ...access.headers },
+            // Idempotent by key: the second DELETE of a gone row answers 404, which this door reads as
+            // already-gone. That is what makes a retried timeout safe here and unsafe on a create.
+            retrySafe: true,
         });
     }
     /**
@@ -229,14 +391,17 @@ export class HttpApiReadClient {
      * transport error.
      */
     async restDeclaredErasureCall(executionContext, compiled) {
-        const access = this.resolveAccess(executionContext);
+        const access = await this.resolveAccess(executionContext);
         const response = await this.rawCallTolerating404({
             method: compiled.method,
             url: `${access.baseUrl}${compiled.path}`,
             headers: { Accept: 'application/json', ...access.headers },
-            jsonBody: compiled.jsonRpc
-                ? { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 }
+            body: compiled.jsonRpc
+                ? { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 } }
                 : undefined,
+            // A declared erasure addresses ONE row by key and is idempotent for the same reason the
+            // OData delete above is; the repository's own remediation for a partial failure is a re-run.
+            retrySafe: true,
         });
         if (compiled.jsonRpc && response !== undefined) {
             const envelope = response;

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-read-client.backend.js","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,GAG3B,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAqB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,OAAO,iBAAiB;IAaT;IACA;IACA;IAdF,UAAU,CAAoB;IAE/C;;;;;;OAMG;IACK,oBAAoB,CAAU;IAEtC,YACmB,OAA+B,EAC/B,sBAAqD,EACrD,YAA8B,mBAAmB;QAFjD,YAAO,GAAP,OAAO,CAAwB;QAC/B,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAEM,aAAa,CAAC,gBAAuC;QAC1D,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnF,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAA8B;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC5G,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,gBAAuC,EAAE,QAA8B;QACjG,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,GAAW;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,EAC/F,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,gBAAuC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,YAAY,EAAE;gBACnE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAA4D,EAAE,QAA8B;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAAiC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC/G,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAyE,CAAC;YACpG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAC7G,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,EAAE,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,gBAAuC,EAAE,QAAiC;QACxG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,0BAA0B,CAClC,6DAA6D,QAAQ,CAAC,UAAU,IAAI,QAAQ,wBAAwB,CACrH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAA4D,EAAE,QAAiC;QAC1H,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,MAAM;aAC1B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,IAAsB;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uFAAuF;YACvF,uEAAuE;YACvE,MAAM,IAAI,0BAA0B,CAClC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,+FAA+F;kBAClI,iIAAiI,CACpI,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE;gBACtE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,MAAM,IAAI,0BAA0B,CAClC,+CAA+C,IAAI,CAAC,OAAO,CAAC,WAAW,UAAU,WAAW,CAAC,EAAE,aAAa,WAAW,CAAC,KAAK,MAAM;sBACjI,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzD,WAAW,CAAC,EAAE;YACd,IAAI,CAAC,oBAAoB;YACzB,WAAW,CAAC,MAAM;YAClB,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA4D,EAC5D,OAAe,EACf,MAAc,EACd,IAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;SACvF,EACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAsG,CAAC;QACjI,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAC7B,wBAAwB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAClI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC;IAED,oFAAoF;IAEpF,8FAA8F;IACvF,KAAK,CAAC,iBAAiB,CAAC,gBAAuC,EAAE,IAAY;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC9B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE;YAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,uBAAuB,CAClC,gBAAuC,EACvC,QAAwC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,QAAQ,EAAE,QAAQ,CAAC,OAAO;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;gBAC3E,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAA2D,CAAC;YAC7E,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EACjI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAEhF,sEAAsE;IAC/D,KAAK,CAAC,OAAO,CAAC,OAAgC;QACnD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC3E,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,oBAAoB,CAAC,OAAgC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * `HttpApiReadClient` — THE one implementation of the HTTP-API dialect mechanics\n * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /\n * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +\n * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and\n * the instance-cached uid), and the 404-as-null read tolerance.\n *\n * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the\n * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is\n * not a persistence adapter — but the runtime middle must be structurally un-duplicable: this\n * class is where \"same mechanism\" stops being a discipline and becomes a fact. The drift pin\n * (`http-api-read-client.single-authority.test.ts`) refuses a second `authenticate` handshake\n * anywhere in the directory.\n *\n * Everything above the wire stays with the consumer: T-set translation, projection, scope\n * checks, audit emission, erasure orchestration, mapping/loading. This class never widens or\n * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed\n * bodies.\n */\n\nimport type {\n  HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nimport {\n  HttpApiRateBudget,\n  HttpApiTransportError,\n  HttpApiTransportFailureKind,\n  executeHttpApiTransportCall,\n  type HttpApiFetchLike,\n  type HttpApiTransportRequest,\n} from './http-api-transport.backend';\nimport type { ODataCompiledRequest } from './odata-query-compiler.backend';\nimport type { RestJsonCompiledErasureRequest, RestJsonCompiledRequest } from './rest-json-query-compiler.backend';\nimport type { OdooCompiledCall } from './odoo-jsonrpc-compiler.backend';\nimport {\n  HttpApiRemoteContractError,\n  resolveHttpApiResultPath,\n} from './http-api-row-projection.backend';\nimport {\n  HttpApiProviderAccessError,\n  type HttpApiProviderAccess,\n  type HttpApiProviderAccessResolver,\n} from './http-api-provider-access.backend';\n\n/** Default fetch over the platform global (Node ≥18); injectable for tests. */\nexport const defaultHttpApiFetch: HttpApiFetchLike = async (url, init) => {\n  const response = await fetch(url, init as RequestInit);\n  return { status: response.status, ok: response.ok, text: () => response.text() };\n};\n\nexport class HttpApiReadClient {\n  private readonly rateBudget: HttpApiRateBudget;\n\n  /**\n   * The authenticated uid for this binding's credentials, resolved once per client instance\n   * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —\n   * clients are constructed once per consumer and the credential set is instance-stable. A\n   * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation\n   * hook belongs with the runtime-proof work, measured against real session-expiry behavior).\n   */\n  private odooAuthenticatedUid?: number;\n\n  constructor(\n    private readonly binding: HttpApiResourceBinding,\n    private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n    private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n  ) {\n    this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);\n  }\n\n  public resolveAccess(executionContext: ExecutionContext<any>): HttpApiProviderAccess {\n    return this.providerAccessResolver.resolveAccess(this.binding, executionContext);\n  }\n\n  // ── OData ────────────────────────────────────────────────────────────────────\n\n  public async odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  public async odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null> {\n    try {\n      return await this.odataGet(executionContext, compiled);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  /**\n   * Follow an OData server-driven paging link (`@odata.nextLink`) — the drift-safe extraction\n   * paging the v3.1 discipline mandates. The link is the server's own absolute (or\n   * service-relative) continuation URL; nothing is compiled locally.\n   */\n  public async odataGetByUrl(executionContext: ExecutionContext<any>, url: string): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;\n    const response = await executeHttpApiTransportCall(\n      { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers } },\n      this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /**\n   * `GET /$metadata` as raw XML text — the WARN-only schema-drift probe's input (partial-resource\n   * paper, PR-21). Deliberately OUTSIDE the JSON transport: the EDMX document is XML, and the\n   * transport treats a 2xx non-JSON body as a contract failure — correct for every data read,\n   * wrong for this one diagnostic document. One plain fetch, no retry, no rate-budget draw\n   * (a diagnostic must never spend the data path's budget), and EVERY failure — non-200, network\n   * error, a server that does not serve `$metadata` at all — answers `null`: the probe's caller\n   * treats null as \"nothing to compare\", never as drift.\n   */\n  public async odataMetadataText(executionContext: ExecutionContext<any>): Promise<string | null> {\n    try {\n      const access = this.resolveAccess(executionContext);\n      const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {\n        method: 'GET',\n        headers: { Accept: 'application/xml', ...access.headers },\n      });\n      if (response.status !== 200) return null;\n      return await response.text();\n    } catch {\n      return null;\n    }\n  }\n\n  private buildODataRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: ODataCompiledRequest): HttpApiTransportRequest {\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    };\n  }\n\n  // ── REST_JSON ────────────────────────────────────────────────────────────────\n\n  public async restJson(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    if (compiled.jsonRpc) {\n      const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the target: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n      return envelope?.result;\n    }\n    return response.json;\n  }\n\n  /**\n   * Single-row REST read with the dialect's no-row semantics: a remote 404, and a `null`/`false`\n   * payload at the declared resultPath, are the target's honest \"no row\"; an ABSENT leaf is a\n   * contract breach, never a silent not-found.\n   */\n  public async restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null> {\n    try {\n      const body = await this.restJson(executionContext, compiled);\n      const payload = resolveHttpApiResultPath(body, compiled.resultPath);\n      if (payload === null || payload === false) return null;\n      if (payload === undefined) {\n        throw new HttpApiRemoteContractError(\n          `The remote read answered 200 but the declared resultPath '${compiled.resultPath ?? '(body)'}' resolves to nothing.`,\n        );\n      }\n      return payload;\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  private buildRestJsonRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: RestJsonCompiledRequest): HttpApiTransportRequest {\n    if (compiled.jsonRpc) {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 },\n      };\n    }\n    if (compiled.method === 'POST') {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: compiled.params,\n      };\n    }\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    };\n  }\n\n  // ── Odoo execute_kw ──────────────────────────────────────────────────────────\n\n  public async odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown> {\n    const access = this.resolveAccess(executionContext);\n    const credentials = access.jsonRpcInArgsCredentials;\n    if (!credentials) {\n      // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot\n      // authenticate at all — the header credential is unread by `/jsonrpc`.\n      throw new HttpApiProviderAccessError(\n        `Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `\n        + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.',\n      );\n    }\n\n    if (this.odooAuthenticatedUid === undefined) {\n      const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [\n        credentials.db, credentials.login, credentials.apiKey, {},\n      ]);\n      if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {\n        // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.\n        throw new HttpApiProviderAccessError(\n          `Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `\n          + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`,\n        );\n      }\n      this.odooAuthenticatedUid = uid;\n    }\n\n    return this.executeOdooRpc(access, 'object', 'execute_kw', [\n      credentials.db,\n      this.odooAuthenticatedUid,\n      credentials.apiKey,\n      this.binding.entityRef,\n      call.method,\n      call.positionalArgs,\n      call.kwargs,\n    ]);\n  }\n\n  private async executeOdooRpc(\n    access: { baseUrl: string; headers: Record<string, string> },\n    service: string,\n    method: string,\n    args: unknown[],\n  ): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      {\n        method: 'POST',\n        url: `${access.baseUrl}/jsonrpc`,\n        headers: { Accept: 'application/json', ...access.headers },\n        jsonBody: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 },\n      },\n      this.binding.remoteCallSemantics,\n      this.fetchImpl,\n      this.rateBudget,\n    );\n    const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string; data?: { message?: string } } };\n    if (envelope && typeof envelope === 'object' && envelope.error) {\n      throw new HttpApiTransportError(\n        `Odoo JSON-RPC error: ${envelope.error.data?.message ?? envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n        { url: '/jsonrpc', method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n      );\n    }\n    return envelope?.result;\n  }\n\n  // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──\n\n  /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */\n  public async odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void> {\n    const access = this.resolveAccess(executionContext);\n    await this.rawCallTolerating404({\n      method: 'DELETE',\n      url: `${access.baseUrl}${path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n    });\n  }\n\n  /**\n   * One declared REST_JSON erasure call (stance 6b explicit spec): frames method/path/RPC\n   * envelope, tolerates 404 as already-gone, and surfaces a JSON-RPC error envelope as a\n   * transport error.\n   */\n  public async restDeclaredErasureCall(\n    executionContext: ExecutionContext<any>,\n    compiled: RestJsonCompiledErasureRequest,\n  ): Promise<void> {\n    const access = this.resolveAccess(executionContext);\n    const response = await this.rawCallTolerating404({\n      method: compiled.method,\n      url: `${access.baseUrl}${compiled.path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      jsonBody: compiled.jsonRpc\n        ? { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 }\n        : undefined,\n    });\n    if (compiled.jsonRpc && response !== undefined) {\n      const envelope = response as { error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the declared erasure operation: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: compiled.method, attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n    }\n  }\n\n  // ── Generic transport ────────────────────────────────────────────────────────\n\n  /** One transport call, body parsed; the caller frames the request. */\n  public async rawCall(request: HttpApiTransportRequest): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      request, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /** As {@link rawCall}, tolerating a remote 404 as \"already gone\" (idempotent deletes). */\n  public async rawCallTolerating404(request: HttpApiTransportRequest): Promise<unknown> {\n    try {\n      return await this.rawCall(request);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return undefined;\n      throw error;\n    }\n  }\n}\n"]}
+{"version":3,"file":"http-api-read-client.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,uCAAuC,GAExC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,GAG3B,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAqB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvE,gGAAgG;IAChG,4FAA4F;IAC5F,2FAA2F;IAC3F,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,0BAA0B,CACjC,OAAmE,EACnE,gBAAuC;IAEvC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC;IAEhD,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,YAAY;QAChF,CAAC,CAAC,SAAS,EAAE,cAAc;QAC3B,CAAC,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI;YAC1D,CAAC,CAAC,SAAS,EAAE,MAAM;YACnB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,SAAS,GAAG;QAChB,UAAU;QACV,UAAU;QACV,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS;YACnG,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,MAAM,GAAG,uCAAuC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAClC,gCAAgC,OAAO,CAAC,WAAW,gBAAgB,UAAU,MAAM,UAAU,eAAe;cAC1G,oDAAoD;cACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;cAC3D,0HAA0H,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAgDT;IACA;IACA;IAjDF,UAAU,CAAoB;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACK,yBAAyB,CAA0C;IAE3E,YACmB,OAA+B,EAC/B,sBAAqD,EACrD,YAA8B,mBAAmB;QAFjD,YAAO,GAAP,OAAO,CAAwB;QAC/B,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC;QAChE,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC9C,IAAI,CAAC,OAAO,CAAC,WAAW,EACxB,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAC1D,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAA8B;QAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC5G,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,gBAAuC,EAAE,QAA8B;QACjG,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,GAAW;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,2BAA2B;QAChD,oEAAoE;QACpE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAChH,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAAC,gBAAuC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YAC1D;;;;;;;;;;;eAWG;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,YAAY,EAAE;gBACnE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAA4D,EAAE,QAA8B;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,QAAQ,CAAC,gBAAuC,EAAE,QAAiC;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC/G,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAyE,CAAC;YACpG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAC7G,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,EAAE,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,gBAAuC,EAAE,QAAiC;QACxG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,0BAA0B,CAClC,6DAA6D,QAAQ,CAAC,UAAU,IAAI,QAAQ,wBAAwB,CACrH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACvF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAA4D,EAAE,QAAiC;QAC1H,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpJ,uFAAuF;gBACvF,yFAAyF;gBACzF,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;gBAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE;gBAC7E,oFAAoF;gBACpF,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAChF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,aAAa,CAAC,gBAAuC,EAAE,IAAsB;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,uFAAuF;YACvF,uEAAuE;YACvE,MAAM,IAAI,0BAA0B,CAClC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,+FAA+F;kBAClI,iIAAiI,CACpI,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,uFAAuF;QACvF,6CAA6C;QAC7C,MAAM,aAAa,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvF,IAAI,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,EAAE,aAAa,KAAK,aAAa;YACpF,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG;YACpC,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE;gBACtE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,EAAE;gBACF,oFAAoF;gBACpF,+EAA+E;gBAC/E,yFAAyF;gBACzF,8DAA8D;gBAC9D,MAAM,IAAI,0BAA0B,CAClC,+CAA+C,IAAI,CAAC,OAAO,CAAC,WAAW,UAAU,WAAW,CAAC,EAAE,aAAa,WAAW,CAAC,KAAK,MAAM;sBACjI,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CACnE,CAAC;YACJ,CAAC;YACD,gBAAgB,GAAG,GAAG,CAAC;YACvB,IAAI,CAAC,yBAAyB,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;YACzD,WAAW,CAAC,EAAE;YACd,gBAAgB;YAChB,WAAW,CAAC,MAAM;YAClB,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,iBAAiB,CAC9B,OAAe,EACf,WAA0D;QAE1D,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;aACxF,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA4D,EAC5D,OAAe,EACf,MAAc,EACd,IAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,IAAI,EAAE,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;YAC1I,gFAAgF;YAChF,kFAAkF;YAClF,0CAA0C;YAC1C,SAAS,EAAE,IAAI;SAChB,EACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAsG,CAAC;QACjI,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAC7B,wBAAwB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EAClI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC;IAED,oFAAoF;IAEpF,8FAA8F;IACvF,KAAK,CAAC,iBAAiB,CAAC,gBAAuC,EAAE,IAAY;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC9B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE;YAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,2FAA2F;YAC3F,uFAAuF;YACvF,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,uBAAuB,CAClC,gBAAuC,EACvC,QAAwC;QAExC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC1D,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;gBACnI,CAAC,CAAC,SAAS;YACb,wFAAwF;YACxF,6FAA6F;YAC7F,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAA2D,CAAC;YAC7E,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,EACjI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,CAAC,YAAY,EAAE,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAEhF,sEAAsE;IAC/D,KAAK,CAAC,OAAO,CAAC,OAAgC;QACnD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAC3E,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,oBAAoB,CAAC,OAAgC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * `HttpApiReadClient` — THE one implementation of the HTTP-API dialect mechanics\n * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /\n * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +\n * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and\n * the credential-keyed cached uid), and the 404-as-null read tolerance.\n *\n * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the\n * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is\n * not a persistence adapter — but the runtime middle must be structurally un-duplicable: this\n * class is where \"same mechanism\" stops being a discipline and becomes a fact. The drift pin\n * (`http-api-read-client.single-authority.test.ts`) refuses a second `authenticate` handshake\n * anywhere in the directory.\n *\n * Everything above the wire stays with the consumer: T-set translation, projection, scope\n * checks, audit emission, erasure orchestration, mapping/loading. This class never widens or\n * narrows a query and never interprets a ROW — it moves compiled requests and returns parsed\n * bodies.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport {\n  ExternalProvider_ConnectionTargetSchema,\n  type ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n  HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nimport {\n  HttpApiRateBudget,\n  HttpApiTransportBodyEncoding,\n  HttpApiTransportError,\n  HttpApiTransportFailureKind,\n  executeHttpApiTransportCall,\n  type HttpApiFetchLike,\n  type HttpApiTransportRequest,\n} from './http-api-transport.backend';\nimport type { ODataCompiledRequest } from './odata-query-compiler.backend';\nimport type { RestJsonCompiledErasureRequest, RestJsonCompiledRequest } from './rest-json-query-compiler.backend';\nimport type { OdooCompiledCall } from './odoo-jsonrpc-compiler.backend';\nimport {\n  HttpApiRemoteContractError,\n  resolveHttpApiResultPath,\n} from './http-api-row-projection.backend';\nimport {\n  HttpApiProviderAccessError,\n  type HttpApiProviderAccess,\n  type HttpApiProviderAccessResolver,\n} from './http-api-provider-access.backend';\n\n/** Default fetch over the platform global (Node ≥18); injectable for tests. */\nexport const defaultHttpApiFetch: HttpApiFetchLike = async (url, init) => {\n  // outbound-deadline: a forwarding seam. `init.signal` is the caller's, and every caller reaches\n  // here through `executeHttpApiTransportCall`, which owns the binding's `remoteCallSemantics\n  // .timeoutMs` and its retry budget. Minting a second deadline here would put two competing\n  // timers on one request and hide which one fired.\n  const response = await fetch(url, init as RequestInit);\n  return { status: response.status, ok: response.ok, text: () => response.text() };\n};\n\n/**\n * The binding's declared connection SHAPE, plus the instance ids this execution supplies — ONE\n * place, deliberately.\n *\n * ## What changed, and why the refusal that used to live here is gone\n *\n * This function used to refuse every delegated binding, naming a missing subsystem: \"the engine has\n * no outbound per-user token store\". That was true when it was written and is not any more — the\n * store exists, is bound, and serves the connection controller (#333). What actually blocked the\n * lift was narrower: the binding carried a two-valued `identityMode`, and `USER_DELEGATED` cannot\n * say WHOSE ACCOUNT is spent. A user's own grant (`USER × SERVICE`) and a tenant's registration\n * acting for one of its members (`ORGANIZATION × USER`) are both \"per-user OAuth\" and resolve\n * different credentials, so mapping the one field would have silently picked a lane. The binding\n * now carries the shape itself, and this function only has to source the instances.\n *\n * ## The ids come from the EXECUTION, and that is not the resolver reading ambient context\n *\n * `ExternalProvider_ConnectionTarget`'s own contract says a target is supplied BY THE CALL and never\n * invented by the resolver, because \"the resolver cannot verify a target it also invented\". This is\n * the call side of that split: an httpApiBinding read is triggered by a resource operation, so the\n * organization and the user it runs for ARE the execution's, and naming them here is what leaves the\n * resolver free to authorize them. It refuses rather than falling back — an absent organization on a\n * tenant-owned binding must not quietly become the application's account, which is the exact\n * mis-attribution `resolveProviderSecretForConnection` exists to prevent.\n *\n * ## The rules are the SCHEMA's\n *\n * Every refusal below comes from `ExternalProvider_ConnectionTargetSchema`'s own refinements, which\n * already say — better than a re-statement here would — that an instance-owned connection names\n * which instance, that an application-owned one has no id to name, and that a delegated call must\n * name the user it acts for. Re-deriving them here would be a second copy that drifts.\n */\nfunction connectionTargetForBinding(\n  binding: Pick<HttpApiResourceBinding, 'providerRef' | 'connection'>,\n  executionContext: ExecutionContext<any>,\n): ExternalProvider_ConnectionTarget {\n  const { ownerScope, delegation } = binding.connection;\n  const initiator = executionContext.initiatorIds;\n\n  const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION\n    ? initiator?.organizationId\n    : ownerScope === ExternalProvider_Connection_OwnerScope.USER\n      ? initiator?.userId\n      : undefined;\n\n  const candidate = {\n    ownerScope,\n    delegation,\n    ...(ownerId === undefined ? {} : { ownerId }),\n    ...(delegation === ExternalProvider_Connection_DelegationMode.USER && initiator?.userId !== undefined\n      ? { actingForUserId: initiator.userId }\n      : {}),\n  };\n\n  const parsed = ExternalProvider_ConnectionTargetSchema.safeParse(candidate);\n  if (!parsed.success) {\n    throw new HttpApiProviderAccessError(\n      `The binding toward provider '${binding.providerRef}' declares a ${ownerScope} × ${delegation} connection, `\n      + 'and this execution cannot supply what that names: '\n      + parsed.error.issues.map((issue) => issue.message).join(' ')\n      + ' Either trigger the read from an execution that carries them, or declare a connection the application can satisfy alone.',\n    );\n  }\n  return parsed.data;\n}\n\nexport class HttpApiReadClient {\n  private readonly rateBudget: HttpApiRateBudget;\n\n  /**\n   * The authenticated uid, KEYED ON the credential it was minted under rather than merely\n   * remembered against this instance.\n   *\n   * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and\n   * is worth caching: the virtual repository builds ONE client per binding and keeps it for the\n   * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating\n   * per call would double every read's round trips.\n   *\n   * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads\n   * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation\n   * genuinely reaches this class — and a uid remembered against the instance would then be an\n   * identity minted under the retired credential, presented on every subsequent `execute_kw`.\n   *\n   * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately\n   * preferred over an `invalidate()` some rotation path has to remember to call: there is no\n   * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note\n   * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so\n   * repointing the binding at another host must not reuse it either.\n   *\n   * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held\n   * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`\n   * call and costs microseconds against a network round trip.\n   *\n   * ONE slot, not a map. A map would save a handshake when a credential the client has already\n   * seen comes back, at the cost of accumulating one secret-derived entry per retired credential\n   * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.\n   * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.\n   *\n   * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which\n   * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating\n   * tenants each miss the key and pay a handshake — slower, and never one tenant acting under\n   * another tenant's uid, which is what an instance-remembered uid would have become the moment the\n   * scope widened. The key is the credential, so the widening cost a round trip and no correctness.\n   *\n   * This replaces the slice-1 note that said a rotation needs a process restart, and with it the\n   * owed work to \"measure against real session-expiry behavior\". That measurement was owed for an\n   * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:\n   * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so\n   * there is no server-side session here whose lifetime we could be racing — the only thing that\n   * can retire the uid is the credential (or the instance) it names, which is exactly the key.\n   */\n  private odooAuthenticatedIdentity?: { credentialKey: string; uid: number };\n\n  constructor(\n    private readonly binding: HttpApiResourceBinding,\n    private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n    private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n  ) {\n    this.rateBudget = new HttpApiRateBudget(binding.remoteCallSemantics.maxRequestsPerMinute);\n  }\n\n  /**\n   * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.\n   *\n   * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of\n   * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land\n   * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is\n   * the whole fix.\n   */\n  public async resolveAccess(executionContext: ExecutionContext<any>): Promise<HttpApiProviderAccess> {\n    return this.providerAccessResolver.resolveAccess(\n      this.binding.providerRef,\n      connectionTargetForBinding(this.binding, executionContext),\n      executionContext,\n    );\n  }\n\n  // ── OData ────────────────────────────────────────────────────────────────────\n\n  public async odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildODataRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  public async odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null> {\n    try {\n      return await this.odataGet(executionContext, compiled);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  /**\n   * Follow an OData server-driven paging link (`@odata.nextLink`) — the drift-safe extraction\n   * paging the v3.1 discipline mandates. The link is the server's own absolute (or\n   * service-relative) continuation URL; nothing is compiled locally.\n   */\n  public async odataGetByUrl(executionContext: ExecutionContext<any>, url: string): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const absoluteUrl = url.startsWith('http') ? url : `${access.baseUrl}${url.startsWith('/') ? '' : '/'}${url}`;\n    const response = await executeHttpApiTransportCall(\n      // A paging continuation is a read: safe to re-send after a timeout.\n      { method: 'GET', url: absoluteUrl, headers: { Accept: 'application/json', ...access.headers }, retrySafe: true },\n      this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /**\n   * `GET /$metadata` as raw XML text — the WARN-only schema-drift probe's input (partial-resource\n   * paper, PR-21). Deliberately OUTSIDE the JSON transport: the EDMX document is XML, and the\n   * transport treats a 2xx non-JSON body as a contract failure — correct for every data read,\n   * wrong for this one diagnostic document. One plain fetch, no retry, no rate-budget draw\n   * (a diagnostic must never spend the data path's budget), and EVERY failure — non-200, network\n   * error, a server that does not serve `$metadata` at all — answers `null`: the probe's caller\n   * treats null as \"nothing to compare\", never as drift.\n   */\n  public async odataMetadataText(executionContext: ExecutionContext<any>): Promise<string | null> {\n    try {\n      const access = await this.resolveAccess(executionContext);\n      /*\n       * The binding's OWN call budget, even though this probe steps outside the transport.\n       *\n       * Stepping outside `executeHttpApiTransportCall` for the XML framing also stepped outside its\n       * deadline, and the `catch` below turns every failure into `null` — so an unresponsive remote\n       * did not surface as drift, as an error, or as anything at all. It simply held the caller.\n       * That is the quietest shape this defect takes, and the reason a second MECHANISM for the same\n       * outbound work has to re-derive the bound rather than inherit it by proximity.\n       *\n       * The budget is the same because the REMOTE is the same. What this probe legitimately declines\n       * is the retry and the rate-budget draw, not the deadline.\n       */\n      const response = await this.fetchImpl(`${access.baseUrl}/$metadata`, {\n        method: 'GET',\n        headers: { Accept: 'application/xml', ...access.headers },\n        signal: AbortSignal.timeout(this.binding.remoteCallSemantics.timeoutMs),\n      });\n      if (response.status !== 200) return null;\n      return await response.text();\n    } catch {\n      return null;\n    }\n  }\n\n  private buildODataRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: ODataCompiledRequest): HttpApiTransportRequest {\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      retrySafe: true,\n    };\n  }\n\n  // ── REST_JSON ────────────────────────────────────────────────────────────────\n\n  public async restJson(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await executeHttpApiTransportCall(\n      this.buildRestJsonRequest(access, compiled), this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    if (compiled.jsonRpc) {\n      const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the target: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n      return envelope?.result;\n    }\n    return response.json;\n  }\n\n  /**\n   * Single-row REST read with the dialect's no-row semantics: a remote 404, and a `null`/`false`\n   * payload at the declared resultPath, are the target's honest \"no row\"; an ABSENT leaf is a\n   * contract breach, never a silent not-found.\n   */\n  public async restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null> {\n    try {\n      const body = await this.restJson(executionContext, compiled);\n      const payload = resolveHttpApiResultPath(body, compiled.resultPath);\n      if (payload === null || payload === false) return null;\n      if (payload === undefined) {\n        throw new HttpApiRemoteContractError(\n          `The remote read answered 200 but the declared resultPath '${compiled.resultPath ?? '(body)'}' resolves to nothing.`,\n        );\n      }\n      return payload;\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return null;\n      throw error;\n    }\n  }\n\n  private buildRestJsonRequest(access: { baseUrl: string; headers: Record<string, string> }, compiled: RestJsonCompiledRequest): HttpApiTransportRequest {\n    if (compiled.jsonRpc) {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: compiled.params, id: 1 } },\n        // POST-shaped, read by construction: the read compilers are the only producers of this\n        // request and they compile nothing but reads, so re-sending it cannot duplicate a write.\n        retrySafe: true,\n      };\n    }\n    if (compiled.method === 'POST') {\n      return {\n        method: 'POST',\n        url: `${access.baseUrl}${compiled.path}`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: compiled.params },\n        // Same argument as the JSON-RPC branch above: a POST-shaped SEARCH is still a read.\n        retrySafe: true,\n      };\n    }\n    const search = Object.entries(compiled.params)\n      .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`)\n      .join('&');\n    return {\n      method: 'GET',\n      url: `${access.baseUrl}${compiled.path}${search.length > 0 ? `?${search}` : ''}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      retrySafe: true,\n    };\n  }\n\n  // ── Odoo execute_kw ──────────────────────────────────────────────────────────\n\n  public async odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown> {\n    const access = await this.resolveAccess(executionContext);\n    const credentials = access.jsonRpcInArgsCredentials;\n    if (!credentials) {\n      // An ODOO_JSONRPC binding on a provider whose contract declares no in-args auth cannot\n      // authenticate at all — the header credential is unread by `/jsonrpc`.\n      throw new HttpApiProviderAccessError(\n        `Provider '${this.binding.providerRef}' declares no jsonRpcInArgsAuth on its rest contract, but this binding speaks ODOO_JSONRPC — `\n        + 'the target authenticates INSIDE the RPC args; declare jsonRpcInArgsAuth (dbEnvVarName, loginEnvVarName) on the provider module.',\n      );\n    }\n\n    // Resolved from THIS call's access, so a rotated credential produces a different key and the\n    // cached identity below simply does not match — no invalidation call, and therefore no\n    // rotation path that can forget to make one.\n    const credentialKey = HttpApiReadClient.odooCredentialKey(access.baseUrl, credentials);\n    let authenticatedUid = this.odooAuthenticatedIdentity?.credentialKey === credentialKey\n      ? this.odooAuthenticatedIdentity.uid\n      : undefined;\n\n    if (authenticatedUid === undefined) {\n      const uid = await this.executeOdooRpc(access, 'common', 'authenticate', [\n        credentials.db, credentials.login, credentials.apiKey, {},\n      ]);\n      if (typeof uid !== 'number' || !Number.isInteger(uid) || uid <= 0) {\n        // Odoo answers `false` for rejected credentials — a terminal answer, spelled loudly.\n        //\n        // The previously cached identity is left alone rather than dropped: it belongs to a\n        // DIFFERENT key (that is why we are here), so it can never be served for these\n        // credentials, and keeping it means a rotation that is rolled back does not pay a second\n        // handshake. Only a successful authenticate writes the field.\n        throw new HttpApiProviderAccessError(\n          `Odoo rejected the credentials for provider '${this.binding.providerRef}' (db '${credentials.db}', login '${credentials.login}'): `\n          + `authenticate answered ${JSON.stringify(uid)} instead of a uid.`,\n        );\n      }\n      authenticatedUid = uid;\n      this.odooAuthenticatedIdentity = { credentialKey, uid };\n    }\n\n    return this.executeOdooRpc(access, 'object', 'execute_kw', [\n      credentials.db,\n      authenticatedUid,\n      credentials.apiKey,\n      this.binding.entityRef,\n      call.method,\n      call.positionalArgs,\n      call.kwargs,\n    ]);\n  }\n\n  /**\n   * The identity a cached uid belongs to: the instance it was minted on, and the exact credential\n   * it was minted with.\n   *\n   * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,\n   * so no combination of separators inside a db name, a login or a key can make two different\n   * tuples produce one key.\n   */\n  private static odooCredentialKey(\n    baseUrl: string,\n    credentials: { db: string; login: string; apiKey: string },\n  ): string {\n    return createHash('sha256')\n      .update(JSON.stringify([baseUrl, credentials.db, credentials.login, credentials.apiKey]))\n      .digest('hex');\n  }\n\n  private async executeOdooRpc(\n    access: { baseUrl: string; headers: Record<string, string> },\n    service: string,\n    method: string,\n    args: unknown[],\n  ): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      {\n        method: 'POST',\n        url: `${access.baseUrl}/jsonrpc`,\n        headers: { Accept: 'application/json', ...access.headers },\n        body: { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: 'call', params: { service, method, args }, id: 1 } },\n        // Two callers, both safe to repeat: `common.authenticate` (a pure question) and\n        // `object.execute_kw` with a read method — the Odoo compiler emits `search_read`/\n        // `search_count` and nothing that writes.\n        retrySafe: true,\n      },\n      this.binding.remoteCallSemantics,\n      this.fetchImpl,\n      this.rateBudget,\n    );\n    const envelope = response.json as { result?: unknown; error?: { code?: number; message?: string; data?: { message?: string } } };\n    if (envelope && typeof envelope === 'object' && envelope.error) {\n      throw new HttpApiTransportError(\n        `Odoo JSON-RPC error: ${envelope.error.data?.message ?? envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n        { url: '/jsonrpc', method: 'POST', attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n      );\n    }\n    return envelope?.result;\n  }\n\n  // ── Erasure-family calls (stance 6b — the door ORCHESTRATES, the client frames) ──\n\n  /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */\n  public async odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void> {\n    const access = await this.resolveAccess(executionContext);\n    await this.rawCallTolerating404({\n      method: 'DELETE',\n      url: `${access.baseUrl}${path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      // Idempotent by key: the second DELETE of a gone row answers 404, which this door reads as\n      // already-gone. That is what makes a retried timeout safe here and unsafe on a create.\n      retrySafe: true,\n    });\n  }\n\n  /**\n   * One declared REST_JSON erasure call (stance 6b explicit spec): frames method/path/RPC\n   * envelope, tolerates 404 as already-gone, and surfaces a JSON-RPC error envelope as a\n   * transport error.\n   */\n  public async restDeclaredErasureCall(\n    executionContext: ExecutionContext<any>,\n    compiled: RestJsonCompiledErasureRequest,\n  ): Promise<void> {\n    const access = await this.resolveAccess(executionContext);\n    const response = await this.rawCallTolerating404({\n      method: compiled.method,\n      url: `${access.baseUrl}${compiled.path}`,\n      headers: { Accept: 'application/json', ...access.headers },\n      body: compiled.jsonRpc\n        ? { encoding: HttpApiTransportBodyEncoding.JSON, value: { jsonrpc: '2.0', method: compiled.jsonRpc.rpcMethod, params: {}, id: 1 } }\n        : undefined,\n      // A declared erasure addresses ONE row by key and is idempotent for the same reason the\n      // OData delete above is; the repository's own remediation for a partial failure is a re-run.\n      retrySafe: true,\n    });\n    if (compiled.jsonRpc && response !== undefined) {\n      const envelope = response as { error?: { code?: number; message?: string } };\n      if (envelope && typeof envelope === 'object' && envelope.error) {\n        throw new HttpApiTransportError(\n          `JSON-RPC error from the declared erasure operation: ${envelope.error.message ?? 'unknown'} (code ${envelope.error.code ?? '?'})`,\n          { url: compiled.path, method: compiled.method, attempts: 1, kind: HttpApiTransportFailureKind.REMOTE_ERROR },\n        );\n      }\n    }\n  }\n\n  // ── Generic transport ────────────────────────────────────────────────────────\n\n  /** One transport call, body parsed; the caller frames the request. */\n  public async rawCall(request: HttpApiTransportRequest): Promise<unknown> {\n    const response = await executeHttpApiTransportCall(\n      request, this.binding.remoteCallSemantics, this.fetchImpl, this.rateBudget,\n    );\n    return response.json;\n  }\n\n  /** As {@link rawCall}, tolerating a remote 404 as \"already gone\" (idempotent deletes). */\n  public async rawCallTolerating404(request: HttpApiTransportRequest): Promise<unknown> {\n    try {\n      return await this.rawCall(request);\n    } catch (error) {\n      if (error instanceof HttpApiTransportError && error.detail.status === 404) return undefined;\n      throw error;\n    }\n  }\n}\n"]}

package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts

@@ -21,6 +21,7 @@ import type { ErrorBuilderBackendService } from '../../../../errors/services/err
 import type { ResourcesRegistryBackendService } from '../../../../resources/services/resources-registry.backend.service';
 import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas';
 import type { RepositoryOptions } from '../../../../base-classes/models/repositories.backend.schemas';
+import { type AuditObservationLossMetricsResolver } from '../../../../monitoring/observability/audit-observation-emission.backend';
 import { type HttpApiFetchLike } from './http-api-transport.backend';
 import { type HttpApiProviderAccessResolver } from './http-api-provider-access.backend';
 type ListCallOptions = RepositoryOptions & {
@@ -55,12 +56,26 @@ export declare class HttpApiResourceRepositoryBackendService {
     private readonly providerAccessResolver;
     private readonly fetchImpl;
     private readonly auditLogsResolver?;
+    /**
+     * The loss counter behind {@link recordReadThroughAccess}, resolved the same way and for the
+     * same reason as the audit seam beside it: this class is built with `new`, holds no container,
+     * and must construct in a unit harness that binds neither. A thunk rather than the recorder
+     * itself so nothing is resolved on the happy path — see the seam's own type.
+     */
+    private readonly metricsResolver?;
     private readonly resourceConfiguration;
     private readonly binding;
     private readonly operationsMap;
     private readonly readClient;
     private readonly logDebug;
-    constructor(resourceType: ResourceType, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourceRegistry: ResourcesRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike, auditLogsResolver?: HttpApiAuditLogsResolver);
+    constructor(resourceType: ResourceType, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourceRegistry: ResourcesRegistryBackendService, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike, auditLogsResolver?: HttpApiAuditLogsResolver, 
+    /**
+     * The loss counter behind {@link recordReadThroughAccess}, resolved the same way and for the
+     * same reason as the audit seam beside it: this class is built with `new`, holds no container,
+     * and must construct in a unit harness that binds neither. A thunk rather than the recorder
+     * itself so nothing is resolved on the happy path — see the seam's own type.
+     */
+    metricsResolver?: AuditObservationLossMetricsResolver);
     doByPath<T = any, U = any>(operationRepositoryPath: Parameters<typeof ResourcesConfig_OperationPathUtils.createOperationRepositoryPathKey>[0], executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: RepositoryOptions): Promise<T>;
     doByKey<T = any, U = any>(operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: RepositoryOptions): Promise<T>;
     doByExecutionContext<T = any>(executionContext: ExecutionContext<any>, data?: any, options?: RepositoryOptions): Promise<T>;
@@ -90,6 +105,19 @@ export declare class HttpApiResourceRepositoryBackendService {
     private _doCount;
     private _doSearch;
     private translate;
+    /**
+     * The ONE place a REST_JSON read member becomes a compilable spec — and, since S3a (#331), the
+     * one place a CATALOGUE REFERENCE is resolved into one.
+     *
+     * Async because a reference loads the provider's catalogue, which is lazy by contract. All four
+     * call sites were already inside async methods, so this cost nothing at the boundary; what it
+     * buys is that a reference is resolved at the same chokepoint an inline spec is read, so no
+     * compiler and no caller ever learns which form the binding used.
+     *
+     * Resolved per call rather than cached here: the resolver memoizes the CATALOGUE (which is the
+     * expensive part), and caching the projected spec as well would put a second copy of provider
+     * state in every repository instance for no measurable gain.
+     */
     private restOperationSpec;
     private executeKeyAddressedRead;
     private executeCollectionRead;
@@ -102,6 +130,14 @@ export declare class HttpApiResourceRepositoryBackendService {
      * never fail the read it observes. Emitted ONLY after a remote round-trip actually happened —
      * match-nothing short-circuits touch no external system and record nothing.
      *
+     * Every emission goes through {@link emitAuditObservation}, so a lost one lands on
+     * `audit_observation_dropped_total` instead of nowhere. The feature detection therefore decides an
+     * ARGUMENT rather than an early return: handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE`, the loss shape that reaches no `_createAuditLog` and used to leave nothing
+     * behind at all. An early return would restore that silence — and the silence is expensive here,
+     * because ATTRIBUTION is the whole point of the row: without it the third party's own logs show
+     * one shared service principal and nothing anywhere resolves it back to a person.
+     *
      * Emission lives at the ADAPTER, deliberately inverting the services-tier precedent
      * (`recordPlatformDirectoryAccess`'s "the repository exists once per adapter" argument):
      * HTTP_API has exactly ONE adapter, and it is the only tier that witnesses EVERY remote access
@@ -122,9 +158,16 @@ export declare class HttpApiResourceRepositoryBackendService {
      *
      * ## Identity-less by design
      *
-     * The internal context below is inert on this path, verified per consumer: translation runs
-     * `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY tenant — the FK
-     * equality is the confinement), and `resolveAccess` ignores the context for SERVICE_PRINCIPAL.
+     * The internal context below is inert on this path for translation, verified per consumer:
+     * translation runs `excludeContextualFilter` (an erasure must reach the subject's rows in EVERY
+     * tenant — the FK equality is the confinement).
+     *
+     * It is NOT inert for access. This said `resolveAccess` "ignores the context for
+     * SERVICE_PRINCIPAL", and since #333 the context is what NAMES the owner whose account a
+     * tenant-owned or user-owned binding spends. An erasure sweep runs on an internal context, so a
+     * binding that declares anything but an application-owned connection refuses here rather than
+     * erasing under the wrong account — which is the fail-closed direction, and is why the refusal is
+     * worth meeting as an explicit error rather than a silent fallback.
      * Attribution lives in the `HTTP_API_EXTERNAL_ERASURE` audit row the calling effect emits;
      * discovery reads here deliberately do NOT emit read-through events (the read exists only to
      * address the deletion the event already records — double-recording would be noise with no