boondmanager-mcp-server 2.15.2 → 2.17.0

package/dist/services/format/list.d.ts

@@ -0,0 +1,3 @@
+import type { JsonApiResource, JsonApiResponse } from "../../types.js";
+export declare function formatListResponse(response: JsonApiResponse, entityType: string, fields?: string[], summaryFn?: (entity: JsonApiResource) => string): string;
+//# sourceMappingURL=list.d.ts.map

package/dist/services/format/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/services/format/list.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGvE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,SAAS,GAAE,CAAC,MAAM,EAAE,eAAe,KAAK,MAA4B,GACnE,MAAM,CAwCR"}

package/dist/services/format/list.js

@@ -0,0 +1,44 @@
+/**
+ * Text rendering of a search page: one summary line per row, a `Total:`
+ * header when the API reports one, and truncation on line boundaries under
+ * `CHARACTER_LIMIT` (a mid-line cut used to hide the row count).
+ */
+import { CHARACTER_LIMIT } from "../../constants.js";
+import { formatEntitySummary, formatProjectedSummary } from "./summary.js";
+export function formatListResponse(response, entityType, fields, summaryFn = formatEntitySummary) {
+    // `data: null` is what BoondManager answers on some empty windows
+    // (`/times-reports` on a month with no report, #243); it used to become
+    // `[null]` and crash the per-row summary.
+    const data = Array.isArray(response.data) ? response.data : response.data ? [response.data] : [];
+    const total = response.meta?.totals?.rows;
+    if (data.length === 0) {
+        return `Aucun(e) ${entityType} trouvé(e).`;
+    }
+    const projected = fields !== undefined && fields.length > 0;
+    const lines = data.map((item) => (projected ? formatProjectedSummary(item, fields) : summaryFn(item)));
+    const header = total !== undefined ? `Total: ${total} ${entityType}(s)\n\n` : "";
+    const body = lines.join("\n");
+    if (header.length + body.length <= CHARACTER_LIMIT)
+        return header + body;
+    // Cut on line boundaries and say how many rows were dropped. A mid-line cut
+    // produced a half-row indistinguishable from a complete one, and the count
+    // is what tells the model to narrow the query (or use `fields`/`pageSize`)
+    // instead of trusting an implicitly complete page.
+    const notice = (shown) => `\n\n[Résultats tronqués : ${shown}/${lines.length} ligne(s) affichée(s) (limite de ${CHARACTER_LIMIT} caractères). ` +
+        `Affinez les filtres, réduisez pageSize, ou utilisez 'fields' pour raccourcir chaque ligne.]`;
+    const budget = CHARACTER_LIMIT - header.length - notice(lines.length).length;
+    const kept = [];
+    let used = 0;
+    for (const line of lines) {
+        const cost = kept.length === 0 ? line.length : line.length + 1;
+        if (used + cost > budget)
+            break;
+        used += cost;
+        kept.push(line);
+    }
+    // A single row longer than the whole budget still has to show something.
+    if (kept.length === 0)
+        return header + body.substring(0, Math.max(budget, 0)) + notice(0);
+    return header + kept.join("\n") + notice(kept.length);
+}
+//# sourceMappingURL=list.js.map

package/dist/services/format/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/services/format/list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3E,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,UAAkB,EAClB,MAAiB,EACjB,YAAiD,mBAAmB;IAEpE,kEAAkE;IAClE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;IAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,UAAU,aAAa,CAAC;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,UAAU,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,MAAM,GAAG,IAAI,CAAC;IAEzE,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,6BAA6B,KAAK,IAAI,KAAK,CAAC,MAAM,oCAAoC,eAAe,gBAAgB;QACrH,6FAA6F,CAAC;IAChG,MAAM,MAAM,GAAG,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAE7E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM;YAAE,MAAM;QAChC,IAAI,IAAI,IAAI,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC"}

package/dist/services/format/summary.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Single rendering rule for a raw JSON:API attribute value, shared by the
+ * fallback summary and the `fields` projection — some Boond amounts come back
+ * as `{ amount, currency }` objects, and the two paths used to disagree
+ * (`[object Object]` on one side, JSON on the other).
+ */
+export declare function renderAttributeValue(value: unknown): string;
+export declare function formatEntitySummary(entity: unknown): string;
+/**
+ * One result line restricted to the caller-selected attribute names.
+ * Unknown names are skipped silently (the schemas document this), so a typo
+ * degrades to a shorter line rather than an error. Non-primitive values are
+ * JSON-serialised — some Boond attributes are nested objects.
+ */
+export declare function formatProjectedSummary(entity: unknown, fields: string[]): string;
+//# sourceMappingURL=summary.d.ts.map

package/dist/services/format/summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.d.ts","sourceRoot":"","sources":["../../../src/services/format/summary.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE3D;AAyDD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAqD3D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAchF"}

package/dist/services/format/summary.js

@@ -0,0 +1,172 @@
+/**
+ * One-line summaries of a JSON:API row for list output: the standard summary
+ * (`formatEntitySummary`, with its business-identifier fallback) and the
+ * `fields` projection. The named-row output is pinned byte-for-byte in tests.
+ */
+import { textExcerpt } from "./html.js";
+/**
+ * Business identifiers used as a last resort when a list row has no
+ * human-readable identity (no name, no title, no dictionary `value`).
+ *
+ * Transactional endpoints (`/invoices`, `/orders`, `/actions`,
+ * `/deliveries-groupments`, `/projects`…) key their rows on a reference, a
+ * number or a date rather than on a name, so the standard summary rendered
+ * them as a bare `[order #1234] | Statut: 1` — a line the model cannot act on
+ * without a follow-up `_get` per row.
+ *
+ * These are deliberately NOT appended unconditionally: `/resources` and
+ * `/opportunities` also carry `reference` and amount attributes, and their
+ * rows already read well (name, title). Enriching them too would only inflate
+ * every line. See `hasIdentity` in formatEntitySummary.
+ */
+const AMOUNT_FALLBACK_FIELDS = [
+    ["turnoverInvoicedExcludingTax", "CA facturé HT"],
+    ["turnoverOrderedExcludingTax", "CA commandé HT"],
+    ["turnoverSimulatedExcludingTax", "CA simulé HT"],
+    ["averageDailyPriceExcludingTax", "TJM HT"],
+];
+/** Max amount entries appended to a fallback line, to keep it scannable. */
+const MAX_FALLBACK_AMOUNTS = 2;
+/**
+ * Single rendering rule for a raw JSON:API attribute value, shared by the
+ * fallback summary and the `fields` projection — some Boond amounts come back
+ * as `{ amount, currency }` objects, and the two paths used to disagree
+ * (`[object Object]` on one side, JSON on the other).
+ */
+export function renderAttributeValue(value) {
+    return value === null || typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+/**
+ * A row is considered to name itself through `value` only when that value is a
+ * non-empty string once rendered. `value: null` / `value: ""` used to both
+ * print a bogus token *and* suppress the business-identifier fallback.
+ */
+function hasValueIdentity(value) {
+    return value !== undefined && value !== null && renderAttributeValue(value) !== "";
+}
+/**
+ * Secondary identifiers for rows that have no name/title/value. Order is
+ * chosen so the most identifying token comes first (number, then reference,
+ * then when it happened, then how much).
+ */
+function fallbackIdentityParts(attrs) {
+    const parts = [];
+    if (attrs.number)
+        parts.push(`N°: ${attrs.number}`);
+    if (attrs.reference)
+        parts.push(`Réf: ${attrs.reference}`);
+    if (attrs.date) {
+        parts.push(`Date: ${attrs.date}`);
+    }
+    else if (attrs.startDate && attrs.endDate) {
+        parts.push(`Du ${attrs.startDate} au ${attrs.endDate}`);
+    }
+    else if (attrs.startDate) {
+        parts.push(`Début: ${attrs.startDate}`);
+    }
+    else if (attrs.endDate) {
+        parts.push(`Fin: ${attrs.endDate}`);
+    }
+    let amounts = 0;
+    for (const [field, label] of AMOUNT_FALLBACK_FIELDS) {
+        if (amounts >= MAX_FALLBACK_AMOUNTS)
+            break;
+        const value = attrs[field];
+        // 0 is meaningful here (an order with no turnover yet), so only
+        // undefined/null are skipped.
+        if (value === undefined || value === null)
+            continue;
+        parts.push(`${label}: ${renderAttributeValue(value)}`);
+        amounts++;
+    }
+    // `typeOf` is an integer resolved through boond://dictionary/typeOf/* — on
+    // its own it is weak, but on an action it is often the only discriminator.
+    if (attrs.typeOf !== undefined && attrs.typeOf !== null)
+        parts.push(`Type: ${attrs.typeOf}`);
+    // End-user-authored free text: labelled and quoted so the model reads it as
+    // a data field of the row and not as server-authored instructions.
+    if (typeof attrs.text === "string") {
+        const excerpt = textExcerpt(attrs.text);
+        if (excerpt !== undefined)
+            parts.push(`Note: "${excerpt}"`);
+    }
+    return parts;
+}
+export function formatEntitySummary(entity) {
+    // A few BoondManager endpoints (e.g. `/calendars`, `/application/dictionary`)
+    // return reference items as flat objects without a JSON:API `attributes`
+    // wrapper. Treating the whole entity as the attribute bag in that case
+    // keeps `formatListResponse` from crashing on `attrs.firstName` and yields
+    // a still-useful summary.
+    const e = (entity ?? {});
+    const hasAttrs = e.attributes !== undefined && e.attributes !== null && typeof e.attributes === "object";
+    const attrs = hasAttrs ? e.attributes : e;
+    const id = e.id !== undefined ? String(e.id) : undefined;
+    const type = e.type !== undefined ? String(e.type) : undefined;
+    const header = id !== undefined && type !== undefined
+        ? `[${type} #${id}]`
+        : id !== undefined
+            ? `[#${id}]`
+            : type !== undefined
+                ? `[${type}]`
+                : "[item]";
+    const parts = [header];
+    // Common name fields
+    if (attrs.firstName || attrs.lastName) {
+        parts.push(`${attrs.firstName || ""} ${attrs.lastName || ""}`.trim());
+    }
+    if (attrs.name)
+        parts.push(String(attrs.name));
+    // `value` covers the `/calendars` and dictionary-style payloads. `0` is a
+    // legitimate label there, so only null/undefined/"" are skipped.
+    if (!attrs.firstName && !attrs.lastName && !attrs.name && hasValueIdentity(attrs.value)) {
+        parts.push(renderAttributeValue(attrs.value));
+    }
+    if (attrs.email1)
+        parts.push(`Email: ${attrs.email1}`);
+    if (attrs.phone1)
+        parts.push(`Tel: ${attrs.phone1}`);
+    if (attrs.city)
+        parts.push(`Ville: ${attrs.city}`);
+    if (attrs.state !== undefined)
+        parts.push(`Statut: ${attrs.state}`);
+    if (attrs.title)
+        parts.push(`Titre: ${attrs.title}`);
+    if (attrs.iso !== undefined && String(attrs.iso) !== id)
+        parts.push(`ISO: ${attrs.iso}`);
+    // Rows that named themselves are already useful — leave them untouched.
+    // Only the ones reduced to `[type #id]` (+ maybe a status integer) get the
+    // business identifiers appended.
+    const hasIdentity = Boolean(attrs.firstName) ||
+        Boolean(attrs.lastName) ||
+        Boolean(attrs.name) ||
+        Boolean(attrs.title) ||
+        hasValueIdentity(attrs.value);
+    if (!hasIdentity) {
+        parts.push(...fallbackIdentityParts(attrs));
+    }
+    return parts.join(" | ");
+}
+/**
+ * One result line restricted to the caller-selected attribute names.
+ * Unknown names are skipped silently (the schemas document this), so a typo
+ * degrades to a shorter line rather than an error. Non-primitive values are
+ * JSON-serialised — some Boond attributes are nested objects.
+ */
+export function formatProjectedSummary(entity, fields) {
+    const e = (entity ?? {});
+    const attrs = (e.attributes ?? e);
+    // Reference endpoints return flat rows keyed on something else than `id`
+    // (`/calendars` keys countries on `iso`), so a missing id renders as the same
+    // `[item]` token the standard summary uses — not as a `[#?]` that reads like
+    // a formatting bug.
+    const parts = [e.id !== undefined ? `[#${String(e.id)}]` : "[item]"];
+    for (const field of fields) {
+        const value = attrs[field];
+        if (value === undefined)
+            continue;
+        parts.push(`${field}: ${renderAttributeValue(value)}`);
+    }
+    return parts.join(" | ");
+}
+//# sourceMappingURL=summary.js.map

package/dist/services/format/summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.js","sourceRoot":"","sources":["../../../src/services/format/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,sBAAsB,GAA6C;IACvE,CAAC,8BAA8B,EAAE,eAAe,CAAC;IACjD,CAAC,6BAA6B,EAAE,gBAAgB,CAAC;IACjD,CAAC,+BAA+B,EAAE,cAAc,CAAC;IACjD,CAAC,+BAA+B,EAAE,QAAQ,CAAC;CAC5C,CAAC;AAEF,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,oBAAoB;YAAE,MAAM;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,gEAAgE;QAChE,8BAA8B;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7F,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;IACzG,MAAM,KAAK,GAA4B,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,UAAsC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,MAAM,MAAM,GACV,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE,GAAG;QACpB,CAAC,CAAC,EAAE,KAAK,SAAS;YAChB,CAAC,CAAC,KAAK,EAAE,GAAG;YACZ,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,IAAI,IAAI,GAAG;gBACb,CAAC,CAAC,QAAQ,CAAC;IACnB,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;IAEjC,qBAAqB;IACrB,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzF,wEAAwE;IACxE,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,WAAW,GACf,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACpB,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe,EAAE,MAAgB;IACtE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAA4B,CAAC;IAC7D,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,KAAK,GAAa,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/services/format/tab.d.ts

@@ -0,0 +1,9 @@
+import type { JsonApiResponse } from "../../types.js";
+/**
+ * Formate la réponse d'un endpoint d'onglet (ex: /resources/{id}/positionings).
+ * Contrairement à formatDetailResponse, un tableau est restitué en entier :
+ * certains onglets renvoient plusieurs entités (positionnements, contacts...)
+ * et n'afficher que la première masquait les autres.
+ */
+export declare function formatTabResponse(response: JsonApiResponse): string;
+//# sourceMappingURL=tab.d.ts.map

package/dist/services/format/tab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tab.d.ts","sourceRoot":"","sources":["../../../src/services/format/tab.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CA0BnE"}

package/dist/services/format/tab.js

@@ -0,0 +1,32 @@
+/**
+ * Rendering of an entity-tab endpoint (`/resources/{id}/positionings`…).
+ */
+import { CHARACTER_LIMIT } from "../../constants.js";
+import { formatDetailResponse, projectEntity } from "./detail.js";
+/**
+ * Formate la réponse d'un endpoint d'onglet (ex: /resources/{id}/positionings).
+ * Contrairement à formatDetailResponse, un tableau est restitué en entier :
+ * certains onglets renvoient plusieurs entités (positionnements, contacts...)
+ * et n'afficher que la première masquait les autres.
+ */
+export function formatTabResponse(response) {
+    if (!Array.isArray(response.data)) {
+        return formatDetailResponse(response);
+    }
+    const entities = response.data.map(projectEntity);
+    // Some tabs carry aggregates in `meta.totals` beyond the row count —
+    // `/orders/{id}/invoices` publishes the ordered / invoiced / remaining
+    // turnover there (issue #258). They are the point of reading that tab, so
+    // they are rendered ahead of the rows instead of being dropped.
+    const totals = response.meta?.totals;
+    const aggregates = totals && typeof totals === "object" ? Object.entries(totals).filter(([key]) => key !== "rows") : [];
+    const header = aggregates.length > 0
+        ? `${entities.length} élément(s) — totaux : ${JSON.stringify(Object.fromEntries(aggregates))}`
+        : `${entities.length} élément(s)`;
+    let result = `${header}\n\n` + JSON.stringify(entities, null, 2);
+    if (result.length > CHARACTER_LIMIT) {
+        result = result.substring(0, CHARACTER_LIMIT) + "\n\n[Résultat tronqué...]";
+    }
+    return result;
+}
+//# sourceMappingURL=tab.js.map

package/dist/services/format/tab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tab.js","sourceRoot":"","sources":["../../../src/services/format/tab.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAElE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAElD,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACrC,MAAM,UAAU,GACd,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE;QAC9F,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,aAAa,CAAC;IAEtC,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,2BAA2B,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/http/auth.d.ts

@@ -0,0 +1,44 @@
+import type { BoondAuthProvider, BoondConfig } from "../../types.js";
+/**
+ * Auth provider for the HTTP transport: reads the Bearer token from the
+ * per-request AsyncLocalStorage populated by the transport layer and
+ * forwards it verbatim to BoondManager as `Authorization: Bearer …`.
+ *
+ * Errors out clearly if called outside a request context — which would
+ * indicate that the transport layer forgot to wrap the request in
+ * `oauthContext.run(...)`.
+ */
+export declare const oauthContextAuth: BoondAuthProvider;
+/**
+ * Build the BoondManager HS256 JWT. By default the payload is exactly
+ * `{ userToken, clientToken }` (BoondManager's documented scheme). When
+ * `expiresInSeconds` is provided, standard `iat`/`exp` claims are added so the
+ * generated token is no longer replayable forever if it leaks — this requires
+ * regenerating the token per request (see `jwtAuth`). Opt-in because not every
+ * BoondManager deployment is known to honour `exp`.
+ */
+export declare function buildJwt(userToken: string, clientToken: string, clientKey: string, options?: {
+    expiresInSeconds?: number;
+    nowSeconds?: number;
+}): string;
+export declare const JWT_HEADER_NAME = "X-Jwt-Client-Boondmanager";
+export declare function initClient(): void;
+/**
+ * True when env-based credentials (JWT components, API token, or BasicAuth) are
+ * configured. Used by the HTTP transport in static-auth mode
+ * (`BOOND_HTTP_STATIC_AUTH=true`) to fail fast with a readable message before
+ * `initClient()` throws; the default HTTP mode is an OAuth2 protected resource
+ * and never reads these variables.
+ */
+export declare function hasEnvCredentials(): boolean;
+/**
+ * Install a custom auth provider — used by the HTTP transport bootstrap to
+ * wire in an OAuth2 token source (where the access token is refreshed
+ * transparently per request rather than baked in at startup).
+ */
+export declare function initClientWithAuth(auth: BoondAuthProvider, baseUrl?: string): void;
+/** Test helper — reset the cached config so the next call re-initialises. */
+export declare function resetClientForTests(): void;
+/** The active configuration, initialising from the environment on first use. */
+export declare function getConfig(): BoondConfig;
+//# sourceMappingURL=auth.d.ts.map

package/dist/services/http/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/services/http/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAKrE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAU9B,CAAC;AAOF;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,MAAM,CAWR;AAED,eAAO,MAAM,eAAe,8BAA8B,CAAC;AAgC3D,wBAAgB,UAAU,IAAI,IAAI,CAsCjC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAM3C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAKlF;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,gFAAgF;AAChF,wBAAgB,SAAS,IAAI,WAAW,CAKvC"}

package/dist/services/http/auth.js

@@ -0,0 +1,146 @@
+/**
+ * Client configuration and the three auth providers (JWT built from
+ * components, static header, OAuth Bearer read from the request context).
+ *
+ * Split out of `boond-client.ts` (issue #239): everything here decides *who*
+ * the request is sent as; nothing here sends anything.
+ */
+import { createHmac } from "crypto";
+import { readString, readUrl } from "../../config/env.js";
+import { DEFAULT_BASE_URL } from "../../constants.js";
+import { oauthContext } from "../oauth.js";
+let config = null;
+/**
+ * Auth provider for the HTTP transport: reads the Bearer token from the
+ * per-request AsyncLocalStorage populated by the transport layer and
+ * forwards it verbatim to BoondManager as `Authorization: Bearer …`.
+ *
+ * Errors out clearly if called outside a request context — which would
+ * indicate that the transport layer forgot to wrap the request in
+ * `oauthContext.run(...)`.
+ */
+export const oauthContextAuth = () => {
+    const ctx = oauthContext.getStore();
+    if (!ctx) {
+        return Promise.reject(new Error("No OAuth access token in request context. The HTTP transport requires an `Authorization: Bearer <boond_access_token>` header on every request."));
+    }
+    return Promise.resolve({ name: "Authorization", value: `Bearer ${ctx.accessToken}` });
+};
+function base64url(data) {
+    const b64 = Buffer.from(data).toString("base64");
+    return b64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+/**
+ * Build the BoondManager HS256 JWT. By default the payload is exactly
+ * `{ userToken, clientToken }` (BoondManager's documented scheme). When
+ * `expiresInSeconds` is provided, standard `iat`/`exp` claims are added so the
+ * generated token is no longer replayable forever if it leaks — this requires
+ * regenerating the token per request (see `jwtAuth`). Opt-in because not every
+ * BoondManager deployment is known to honour `exp`.
+ */
+export function buildJwt(userToken, clientToken, clientKey, options) {
+    const header = base64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const claims = { userToken, clientToken };
+    if (options?.expiresInSeconds && options.expiresInSeconds > 0) {
+        const now = options.nowSeconds ?? Math.floor(Date.now() / 1000);
+        claims.iat = now;
+        claims.exp = now + options.expiresInSeconds;
+    }
+    const payload = base64url(JSON.stringify(claims));
+    const signature = base64url(createHmac("sha256", clientKey).update(`${header}.${payload}`).digest());
+    return `${header}.${payload}.${signature}`;
+}
+export const JWT_HEADER_NAME = "X-Jwt-Client-Boondmanager";
+/**
+ * Wrap a static header pair in the dynamic AuthProvider contract.
+ * Used by the stdio transport, which sticks to the JWT / BasicAuth paths.
+ */
+function staticAuth(name, value) {
+    const cached = Promise.resolve({ name, value });
+    return () => cached;
+}
+/**
+ * JWT auth provider. When `ttlSeconds` is set (via BOOND_JWT_TTL_SECONDS), a
+ * fresh token with `iat`/`exp` is minted per request so a leaked token expires;
+ * otherwise the token is built once and cached (legacy, never-expiring).
+ */
+function jwtAuth(userToken, clientToken, clientKey, ttlSeconds) {
+    if (!ttlSeconds || ttlSeconds <= 0) {
+        return staticAuth(JWT_HEADER_NAME, buildJwt(userToken, clientToken, clientKey));
+    }
+    return () => Promise.resolve({
+        name: JWT_HEADER_NAME,
+        value: buildJwt(userToken, clientToken, clientKey, { expiresInSeconds: ttlSeconds }),
+    });
+}
+export function initClient() {
+    const baseUrl = readUrl("BOOND_BASE_URL") ?? DEFAULT_BASE_URL;
+    // Auth priority (stdio transport):
+    // 1. Build JWT from components (userToken + clientToken + clientKey)
+    // 2. Pre-built JWT token
+    // 3. BasicAuth (user:password)
+    //
+    // Per BoondManager's JWT spec the token must travel in the
+    // `X-Jwt-Client-Boondmanager` header — sending it as `Authorization: Bearer`
+    // makes the API reject the request with 422 "Signature verification failed".
+    // BasicAuth, on the other hand, uses the standard `Authorization` header.
+    //
+    // HTTP transport uses OAuth2 exclusively — see `initClientWithAuth`.
+    const userToken = readString("BOOND_USER_TOKEN");
+    const clientToken = readString("BOOND_CLIENT_TOKEN");
+    const clientKey = readString("BOOND_CLIENT_KEY");
+    const token = readString("BOOND_API_TOKEN");
+    const user = readString("BOOND_USER");
+    const password = readString("BOOND_PASSWORD");
+    let auth;
+    if (userToken && clientToken && clientKey) {
+        const ttlRaw = readString("BOOND_JWT_TTL_SECONDS");
+        const ttlSeconds = ttlRaw ? Number(ttlRaw) : undefined;
+        auth = jwtAuth(userToken, clientToken, clientKey, Number.isFinite(ttlSeconds) ? ttlSeconds : undefined);
+    }
+    else if (token) {
+        auth = staticAuth(JWT_HEADER_NAME, token);
+    }
+    else if (user && password) {
+        auth = staticAuth("Authorization", `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`);
+    }
+    else {
+        throw new Error("Authentication required. Set BOOND_USER_TOKEN + BOOND_CLIENT_TOKEN + BOOND_CLIENT_KEY, or BOOND_API_TOKEN, or both BOOND_USER and BOOND_PASSWORD.");
+    }
+    config = { baseUrl, auth };
+}
+/**
+ * True when env-based credentials (JWT components, API token, or BasicAuth) are
+ * configured. Used by the HTTP transport in static-auth mode
+ * (`BOOND_HTTP_STATIC_AUTH=true`) to fail fast with a readable message before
+ * `initClient()` throws; the default HTTP mode is an OAuth2 protected resource
+ * and never reads these variables.
+ */
+export function hasEnvCredentials() {
+    return !!((readString("BOOND_USER_TOKEN") && readString("BOOND_CLIENT_TOKEN") && readString("BOOND_CLIENT_KEY")) ||
+        readString("BOOND_API_TOKEN") ||
+        (readString("BOOND_USER") && readString("BOOND_PASSWORD")));
+}
+/**
+ * Install a custom auth provider — used by the HTTP transport bootstrap to
+ * wire in an OAuth2 token source (where the access token is refreshed
+ * transparently per request rather than baked in at startup).
+ */
+export function initClientWithAuth(auth, baseUrl) {
+    config = {
+        baseUrl: baseUrl ?? readUrl("BOOND_BASE_URL") ?? DEFAULT_BASE_URL,
+        auth,
+    };
+}
+/** Test helper — reset the cached config so the next call re-initialises. */
+export function resetClientForTests() {
+    config = null;
+}
+/** The active configuration, initialising from the environment on first use. */
+export function getConfig() {
+    if (!config) {
+        initClient();
+    }
+    return config;
+}
+//# sourceMappingURL=auth.js.map

package/dist/services/http/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/http/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,IAAI,MAAM,GAAuB,IAAI,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB,GAAG,EAAE;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,gJAAgJ,CACjJ,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,IAAqB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAiB,EACjB,WAAmB,EACnB,SAAiB,EACjB,OAA4D;IAE5D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACnE,IAAI,OAAO,EAAE,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAE3D;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CACd,SAAiB,EACjB,WAAmB,EACnB,SAAiB,EACjB,UAA8B;IAE9B,IAAI,CAAC,UAAU,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,EAAE,CACV,OAAO,CAAC,OAAO,CAAC;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;KACrF,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC;IAE9D,mCAAmC;IACnC,qEAAqE;IACrE,yBAAyB;IACzB,+BAA+B;IAC/B,EAAE;IACF,2DAA2D;IAC3D,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,MAAM,SAAS,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAE9C,IAAI,IAAuB,CAAC;IAE5B,IAAI,SAAS,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1G,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,IAAI,GAAG,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;SAAM,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,UAAU,CAAC,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,CAAC,CACP,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACtG,UAAU,CAAC,iBAAiB,CAAC;QAC7B,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,OAAgB;IAC1E,MAAM,GAAG;QACP,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,gBAAgB;QACjE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,MAAO,CAAC;AACjB,CAAC"}

package/dist/services/http/download.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Binary downloads (`/documents/{id}`): streaming read under a byte cap
+ * (issue #235), byte-level progress, and the two guards a document download
+ * needs that a JSON request does not — the application-shell detection and
+ * the `Content-Disposition` filename.
+ */
+import type { ProgressReporter } from "../progress.js";
+/**
+ * Parse the filename out of a `Content-Disposition` header. Handles the
+ * common `filename="…"`/`filename=…` forms and the RFC 5987
+ * `filename*=UTF-8''…` form. Returns undefined when absent. Exported for
+ * unit testing.
+ */
+export declare function parseContentDispositionFilename(header: string | null): string | undefined;
+/**
+ * BoondManager writes the plain `filename="…"` form with UTF-8 bytes (often
+ * NFD: `e` + combining acute), and `fetch` decodes header bytes as Latin-1 as
+ * the spec says — so "Frédéric" arrives as "FreÌdeÌric" (observed live on
+ * 2026-09-26, issue #311). Re-decode those bytes as UTF-8 when that yields a
+ * clean string, and normalise to NFC so the name compares like a normal one.
+ */
+export declare function repairUtf8Filename(name: string): string;
+export interface DownloadedDocument {
+    data: Buffer;
+    contentType: string;
+    filename?: string;
+}
+/**
+ * Thrown by `apiDownload` when the payload exceeds `maxBytes` — before the
+ * body is read when the response announces its size, otherwise the moment the
+ * running total crosses the cap (the stream is cancelled, nothing more is
+ * buffered). `bytes` is the announced size in the first case and a lower
+ * bound (bytes received so far) in the second; `announced` tells which.
+ */
+export declare class DownloadTooLargeError extends Error {
+    readonly bytes: number;
+    readonly maxBytes: number;
+    readonly announced: boolean;
+    constructor(path: string, bytes: number, maxBytes: number, announced: boolean);
+}
+/** Options for `apiDownload`. */
+export interface DownloadOptions {
+    /** Refuse payloads larger than this many bytes (see `DownloadTooLargeError`). */
+    maxBytes?: number;
+}
+/**
+ * Download a binary payload (documents, justificatifs…) from the BoondManager
+ * API. Same pipeline as `apiRequest` (`send()`: auth, path guard, rate limit,
+ * timeout, retry policy for a GET), but the body is streamed raw instead of
+ * being parsed as JSON:API.
+ *
+ * `onProgress` reports bytes received when the client asked for progress and
+ * the response carries a `Content-Length`; otherwise nothing is emitted.
+ *
+ * `options.maxBytes` bounds memory: a `Content-Length` above it is refused
+ * before a single body byte is read, and a body without one is cancelled the
+ * moment it crosses the cap (`DownloadTooLargeError` either way).
+ */
+export declare function apiDownload(path: string, onProgress?: ProgressReporter, options?: DownloadOptions): Promise<DownloadedDocument>;
+//# sourceMappingURL=download.d.ts.map

package/dist/services/http/download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/services/http/download.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAazF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAUD;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAChB,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;CAS9E;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,gBAAgB,EAC7B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAoC7B"}