@burdenoff/fluidgrids-fe-sdk 2026.1111.15 → 2026.1111.17

package/dist/client-C9XSzSXr.js

@@ -0,0 +1,1147 @@
+"use client";
+import { t as __exportAll } from "./rolldown-runtime-hDbaFkMy.js";
+import { ApolloClient, ApolloLink, InMemoryCache, Observable, createHttpLink, split } from "@apollo/client/core";
+import { setContext } from "@apollo/client/link/context";
+import { getMainDefinition } from "@apollo/client/utilities";
+import { GraphQLWsLink } from "@apollo/client/link/subscriptions";
+import { createClient } from "graphql-ws";
+import { create } from "zustand";
+import { CombinedGraphQLErrors, ServerError } from "@apollo/client/errors";
+
+// src/modules/executions/store/executionsStore.ts
+const DEFAULT_EXECUTIONS_FILTER = {
+	status: "all",
+	workflowKey: "",
+	dateRange: {
+		start: null,
+		end: null,
+		preset: "all"
+	},
+	search: "",
+	triggerType: "all",
+	durationMinSeconds: null,
+	durationMaxSeconds: null,
+	errorType: "all",
+	nodeId: "",
+	failedNodeType: "",
+	tagId: "",
+	workflowId: ""
+};
+const defaultPagination = {
+	page: 1,
+	pageSize: 25,
+	total: 0
+};
+const useExecutionsStore = create((set) => ({
+	viewMode: "table",
+	selectedExecution: null,
+	expandedRows: /* @__PURE__ */ new Set(),
+	selection: {
+		runIds: [],
+		allSelected: false
+	},
+	filter: DEFAULT_EXECUTIONS_FILTER,
+	pagination: defaultPagination,
+	isFilterPanelOpen: false,
+	isDetailsPanelOpen: false,
+	autoRefresh: true,
+	autoRefreshInterval: 5e3,
+	liveRunIds: /* @__PURE__ */ new Set(),
+	setViewMode: (mode) => set({ viewMode: mode }),
+	setSelectedExecution: (execution) => set({
+		selectedExecution: execution,
+		isDetailsPanelOpen: execution !== null
+	}),
+	toggleRowExpanded: (runId) => set((state) => {
+		const newExpanded = new Set(state.expandedRows);
+		if (newExpanded.has(runId)) newExpanded.delete(runId);
+		else newExpanded.add(runId);
+		return { expandedRows: newExpanded };
+	}),
+	setSelection: (selection) => set({ selection }),
+	toggleSelectRun: (runId) => set((state) => {
+		return { selection: {
+			runIds: state.selection.runIds.includes(runId) ? state.selection.runIds.filter((id) => id !== runId) : [...state.selection.runIds, runId],
+			allSelected: false
+		} };
+	}),
+	selectAll: (runIds) => set((state) => ({ selection: {
+		runIds: state.selection.allSelected ? [] : runIds,
+		allSelected: !state.selection.allSelected
+	} })),
+	clearSelection: () => set({ selection: {
+		runIds: [],
+		allSelected: false
+	} }),
+	updateFilter: (filterUpdate) => set((state) => ({
+		filter: {
+			...state.filter,
+			...filterUpdate
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setStatusFilter: (status) => set((state) => ({
+		filter: {
+			...state.filter,
+			status
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setWorkflowFilter: (workflowKey) => set((state) => ({
+		filter: {
+			...state.filter,
+			workflowKey
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setDateRange: (dateRange) => set((state) => ({
+		filter: {
+			...state.filter,
+			dateRange
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setSearchQuery: (search) => set((state) => ({
+		filter: {
+			...state.filter,
+			search
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setTriggerTypeFilter: (triggerType) => set((state) => ({
+		filter: {
+			...state.filter,
+			triggerType
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setDurationFilter: (durationMinSeconds, durationMaxSeconds) => set((state) => ({
+		filter: {
+			...state.filter,
+			durationMinSeconds,
+			durationMaxSeconds
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setErrorTypeFilter: (errorType) => set((state) => ({
+		filter: {
+			...state.filter,
+			errorType
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setNodeFilter: (nodeId) => set((state) => ({
+		filter: {
+			...state.filter,
+			nodeId
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setFailedNodeTypeFilter: (failedNodeType) => set((state) => ({
+		filter: {
+			...state.filter,
+			failedNodeType
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setTagFilter: (tagId) => set((state) => ({
+		filter: {
+			...state.filter,
+			tagId
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	setWorkflowIdFilter: (workflowId) => set((state) => ({
+		filter: {
+			...state.filter,
+			workflowId
+		},
+		pagination: {
+			...state.pagination,
+			page: 1
+		}
+	})),
+	resetFilters: () => set({
+		filter: DEFAULT_EXECUTIONS_FILTER,
+		pagination: { ...defaultPagination }
+	}),
+	setPage: (page) => set((state) => ({ pagination: {
+		...state.pagination,
+		page
+	} })),
+	setPageSize: (pageSize) => set((state) => ({ pagination: {
+		...state.pagination,
+		pageSize,
+		page: 1
+	} })),
+	setTotal: (total) => set((state) => ({ pagination: {
+		...state.pagination,
+		total
+	} })),
+	toggleFilterPanel: () => set((state) => ({ isFilterPanelOpen: !state.isFilterPanelOpen })),
+	toggleDetailsPanel: () => set((state) => ({ isDetailsPanelOpen: !state.isDetailsPanelOpen })),
+	setAutoRefresh: (enabled) => set({ autoRefresh: enabled }),
+	setAutoRefreshInterval: (interval) => set({ autoRefreshInterval: interval }),
+	addLiveRun: (runId) => set((state) => {
+		const newLiveRunIds = new Set(state.liveRunIds);
+		newLiveRunIds.add(runId);
+		return { liveRunIds: newLiveRunIds };
+	}),
+	removeLiveRun: (runId) => set((state) => {
+		const newLiveRunIds = new Set(state.liveRunIds);
+		newLiveRunIds.delete(runId);
+		return { liveRunIds: newLiveRunIds };
+	}),
+	clearLiveRuns: () => set({ liveRunIds: /* @__PURE__ */ new Set() })
+}));
+
+// src/theme/fluidgridsTheme.ts
+const color = (...cssVariables) => ({
+	kind: "color",
+	cssVariables
+});
+const length = (...cssVariables) => ({
+	kind: "length",
+	cssVariables
+});
+const font = (...cssVariables) => ({
+	kind: "font",
+	cssVariables
+});
+/**
+* Theme token → the fe-libs semantic CSS variables it sets. This table is the
+* public contract: a token keeps its variables across minor releases.
+*/
+const FLUIDGRIDS_THEME_TOKEN_MAP = {
+	"colors.bgCanvas": color("--color-bg-canvas"),
+	"colors.bgSurface": color("--color-bg-surface"),
+	"colors.bgElevated": color("--color-bg-elevated"),
+	"colors.bgSunken": color("--color-bg-sunken"),
+	"colors.textPrimary": color("--color-text-primary"),
+	"colors.textSecondary": color("--color-text-secondary"),
+	"colors.textMuted": color("--color-text-muted"),
+	"colors.borderDefault": color("--color-border-default"),
+	"colors.borderSubtle": color("--color-border-subtle"),
+	"colors.borderStrong": color("--color-border-strong"),
+	"colors.primary": color("--color-action-primary-bg", "--color-action-primary-border"),
+	"colors.primaryHover": color("--color-action-primary-bgHover"),
+	"colors.primaryActive": color("--color-action-primary-bgActive"),
+	"colors.primaryText": color("--color-action-primary-text"),
+	"colors.success": color("--color-status-success-bg"),
+	"colors.warning": color("--color-status-warning-bg"),
+	"colors.error": color("--color-status-error-bg"),
+	"colors.info": color("--color-status-info-bg"),
+	"radius.base": length("--radius"),
+	"radius.card": length("--radius-card"),
+	"radius.button": length("--radius-button"),
+	"radius.input": length("--radius-input"),
+	"font.body": font("--font-family-body", "--font-sans"),
+	"font.heading": font("--font-family-heading"),
+	"font.mono": font("--font-family-mono", "--font-mono")
+};
+const MAX_VALUE_LENGTH = 200;
+const FORBIDDEN_VALUE = /[;{}<>\\!@"`]|\/\*|\*\/|url\s*\(|expression\s*\(|image\s*\(|image-set\s*\(|javascript:|@import/i;
+const HEX_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i;
+const NAMED_COLOR = /^[a-z]{3,30}$/i;
+const COLOR_FUNCTION = /^(?:rgb|rgba|hsl|hsla|hwb|lab|lch|oklab|oklch|color|color-mix)\([a-z0-9#%.,/\s()+-]*\)$/i;
+const CSS_VAR = /^var\(--[a-z0-9-]+\)$/i;
+const LENGTH = /^(?:0|\d*\.?\d+(?:px|rem|em|%|vh|vw|vmin|vmax|ch|ex|pt))$/i;
+const CALC = /^calc\([a-z0-9%.\s()*/+-]*\)$/i;
+const FONT_FAMILY_ITEM = /^(?:[a-z0-9][a-z0-9 _-]*|'[a-z0-9 _-]+')$/i;
+function balancedParentheses(value) {
+	let depth = 0;
+	for (const char of value) {
+		if (char === "(") depth += 1;
+		if (char === ")") depth -= 1;
+		if (depth < 0) return false;
+	}
+	return depth === 0;
+}
+/**
+* Validate one token value. Returns the trimmed value, or null when it is not
+* a plain CSS value of the expected kind.
+*/
+function sanitizeThemeValue(kind, value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.length > MAX_VALUE_LENGTH) return null;
+	if (FORBIDDEN_VALUE.test(trimmed) || !balancedParentheses(trimmed)) return null;
+	if (CSS_VAR.test(trimmed)) return trimmed;
+	switch (kind) {
+		case "color": return HEX_COLOR.test(trimmed) || NAMED_COLOR.test(trimmed) || COLOR_FUNCTION.test(trimmed) ? trimmed : null;
+		case "length": return LENGTH.test(trimmed) || CALC.test(trimmed) ? trimmed : null;
+		case "font": {
+			const items = trimmed.split(",").map((item) => item.trim());
+			return items.every((item) => FONT_FAMILY_ITEM.test(item)) ? items.join(", ") : null;
+		}
+	}
+}
+function warnDropped(key, value) {
+	console.warn(`[FluidGrids SDK] theme token "${key}" ignored: ${JSON.stringify(value)} is not a plain CSS value.`);
+}
+/** Relative luminance of a hex colour, or null for any other notation. */
+function hexLuminance(value) {
+	if (!HEX_COLOR.test(value)) return null;
+	let hex = value.slice(1);
+	if (hex.length <= 4) hex = hex.split("").map((digit) => digit + digit).join("");
+	const [red = 0, green = 0, blue = 0] = [
+		0,
+		2,
+		4
+	].map((offset) => {
+		const channel = parseInt(hex.slice(offset, offset + 2), 16) / 255;
+		return channel <= .03928 ? channel / 12.92 : Math.pow((channel + .055) / 1.055, 2.4);
+	});
+	return .2126 * red + .7152 * green + .0722 * blue;
+}
+/**
+* The resolved mode of a theme: the shortcut itself, `theme.mode`, or
+* undefined when the theme leaves the mode to the host.
+*/
+function themeMode(theme) {
+	if (theme === "light" || theme === "dark") return theme;
+	if (theme && typeof theme === "object") return theme.mode === "light" || theme.mode === "dark" ? theme.mode : void 0;
+}
+function groupEntries(theme, group) {
+	const values = theme[group];
+	if (!values || typeof values !== "object") return [];
+	return Object.entries(values);
+}
+function isTokenKey(key) {
+	return Object.prototype.hasOwnProperty.call(FLUIDGRIDS_THEME_TOKEN_MAP, key);
+}
+/**
+* Turn a theme into the CSS custom properties it sets. Pure: no DOM access.
+*
+* Values that are not plain CSS values of the token's kind (anything with
+* `;`, `{`, `}`, `url(`, `expression(`, quotes other than single-quoted font
+* names, …) are dropped with a console warning. Unknown keys are dropped the
+* same way. When `colors.primary` is set, the hover / pressed shades and the
+* text colour are derived from it unless they are set explicitly; the text
+* colour is picked for contrast when `primary` is a hex colour.
+*/
+function themeToCssVariables(theme) {
+	const variables = {};
+	if (!theme || typeof theme !== "object") return variables;
+	const colors = {};
+	for (const group of [
+		"colors",
+		"radius",
+		"font"
+	]) for (const [name, raw] of groupEntries(theme, group)) {
+		if (raw === void 0) continue;
+		const key = `${group}.${name}`;
+		if (!isTokenKey(key)) {
+			warnDropped(key, raw);
+			continue;
+		}
+		const mapping = FLUIDGRIDS_THEME_TOKEN_MAP[key];
+		const value = sanitizeThemeValue(mapping.kind, raw);
+		if (value === null) {
+			warnDropped(key, raw);
+			continue;
+		}
+		if (group === "colors") colors[name] = value;
+		for (const cssVariable of mapping.cssVariables) variables[cssVariable] = value;
+	}
+	const primary = colors.primary;
+	if (primary) {
+		if (!colors.primaryHover) variables["--color-action-primary-bgHover"] = `color-mix(in oklab, ${primary} 84%, var(--palette-black))`;
+		if (!colors.primaryActive) variables["--color-action-primary-bgActive"] = `color-mix(in oklab, ${primary} 70%, var(--palette-black))`;
+		if (!colors.primaryText) {
+			const luminance = hexLuminance(primary);
+			if (luminance !== null) variables["--color-action-primary-text"] = luminance > .4 ? "var(--palette-black)" : "var(--palette-white)";
+		}
+	}
+	return variables;
+}
+const stack = [];
+let nextId = 1;
+let observer = null;
+const hostVariables = /* @__PURE__ */ new Map();
+const appliedVariables = /* @__PURE__ */ new Map();
+let hostMode = null;
+function readHostMode(root) {
+	return {
+		dataTheme: root.getAttribute("data-theme"),
+		dark: root.classList.contains("dark")
+	};
+}
+function writeMode(root, mode) {
+	if (mode.dataTheme === null) root.removeAttribute("data-theme");
+	else if (root.getAttribute("data-theme") !== mode.dataTheme) root.setAttribute("data-theme", mode.dataTheme);
+	if (root.classList.contains("dark") !== mode.dark) root.classList.toggle("dark", mode.dark);
+}
+function modeDrifted(root, mode) {
+	return root.getAttribute("data-theme") !== mode || root.classList.contains("dark") !== (mode === "dark");
+}
+function restoreVariable(root, name) {
+	const previous = hostVariables.get(name) ?? "";
+	if (previous) root.style.setProperty(name, previous);
+	else root.style.removeProperty(name);
+	hostVariables.delete(name);
+	appliedVariables.delete(name);
+}
+function forceVariable(root, name, value) {
+	root.style.setProperty(name, value);
+	appliedVariables.set(name, root.style.getPropertyValue(name));
+}
+/** Re-force the winning theme where something else changed it. */
+function reconcileDrift() {
+	const top = stack.at(-1);
+	if (!top || typeof document === "undefined") return;
+	const root = document.documentElement;
+	for (const [name, value] of Object.entries(top.variables)) {
+		const current = root.style.getPropertyValue(name);
+		if (current !== appliedVariables.get(name)) {
+			hostVariables.set(name, current);
+			forceVariable(root, name, value);
+		}
+	}
+	if (top.mode && modeDrifted(root, top.mode)) {
+		hostMode = readHostMode(root);
+		writeMode(root, {
+			dataTheme: top.mode,
+			dark: top.mode === "dark"
+		});
+	}
+}
+/** Make the document match the top of the stack. */
+function sync() {
+	if (typeof document === "undefined") return;
+	const root = document.documentElement;
+	const top = stack.at(-1);
+	const wanted = top?.variables ?? {};
+	for (const name of [...appliedVariables.keys()]) if (!(name in wanted)) restoreVariable(root, name);
+	for (const [name, value] of Object.entries(wanted)) {
+		if (!hostVariables.has(name)) hostVariables.set(name, root.style.getPropertyValue(name));
+		if (appliedVariables.get(name) !== value) forceVariable(root, name, value);
+	}
+	if (top?.mode) {
+		if (!hostMode) hostMode = readHostMode(root);
+		writeMode(root, {
+			dataTheme: top.mode,
+			dark: top.mode === "dark"
+		});
+	} else if (hostMode) {
+		writeMode(root, hostMode);
+		hostMode = null;
+	}
+	if (!top) {
+		observer?.disconnect();
+		observer = null;
+		return;
+	}
+	if (!observer && typeof MutationObserver !== "undefined") {
+		observer = new MutationObserver(reconcileDrift);
+		observer.observe(root, {
+			attributes: true,
+			attributeFilter: [
+				"style",
+				"data-theme",
+				"class"
+			]
+		});
+	}
+}
+/**
+* Apply a theme to the document and return a function that removes it again.
+*
+* Sets each variable from {@link themeToCssVariables} as an inline custom
+* property on `document.documentElement`, and for a mode sets `data-theme`
+* and the `.dark` class. While applied, the values are re-forced if something
+* else (a host ThemeProvider) rewrites them. Disposing restores the inline
+* values and mode the document had (including any change the host made in
+* between). When several themes are applied, the most recent one wins.
+* Calling the returned function more than once is safe. Without a DOM
+* (server rendering) it does nothing.
+*/
+function applyFluidGridsTheme(theme) {
+	if (typeof document === "undefined") return () => void 0;
+	const entry = {
+		id: nextId++,
+		variables: themeToCssVariables(theme),
+		mode: themeMode(theme)
+	};
+	stack.push(entry);
+	sync();
+	let disposed = false;
+	return () => {
+		if (disposed) return;
+		disposed = true;
+		const index = stack.findIndex((active) => active.id === entry.id);
+		if (index >= 0) stack.splice(index, 1);
+		sync();
+	};
+}
+/**
+* Stable key for a theme value, so callers can tell two theme objects with the
+* same content apart from a real change (hosts often pass inline objects).
+*/
+function themeKey(theme) {
+	if (!theme) return "";
+	if (typeof theme === "string") return theme;
+	const sortedGroup = (group) => groupEntries(theme, group).filter(([, value]) => value !== void 0).sort(([a], [b]) => a.localeCompare(b));
+	return JSON.stringify([
+		theme.mode ?? null,
+		sortedGroup("colors"),
+		sortedGroup("radius"),
+		sortedGroup("font")
+	]);
+}
+
+// src/config/index.ts
+var config_exports = /* @__PURE__ */ __exportAll({ getFluidGridsConfig: () => getFluidGridsConfig });
+let runtimeConfig = {
+	apiGatewayUrl: "",
+	workspaceId: ""
+};
+/**
+* Get current configuration via proxy for live access
+*/
+const config = new Proxy({}, { get(_, prop) {
+	return runtimeConfig[prop];
+} });
+/**
+* Get the full configuration object
+*/
+function getFluidGridsConfig() {
+	return { ...runtimeConfig };
+}
+/**
+* Set runtime configuration
+*/
+function setFluidGridsConfig(newConfig) {
+	const previous = runtimeConfig;
+	runtimeConfig = {
+		...runtimeConfig,
+		...newConfig
+	};
+	if (previous.authToken !== runtimeConfig.authToken || previous.workspaceToken !== runtimeConfig.workspaceToken) tokenRevision += 1;
+	if ("theme" in newConfig) syncConfigTheme(newConfig.theme);
+}
+/**
+* Reset configuration to defaults
+*/
+function resetFluidGridsConfig() {
+	tokenRevision += 1;
+	runtimeConfig = {
+		apiGatewayUrl: "",
+		workspaceId: ""
+	};
+	syncConfigTheme(void 0);
+}
+let tokenRevision = 0;
+/** Current token revision. Internal: used by the SDK's Apollo clients. */
+function getFluidGridsTokenRevision() {
+	return tokenRevision;
+}
+let configTheme = null;
+function syncConfigTheme(theme) {
+	const key = themeKey(theme);
+	if (configTheme?.key === key) return;
+	const previous = configTheme;
+	configTheme = key ? {
+		key,
+		dispose: applyFluidGridsTheme(theme)
+	} : null;
+	previous?.dispose();
+}
+function normalizeOrigin(origin) {
+	return origin.replace(/\/$/, "");
+}
+function validateTrustedOrigin(trustedOrigins) {
+	if (typeof window === "undefined" || !trustedOrigins?.length) return;
+	const currentOrigin = normalizeOrigin(window.location.origin);
+	if (!trustedOrigins.map(normalizeOrigin).includes(currentOrigin)) throw new Error(`FluidGrids SDK blocked untrusted origin: ${currentOrigin}`);
+}
+/**
+* Get the GraphQL endpoint URL
+*/
+function getGraphQLEndpoint(baseUrl) {
+	const url = baseUrl || runtimeConfig.apiGatewayUrl;
+	if (!url) throw new Error("FluidGrids SDK requires apiGatewayUrl to be configured");
+	const normalizedBase = url.endsWith("/") ? url.slice(0, -1) : url;
+	if (normalizedBase.endsWith("/graphql")) return normalizedBase;
+	return `${normalizedBase}/workspaces/graphql`;
+}
+/** Clear user execution state only when a host session ends or changes identity. */
+function resetFluidGridsExecutionState() {
+	useExecutionsStore.setState(useExecutionsStore.getInitialState(), true);
+}
+
+// src/graphql/live-tokens.ts
+/**
+* Token reader for an SDK-created Apollo client (BOFF-9961).
+*
+* The client starts with the tokens it was created with. Once a token is set
+* in the SDK config after that — a refresh through `auth.onTokenExpired`, or
+* a host calling `setFluidGridsConfig({ authToken })` — every later request
+* reads the configured value instead. Reading per request (never capturing
+* the token in a closure) is what lets a refreshed token reach in-flight
+* retries and websocket reconnects.
+*/
+function createLiveTokenReader(initial) {
+	const createdAt = getFluidGridsTokenRevision();
+	return () => {
+		if (getFluidGridsTokenRevision() === createdAt) return initial;
+		return {
+			authToken: config.authToken ?? initial.authToken,
+			workspaceToken: config.workspaceToken ?? initial.workspaceToken
+		};
+	};
+}
+
+// src/graphql/errors.ts
+/**
+* Operation-error helpers.
+*
+* The SDK usually runs against a host-injected Apollo client (see
+* `setFluidGridsClient`). App shells configure their shared client with
+* `errorPolicy: 'all'`, so `client.mutate` / `client.query` RESOLVE on
+* GraphQL errors — `result.data` is empty and the real failure sits in
+* `result.error`. Callers that only check `result.data` silently swallow
+* server errors (e.g. QUOTA_EXHAUSTED) and surface generic messages.
+*
+* Use `throwIfResultError(result)` right after a mutate/query so failures
+* flow through the existing catch paths, and `describeOperationError(err)`
+* to turn whatever was thrown into a user-presentable message.
+*/
+/** Well-known gateway error codes mapped to user-friendly messages. */
+function describeGraphQLError(error) {
+	switch (typeof error.extensions?.code === "string" ? error.extensions.code : void 0) {
+		case "QUOTA_EXHAUSTED": {
+			const quota = /Quota exhausted for (\S+)/.exec(error.message)?.[1];
+			return `Quota exhausted — your workspace has used up its ${quota ? `"${quota}" quota` : "usage quota"}. Upgrade your plan or wait for the quota to reset.`;
+		}
+		case "QUOTA_NOT_PROVISIONED": return "This workspace's plan does not include this usage allowance yet. Contact your workspace admin or support to have it provisioned.";
+		case "UNAUTHENTICATED": return "Your session has expired. Please sign in again.";
+		case "FORBIDDEN": return error.message || "You don't have permission to perform this action.";
+		default: return error.message || "Unknown error";
+	}
+}
+/** The first GraphQL error of a raw JSON response body, if it carries one. */
+function firstGraphQLErrorInBody(bodyText) {
+	try {
+		const parsed = JSON.parse(bodyText);
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const errors = parsed.errors;
+		if (!Array.isArray(errors) || errors.length === 0) return null;
+		const first = errors[0];
+		if (typeof first !== "object" || first === null) return null;
+		if (typeof first.message !== "string") return null;
+		return first;
+	} catch {
+		return null;
+	}
+}
+/**
+* Turn anything thrown (or found in `result.error`) into a message fit for
+* a toast / run log. Unwraps Apollo `CombinedGraphQLErrors` so well-known
+* gateway codes (quota, auth) read properly instead of a concatenated dump.
+*/
+function describeOperationError(error, fallback = "Unknown error") {
+	if (CombinedGraphQLErrors.is(error)) {
+		const first = error.errors[0];
+		return first ? describeGraphQLError(first) : error.message || fallback;
+	}
+	if (ServerError.is(error)) {
+		const first = firstGraphQLErrorInBody(error.bodyText);
+		if (first) return describeGraphQLError(first);
+	}
+	if (error instanceof Error) return error.message || fallback;
+	if (typeof error === "string" && error.length > 0) return error;
+	return fallback;
+}
+/**
+* Throw `result.error` when the injected client resolved an errored
+* operation (errorPolicy 'all'). Returns the result unchanged otherwise, so
+* it can be chained inline:
+*
+* ```ts
+* const result = throwIfResultError(await client.mutate({ ... }));
+* ```
+*/
+function throwIfResultError(result) {
+	if (result.error) throw new Error(describeOperationError(result.error), { cause: result.error });
+	return result;
+}
+/** True when a GraphQL error list carries a FORBIDDEN code. */
+function hasForbiddenCode(errors) {
+	return (errors ?? []).some((error) => error.extensions?.code === "FORBIDDEN");
+}
+/**
+* True when an operation failed because the caller lacks the permission
+* (gateway `@rbac` denial). Accepts the raw Apollo error, a `result.error`,
+* or the Error `throwIfResultError` throws (the original sits in `cause`).
+* Pages use it to render a no-access state instead of a load failure.
+*/
+function isForbiddenError(error) {
+	if (CombinedGraphQLErrors.is(error)) return hasForbiddenCode(error.errors);
+	if (ServerError.is(error)) {
+		if (error.statusCode === 403) return true;
+		const first = firstGraphQLErrorInBody(error.bodyText);
+		return first ? hasForbiddenCode([first]) : false;
+	}
+	if (error instanceof Error && error.cause !== void 0) return isForbiddenError(error.cause);
+	return false;
+}
+const REFRESHABLE_AUTH_FAILURES = /* @__PURE__ */ new Set(["CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED"]);
+const EXPIRED_TOKEN_MESSAGE = /\b(?:jwt|token)\b[^.]{0,40}\bexpired\b|\bexpired\b[^.]{0,20}\b(?:jwt|token)\b/i;
+function isUnauthenticatedGraphQLError(error) {
+	if (error.extensions?.code === "UNAUTHENTICATED") return true;
+	const authFailure = error.extensions?.authFailure;
+	if (typeof authFailure === "string" && REFRESHABLE_AUTH_FAILURES.has(authFailure)) return true;
+	return typeof error.message === "string" && EXPIRED_TOKEN_MESSAGE.test(error.message);
+}
+/**
+* True when a GraphQL error list says the caller's credential expired or is
+* not accepted: an `UNAUTHENTICATED` code, an expired / revoked
+* `authFailure` category, or an expired-token message.
+*/
+function hasUnauthenticatedGraphQLError(errors) {
+	return (errors ?? []).some(isUnauthenticatedGraphQLError);
+}
+/**
+* True when an operation failed because the session expired: HTTP 401, a
+* GraphQL `UNAUTHENTICATED` error, or an expired / revoked credential.
+* Accepts the raw Apollo error, a `result.error`, or the Error
+* `throwIfResultError` throws (the original sits in `cause`). A 503
+* `AUTH_SERVICE_UNAVAILABLE` is not an expired session and returns false.
+*/
+function isUnauthenticatedError(error) {
+	if (CombinedGraphQLErrors.is(error)) return hasUnauthenticatedGraphQLError(error.errors);
+	if (ServerError.is(error)) {
+		if (error.statusCode === 401) return true;
+		const first = firstGraphQLErrorInBody(error.bodyText);
+		return first ? isUnauthenticatedGraphQLError(first) : false;
+	}
+	if (error instanceof Error && error.cause !== void 0) return isUnauthenticatedError(error.cause);
+	return false;
+}
+/** The gateway error code of an operation failure, when it carries one. */
+function operationErrorCode(error) {
+	const codeOf = (graphQLError) => {
+		const code = graphQLError?.extensions?.code;
+		return typeof code === "string" ? code : void 0;
+	};
+	if (CombinedGraphQLErrors.is(error)) return codeOf(error.errors[0]);
+	if (ServerError.is(error)) return codeOf(firstGraphQLErrorInBody(error.bodyText) ?? void 0);
+	if (error instanceof Error && error.cause !== void 0) return operationErrorCode(error.cause);
+}
+
+// src/events/eventBus.ts
+/**
+* Host event bus for embedders (BOFF-9961).
+*
+* The SDK reports what happens inside the embedded builder to the host page
+* through one typed callback, `onEvent`, set on `FluidGridsConfig` (or the
+* `onEvent` prop of `FluidGridsProvider`). Hosts use it to sync their own UI,
+* analytics or backend: a workflow was saved or activated, a run started or
+* finished, the user selected a node, something failed.
+*
+* This bus is separate from the product-analytics emitters in
+* `analytics/fluidgridsEvents.ts`, which publish `fluidgrids.*` facts on the
+* fe-libs shell bus for Rybbit/OTel. Those stay as they are; this one is the
+* documented, versioned contract for third-party hosts.
+*
+* Versioning: {@link FLUIDGRIDS_EVENTS_VERSION} follows semver.
+*  - A new event name, or a new optional payload field, is a minor bump.
+*  - Removing or renaming an event, removing a payload field, or changing a
+*    field's type or meaning is a major bump (and a breaking SDK release).
+*
+* Delivery: events are synchronous and best effort. A handler that throws is
+* caught and logged with a warning; it never breaks the SDK action that
+* emitted the event.
+*
+* @module events/eventBus
+*/
+/** Version of the host event contract. See the module note for the rules. */
+const FLUIDGRIDS_EVENTS_VERSION = "1.1.0";
+/** Every host event name, in documentation order. */
+const FLUIDGRIDS_EVENT_NAMES = [
+	"workflow:saved",
+	"workflow:activated",
+	"run:started",
+	"run:completed",
+	"node:selected",
+	"error",
+	"auth:failed",
+	"builder:fullscreen"
+];
+/** Drop undefined keys so hosts see only the fields that are known. */
+function withoutUndefined(payload) {
+	return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== void 0));
+}
+/**
+* Deliver one host event. Never throws: a missing handler is a no-op and a
+* handler that throws is logged, so SDK code can call this anywhere.
+*/
+function emitFluidGridsEvent(name, payload) {
+	let handler;
+	try {
+		handler = config.onEvent;
+	} catch {
+		return;
+	}
+	if (typeof handler !== "function") return;
+	try {
+		const args = [name, withoutUndefined(payload)];
+		handler(...args);
+	} catch (error) {
+		console.warn(`[FluidGrids SDK] onEvent handler failed for ${name}`, error);
+	}
+}
+/**
+* Emit an `error` event for a failed SDK operation: the user-presentable
+* message and, when the gateway sent one, its error code.
+*/
+function emitOperationErrorEvent(source, error) {
+	emitFluidGridsEvent("error", {
+		source,
+		message: describeOperationError(error),
+		code: operationErrorCode(error)
+	});
+}
+const MAX_COMPLETED_RUNS = 500;
+const completedRuns = /* @__PURE__ */ new Set();
+/**
+* Emit `run:completed` once per run id. Later calls for the same run (a
+* second poll that sees the terminal status, a remounted builder following
+* the same run) are ignored.
+*/
+function emitRunCompletedOnce(payload) {
+	if (!payload.runId || completedRuns.has(payload.runId)) return;
+	completedRuns.add(payload.runId);
+	if (completedRuns.size > MAX_COMPLETED_RUNS) {
+		const oldest = completedRuns.values().next().value;
+		if (oldest !== void 0) completedRuns.delete(oldest);
+	}
+	emitFluidGridsEvent("run:completed", payload);
+}
+
+// src/graphql/token-refresh-link.ts
+/**
+* Token refresh on expiry (BOFF-9961).
+*
+* Workspace tokens are short-lived, so a builder left open outlives the token
+* it was mounted with. The gateway then answers 401 with a GraphQL
+* `UNAUTHENTICATED` error (category `CREDENTIAL_EXPIRED` / `_REVOKED`). This
+* link catches that, asks the host for a fresh token through
+* `auth.onTokenExpired`, stores it in the SDK config, and retries the failed
+* operation once with the new headers.
+*
+* Rules:
+*  - one refresh at a time: operations that fail while a refresh is running
+*    wait for the same promise instead of calling the host again, and an
+*    operation that was sent before a refresh finished retries with the
+*    token that refresh produced;
+*  - each operation is retried at most once, so a token the gateway keeps
+*    refusing can never loop;
+*  - when the host cannot refresh (the callback rejects or returns no token),
+*    `auth:failed` is emitted and the operation fails with its ORIGINAL error;
+*  - an operation sent before a refresh attempt that has since FAILED does
+*    not start a new one: its 401 is the same expired session that attempt
+*    already reported, so it fails with its original error and no second
+*    `auth:failed`. Only an operation sent after the failure (the host may
+*    have recovered, e.g. the user signed in again) may try a fresh refresh.
+*
+* @module graphql/token-refresh-link
+*/
+let inFlight = null;
+let refreshGeneration = 0;
+let lastRefreshed = null;
+let settledAttempts = 0;
+let lastFailedAttempt = 0;
+function normalizeTokens(value) {
+	if (typeof value === "string") return value.trim() ? { authToken: value } : null;
+	if (!value || typeof value !== "object") return null;
+	const tokens = {};
+	if (typeof value.authToken === "string" && value.authToken.trim()) tokens.authToken = value.authToken;
+	if (typeof value.workspaceToken === "string" && value.workspaceToken.trim()) tokens.workspaceToken = value.workspaceToken;
+	return tokens.authToken || tokens.workspaceToken ? tokens : null;
+}
+function storeInConfig(tokens) {
+	setFluidGridsConfig(tokens);
+}
+/**
+* Run the host refresh callback, sharing one call between concurrent
+* failures. Resolves with the fresh tokens, or null when the host could not
+* provide any (after emitting `auth:failed`).
+*/
+function refreshTokens(callback, store) {
+	if (inFlight) return inFlight;
+	const fail = (message) => {
+		settledAttempts += 1;
+		lastFailedAttempt = settledAttempts;
+		emitFluidGridsEvent("auth:failed", { message });
+		return null;
+	};
+	const run = (async () => {
+		try {
+			const tokens = normalizeTokens(await callback());
+			if (!tokens) return fail("onTokenExpired returned no token.");
+			store(tokens);
+			settledAttempts += 1;
+			refreshGeneration += 1;
+			lastRefreshed = tokens;
+			return tokens;
+		} catch (error) {
+			return fail(describeOperationError(error, "Token refresh failed."));
+		}
+	})();
+	inFlight = run;
+	run.finally(() => {
+		if (inFlight === run) inFlight = null;
+	});
+	return run;
+}
+function withTokenHeaders(headers, tokens) {
+	return {
+		...headers,
+		...tokens.authToken && { authorization: `Bearer ${tokens.authToken}` },
+		...tokens.workspaceToken && { "x-workspace-authorization": `Bearer ${tokens.workspaceToken}` }
+	};
+}
+function resultIsUnauthenticated(result) {
+	return hasUnauthenticatedGraphQLError(result.errors);
+}
+/**
+* Apollo link that refreshes an expired token and retries once.
+*
+* The SDK adds it to the clients it creates (`createFluidGridsClient`,
+* `createGlobalStoreClient`, `createFluidGridsClients`). Hosts that inject
+* their own Apollo client add it to their chain, BEFORE the link that sets the
+* `authorization` header, and either read the token from the SDK config in
+* that link or pass `onTokenRefreshed`:
+*
+* ```ts
+* const link = ApolloLink.from([
+*   createFluidGridsTokenRefreshLink(),
+*   authLink, // reads getFluidGridsConfig().authToken per request
+*   httpLink,
+* ]);
+* ```
+*
+* The retried operation also carries the new token in its own headers, so it
+* works when the host's auth link runs first, too — as long as that link
+* does not overwrite an `authorization` header it finds.
+*/
+function createFluidGridsTokenRefreshLink(options = {}) {
+	return new ApolloLink((operation, forward) => {
+		const store = options.onTokenRefreshed ?? storeInConfig;
+		return new Observable((observer) => {
+			const sentInGeneration = refreshGeneration;
+			const sentAfterAttempts = settledAttempts;
+			let retried = false;
+			let closed = false;
+			let current = null;
+			const pickRefresh = (callback) => {
+				if (refreshGeneration !== sentInGeneration && lastRefreshed) return Promise.resolve(lastRefreshed);
+				if (lastFailedAttempt > sentAfterAttempts) return Promise.resolve(null);
+				return refreshTokens(callback, store);
+			};
+			const retryOrFail = (fail) => {
+				const callback = options.onTokenExpired ?? config.auth?.onTokenExpired;
+				if (!callback) return false;
+				retried = true;
+				current?.unsubscribe();
+				current = null;
+				pickRefresh(callback).then((tokens) => {
+					if (closed) return;
+					if (!tokens) {
+						fail();
+						return;
+					}
+					const headers = operation.getContext().headers;
+					operation.setContext({ headers: withTokenHeaders(headers && typeof headers === "object" ? headers : void 0, tokens) });
+					subscribe();
+				});
+				return true;
+			};
+			const subscribe = () => {
+				let refreshing = false;
+				current = forward(operation).subscribe({
+					next: (result) => {
+						if (!retried && resultIsUnauthenticated(result) && retryOrFail(() => {
+							observer.next(result);
+							observer.complete();
+						})) {
+							refreshing = true;
+							return;
+						}
+						observer.next(result);
+					},
+					error: (error) => {
+						if (!retried && isUnauthenticatedError(error) && retryOrFail(() => observer.error(error))) {
+							refreshing = true;
+							return;
+						}
+						observer.error(error);
+					},
+					complete: () => {
+						if (!refreshing) observer.complete();
+					}
+				});
+			};
+			subscribe();
+			return () => {
+				closed = true;
+				current?.unsubscribe();
+			};
+		});
+	});
+}
+
+// src/graphql/client.ts
+let clientInstance = null;
+/**
+* Create a new Apollo client for FluidGrids SDK.
+*
+* Tokens are read per request: the client starts with `config.authToken` /
+* `config.workspaceToken` and follows any token set later in the SDK config
+* (see `auth.onTokenExpired`). Expired-token responses are refreshed and
+* retried once by `createFluidGridsTokenRefreshLink`; the websocket reads the
+* current token whenever it (re)connects.
+*/
+function createFluidGridsClient(config) {
+	const graphqlUrl = getGraphQLUrl(config.apiGatewayUrl);
+	const wsUrl = graphqlUrl.replace(/^http/, "ws");
+	const readTokens = createLiveTokenReader({
+		authToken: config.authToken,
+		workspaceToken: config.workspaceToken
+	});
+	const httpLink = createHttpLink({ uri: graphqlUrl });
+	const authLink = setContext((_, { headers }) => {
+		const { authToken, workspaceToken } = readTokens();
+		return { headers: {
+			...headers,
+			...authToken && { authorization: `Bearer ${authToken}` },
+			...workspaceToken && { "x-workspace-authorization": `Bearer ${workspaceToken}` },
+			"x-workspace-id": config.workspaceId,
+			...config.tenantId && { "x-tenant-id": config.tenantId },
+			...config.productId && { "x-product-id": config.productId }
+		} };
+	});
+	const wsLink = new GraphQLWsLink(createClient({
+		url: wsUrl,
+		connectionParams: () => {
+			const { authToken, workspaceToken } = readTokens();
+			return {
+				authorization: authToken ? `Bearer ${authToken}` : "",
+				...workspaceToken && { "x-workspace-authorization": `Bearer ${workspaceToken}` },
+				"x-workspace-id": config.workspaceId,
+				...config.tenantId && { "x-tenant-id": config.tenantId },
+				...config.productId && { "x-product-id": config.productId }
+			};
+		}
+	}));
+	const splitLink = split(({ query }) => {
+		const definition = getMainDefinition(query);
+		return definition.kind === "OperationDefinition" && definition.operation === "subscription";
+	}, wsLink, createFluidGridsTokenRefreshLink().concat(authLink).concat(httpLink));
+	return new ApolloClient({
+		link: splitLink,
+		cache: new InMemoryCache(),
+		defaultOptions: {
+			watchQuery: { fetchPolicy: "cache-and-network" },
+			query: { fetchPolicy: "network-only" }
+		}
+	});
+}
+/**
+* Get the GraphQL URL from the API gateway URL
+*/
+function getGraphQLUrl(apiGatewayUrl) {
+	const normalizedBase = apiGatewayUrl.endsWith("/") ? apiGatewayUrl.slice(0, -1) : apiGatewayUrl;
+	if (normalizedBase.endsWith("/graphql")) return normalizedBase;
+	return `${normalizedBase}/workspaces/graphql`;
+}
+/**
+* Set the module-level client (for SDK-managed mode or wrapper injection)
+*/
+function setFluidGridsClient(client) {
+	clientInstance = client;
+}
+/**
+* Get the module-level client
+* @throws Error if client is not initialized
+*/
+function getFluidGridsClient() {
+	if (!clientInstance) throw new Error("FluidGrids client not initialized. Use FluidGridsProvider or call setFluidGridsClient().");
+	return clientInstance;
+}
+/**
+* Get the client if available, or null if not initialized
+*/
+function getFluidGridsClientSafe() {
+	return clientInstance;
+}
+/**
+* Check if the client is ready
+*/
+function isFluidGridsClientReady() {
+	return clientInstance !== null;
+}
+/**
+* Wait for the client to be initialized
+*/
+function waitForFluidGridsClient(timeoutMs = 1e4, intervalMs = 100) {
+	return new Promise((resolve) => {
+		if (clientInstance) {
+			resolve(clientInstance);
+			return;
+		}
+		const start = Date.now();
+		const timer = setInterval(() => {
+			if (clientInstance) {
+				clearInterval(timer);
+				resolve(clientInstance);
+			} else if (Date.now() - start >= timeoutMs) {
+				clearInterval(timer);
+				resolve(null);
+			}
+		}, intervalMs);
+	});
+}
+/**
+* Reset the client reference (for cleanup on unmount)
+*/
+function resetFluidGridsClient() {
+	clientInstance = null;
+}
+
+export { themeKey as A, resetFluidGridsConfig as C, FLUIDGRIDS_THEME_TOKEN_MAP as D, validateTrustedOrigin as E, DEFAULT_EXECUTIONS_FILTER as M, useExecutionsStore as N, applyFluidGridsTheme as O, getGraphQLEndpoint as S, setFluidGridsConfig as T, throwIfResultError as _, resetFluidGridsClient as a, config_exports as b, createFluidGridsTokenRefreshLink as c, emitFluidGridsEvent as d, emitOperationErrorEvent as f, isUnauthenticatedError as g, isForbiddenError as h, isFluidGridsClientReady as i, themeToCssVariables as j, sanitizeThemeValue as k, FLUIDGRIDS_EVENTS_VERSION as l, describeOperationError as m, getFluidGridsClient as n, setFluidGridsClient as o, emitRunCompletedOnce as p, getFluidGridsClientSafe as r, waitForFluidGridsClient as s, createFluidGridsClient as t, FLUIDGRIDS_EVENT_NAMES as u, createLiveTokenReader as v, resetFluidGridsExecutionState as w, getFluidGridsConfig as x, config as y };