@dashai/sdk 0.9.0 → 2.0.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/data/deps.ts","../src/data/errors.ts","../src/data/http.ts","../src/data/client.ts","../src/data/dev-client.ts","../src/index.ts"],"names":["durationMs","assertValidTableSlug","MODULE_SLUG_REGEX","TABLE_SLUG_REGEX"],"mappings":";;;;;;;;;;AA2CA,IAAM,iBAAA,GAAoB,2BAAA;AAO1B,IAAM,gBAAA,GAAmB,2BAAA;AAEzB,SAAS,wBAAwB,IAAA,EAAoB;AACnD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uCAAuC,IAAI,CAAA,wHAAA;AAAA,KAC7C;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,IAAA,EAAoB;AAChD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC5D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAI,CAAA,mEAAA;AAAA,KAC1C;AAAA,EACF;AACF;AASO,SAAS,QAAA,CAAS,WAA0B,YAAA,EAA4B;AAC7E,EAAA,uBAAA,CAAwB,YAAY,CAAA;AAEpC,EAAA,OAAO;AAAA,IACL,GAAwB,SAAA,EAA6C;AACnE,MAAA,oBAAA,CAAqB,SAAS,CAAA;AAC9B,MAAA,OAAO,uBAAA,CAA6B,SAAA,EAAW,YAAA,EAAc,SAAS,CAAA;AAAA,IACxE;AAAA,GACF;AACF;AAOA,SAAS,uBAAA,CACP,SAAA,EACA,YAAA,EACA,SAAA,EAC0B;AAM1B,EAAA,MAAM,IAAA,GAAO,CAAA,MAAA,EAAS,YAAY,CAAA,IAAA,EAAO,SAAS,CAAA,CAAA;AAElD,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,IAAA,EAA0C;AACnD,MAAA,MAAM,IAAA,GAAO,QAAQ,EAAC;AACtB,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,CAAmB,QAAQ,CAAA,EAAG,IAAI,SAAS,IAAI,CAAA;AAK9E,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,MAAA,CAAO,MAAA;AAAA,UACd,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS,MAAA,CAAO,MAAA;AAAA,UAC5B,MAAA,EAAQ,KAAK,MAAA,IAAU;AAAA,SACzB;AAAA,MACF;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,IAAI,EAAA,EAA0B;AAClC,MAAA,OAAO,UAAU,OAAA,CAAa,KAAA,EAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IACtD;AAAA,GACF;AACF;;;ACjGO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,eAAA,EAAiB,iBAAA;AAAA,EACjB,SAAA,EAAW,WAAA;AAAA,EACX,aAAA,EAAe,eAAA;AAAA,EACf,sBAAA,EAAwB,wBAAA;AAAA,EACxB,6BAAA,EAA+B,+BAAA;AAAA;AAAA,EAE/B,kBAAA,EAAoB,oBAAA;AAAA,EACpB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,iBAAA,EAAmB,mBAAA;AAAA,EACnB,qBAAA,EAAuB,uBAAA;AAAA;AAAA;AAAA;AAAA,EAIvB,uBAAA,EAAyB,yBAAA;AAAA,EACzB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,sBAAA,EAAwB,wBAAA;AAAA,EACxB,iCAAA,EAAmC,mCAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnC,oBAAA,EAAsB,sBAAA;AAAA,EACtB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,eAAA,EAAiB,iBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,mBAAA,EAAqB,qBAAA;AAAA,EACrB,oBAAA,EAAsB,sBAAA;AAAA,EACtB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,mBAAA,EAAqB,qBAAA;AAAA,EACrB,uBAAA,EAAyB,yBAAA;AAAA;AAAA,EAEzB,aAAA,EAAe,eAAA;AAAA,EACf,eAAA,EAAiB,iBAAA;AAAA,EACjB,iBAAA,EAAmB,mBAAA;AAAA,EACnB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,sBAAA,EAAwB,wBAAA;AAAA;AAAA,EAExB,oBAAA,EAAsB,sBAAA;AAAA,EACtB,4BAAA,EAA8B,8BAAA;AAAA;AAAA,EAE9B,aAAA,EAAe,eAAA;AAAA,EACf,OAAA,EAAS,SAAA;AAAA;AAAA,EAET,cAAA,EAAgB;AAClB;AAYO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,SAAA;AAAA,EAET,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,GAWI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,QAAQ,MAAA,IAAU,CAAA;AAChC,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACtC,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACtC,IAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAI/B,MAAC,IAAA,CAA6B,QAAQ,OAAA,CAAQ,KAAA;AAAA,IAChD;AAAA,EACF;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,aAAA,CAAc;AAAA,EAC9C,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,kBAAkB,aAAA,EAAe,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,CAAA;AAAA,EAC5E;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,aAAA,CAAc;AAAA,EAC9C,WAAA,CAAY,SAAiB,SAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,iBAAA,CAAkB,SAAS,OAAA,EAAS;AAAA,MACxC,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS,EAAE,UAAA,EAAY,SAAA;AAAU,KAClC,CAAA;AAAA,EACH;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EACtD,WAAA,CAAY,OAAA,GAAU,yBAAA,EAA2B,SAAA,GAA2B,IAAA,EAAM;AAChF,IAAA,KAAA,CAAM,kBAAkB,eAAA,EAAiB,OAAA,EAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,WAAW,CAAA;AAAA,EAC9E;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAChD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,WAAW,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EACjF;AACF;AAGO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EAClD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,eAAe,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EACrF;AACF;AAOO,IAAM,sBAAA,GAAN,cAAqC,aAAA,CAAc;AAAA,EACxD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,oBAAoB,OAAA,EAAS;AAAA,MACnD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,aAAA,CAAc;AAAA,EACjD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,mBAAmB,OAAA,EAAS;AAAA,MAClD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAuBO,IAAM,uBAAA,GAAN,cAAsC,aAAA,CAAc;AAAA,EACzD,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EAC1D;AACF;AAUO,IAAM,yBAAA,GAAN,cAAwC,aAAA,CAAc;AAAA,EAC3D,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,wBAAwB,OAAA,EAAS;AAAA,MACvD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAWO,IAAM,kCAAA,GAAN,cAAiD,aAAA,CAAc;AAAA,EACpE,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,mCAAmC,OAAA,EAAS;AAAA,MAClE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAgCO,IAAM,SAAA,GAAN,cAAwB,aAAA,CAAc;AAAA,EAC3C,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EAC1D;AACF;AAqCO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAChD,YACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,MACnB,MAAA;AAAA,MACA,SAAA,EAAW,SAAS,iBAAA,CAAkB,mBAAA;AAAA,MACtC,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAA;AAyBO,SAAS,mBAAA,CACd,MAAA,EACA,QAAA,EACA,SAAA,GAA2B,IAAA,EACZ;AACf,EAAA,MAAM,IAAA,GAAO,QAAA,EAAU,IAAA,IAAQ,cAAA,CAAe,MAAM,CAAA;AACpD,EAAA,MAAM,OAAA,GAAU,QAAA,EAAU,OAAA,IAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA;AACnD,EAAA,MAAM,UAAU,QAAA,EAAU,OAAA;AAE1B,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA,CAAkB,eAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,aAAA;AACrB,MAAA,OAAO,IAAI,oBAAA,CAAqB,OAAA,EAAS,SAAS,CAAA;AAAA,IACpD,KAAK,iBAAA,CAAkB,SAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACvD,KAAK,iBAAA,CAAkB,aAAA;AACrB,MAAA,OAAO,IAAI,gBAAA,CAAiB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACzD,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,iBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,sBAAA,CAAuB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAC/D,KAAK,iBAAA,CAAkB,iBAAA;AACrB,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACxD,KAAK,iBAAA,CAAkB,uBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,uBAAA,CAAwB,IAAA,EAAM,OAAA,EAAS,SAAS,SAAS,CAAA;AAAA,IACtE,KAAK,iBAAA,CAAkB,sBAAA;AACrB,MAAA,OAAO,IAAI,yBAAA,CAA0B,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,iCAAA;AACrB,MAAA,OAAO,IAAI,kCAAA,CAAmC,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAC3E,KAAK,iBAAA,CAAkB,oBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,gBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,eAAA;AACrB,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA,EAAM,OAAA,EAAS,SAAS,SAAS,CAAA;AAAA,IACxD,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,mBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,oBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,mBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,uBAAA;AAMrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE;AACE,MAAA,OAAO,IAAI,aAAA,CAAc,IAAA,EAAM,OAAA,EAAS;AAAA,QACtC,MAAA;AAAA,QACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,QAClC,OAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA;AAEP;AAEA,SAAS,eAAe,MAAA,EAAwB;AAC9C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,eAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,SAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,aAAA;AAC7C,EAAA,IAAI,MAAA,IAAU,GAAA,EAAK,OAAO,iBAAA,CAAkB,cAAA;AAC5C,EAAA,OAAO,YAAA;AACT;;;ACpaA,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,+BAAA,GAAkC,GAAA;AACxC,IAAM,cAAA,GAAiB,MAAA;AACvB,IAAM,aAAA,GAAgB,MAAA;AAOtB,SAAS,YAAA,CAAa,SAAiB,cAAA,EAAyC;AAC9E,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACtD;AACA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAClD,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,aAAA,EAAgB,cAAc,CAAA,CAAA;AACjD;AAEA,SAAS,aAAa,MAAA,EAA0C;AAC9D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,OAAO,UAAA,CAAW,KAAA,KAAU,UAAA,EAAY;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AACzC;AASA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,OAAO,MAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACvD,EAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAE7C,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAI,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,WAAW,MAAA,EAAqC;AAC9D,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAO,cAAc,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACzC,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AACtC,EAAA,MAAM,aAAA,GAAwC;AAAA,IAC5C,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,MAAA,CAAO,OAAA,IAAW;AAAC,GACzB;AAKA,EAAA,MAAM,cAAc,MAAA,CAAO,WAAA;AAC3B,EAAA,MAAM,oBAAA,GACJ,OAAO,oBAAA,IAAwB,+BAAA;AAUjC,EAAA,SAAS,mBAAmB,IAAA,EAA2B;AACrD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,IAAI,IAAA,CAAK,cAAc,oBAAA,EAAsB;AAC7C,IAAA,IAAI;AACF,MAAA,WAAA,CAAY,IAAI,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,eAAe,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA4B;AAClF,IAAA,MAAM,iBAAiB,CAAA,CAAA,EAAI,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAC,CAAA,CAAA;AAO1D,IAAA,MAAM,MAAM,cAAA,CAAe,UAAA,CAAW,OAAO,CAAA,GACzC,CAAA,EAAG,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,EAAG,cAAc,KACtD,CAAA,EAAG,IAAI,GAAG,cAAc,CAAA,CAAA;AAU5B,IAAA,MAAM,KAAA,GAAA,CACH,OAAO,QAAA,GAAW,MAAM,OAAO,QAAA,EAAS,GAAI,IAAA,KAAS,MAAA,CAAO,MAAA,IAAU,IAAA;AAEzE,IAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,aAAA,EAAc;AAC3D,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IAC5B;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,IAC5C;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAM5D,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AAEvB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,QAAQ,GAAA,EAAK;AAAA,QACvB,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAMA,WAAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAChC,MAAA,IAAI,YAAA,CAAa,GAAG,CAAA,EAAG;AACrB,QAAA,kBAAA,CAAmB;AAAA,UACjB,MAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,UAAA,EAAAA,WAAAA;AAAA,UACA,MAAA,EAAQ,CAAA;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,SAAA,EAAW;AAAA,SACZ,CAAA;AACD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,WAAA,EAAc,MAAM,CAAA,CAAA,EAAI,cAAc,cAAc,SAAS,CAAA;AAAA,MACtF;AACA,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA,EAAAA,WAAAA;AAAA,QACA,MAAA,EAAQ,CAAA;AAAA,QACR,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AACD,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,sBAAsB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,EAAA,EAAK,aAAA,CAAc,GAAG,CAAC,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAElB,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAUhC,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEhD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,KAAA;AAAA,QACT;AAAA,OACD,CAAA;AACD,MAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AAC/C,MAAA,MAAM,mBAAA,CAAoB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAA;AAAA,IAC3D;AAEA,IAAA,kBAAA,CAAmB;AAAA,MACjB,MAAA;AAAA,MACA,IAAA,EAAM,cAAA;AAAA,MACN,UAAA;AAAA,MACA,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,OAAA,EAAS,IAAA;AAAA,MACT;AAAA,KACD,CAAA;AAKD,IAAA,OAAO,MAAA;AAAA,EACT;AAWA,EAAA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,MAAA,EACmB;AACnB,IAAA,MAAM,iBAAiB,CAAA,CAAA,EAAI,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAC,CAAA,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,EAAG,cAAc,CAAA,CAAA;AACpC,IAAA,MAAM,QAAQ,MAAA,CAAO,QAAA,GAAW,MAAM,MAAA,CAAO,UAAS,GAAI,IAAA;AAE1D,IAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,aAAA,EAAc;AAC3D,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IAC5B;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,IAC5C;AAIA,IAAA,MAAM,iBAAA,GAAoB,IAAI,eAAA,EAAgB;AAC9C,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,iBAAA,CAAkB,KAAA,IAAS,SAAS,CAAA;AACnE,IAAA,MAAM,kBAAA,GAAqB,IAAI,eAAA,EAAgB;AAC/C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,MAAA,CAAO,OAAA,EAAS,kBAAA,CAAmB,KAAA,EAAM;AAAA,WACxC,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,MAAM,kBAAA,CAAmB,OAAM,EAAG,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,IACxF;AACA,IAAA,iBAAA,CAAkB,MAAA,CAAO,gBAAA;AAAA,MACvB,OAAA;AAAA,MACA,MAAM,mBAAmB,KAAA,EAAM;AAAA,MAC/B,EAAE,MAAM,IAAA;AAAK,KACf;AAOA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,QAAQ,GAAA,EAAK;AAAA,QACvB,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,kBAAA,CAAmB;AAAA,OAC5B,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAChC,MAAA,IAAI,YAAA,CAAa,GAAG,CAAA,EAAG;AACrB,QAAA,kBAAA,CAAmB;AAAA,UACjB,MAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,UAAA;AAAA,UACA,MAAA,EAAQ,CAAA;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,SAAA,EAAW;AAAA,SACZ,CAAA;AAID,QAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,UAAA,MAAM,CAAA,GAAI,IAAI,KAAA,CAAM,mBAAmB,CAAA;AACvC,UAAA,CAAA,CAAE,IAAA,GAAO,YAAA;AACT,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,qBAAA,EAAwB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,iCAAA,CAAA;AAAA,UAChD;AAAA,SACF;AAAA,MACF;AACA,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA;AAAA,QACA,MAAA,EAAQ,CAAA;AAAA,QACR,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AACD,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,sBAAsB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,EAAA,EAAK,aAAA,CAAc,GAAG,CAAC,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAElB,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,IAAA,kBAAA,CAAmB;AAAA,MACjB,MAAA;AAAA,MACA,IAAA,EAAM,cAAA;AAAA,MACN,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,MACzB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAS,GAAA,CAAI,EAAA;AAAA,MACb;AAAA,KACD,CAAA;AAKD,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAE,SAAS,SAAA,EAAU;AAC9B;AAIA,SAAS,aAAa,GAAA,EAAuB;AAC3C,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,YAAA,IAAgB,CAAA,CAAE,IAAA,KAAS,WAAA;AAC/C;AAEA,SAAS,cAAc,GAAA,EAAsB;AAC3C,EAAA,IAAI,GAAA,YAAe,KAAA,EAAO,OAAO,GAAA,CAAI,OAAA;AACrC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,GAAA;AACpC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,iBAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAKlB;AACA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,CAAA,GAAI,KAAA;AAGV,EAAA,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,OAAO,EAAE,OAAA,KAAY,QAAA;AAC5D;;;AC5WO,SAAS,aAAa,MAAA,EAA8B;AACzD,EAAA,MAAM,SAAA,GAAY,WAAW,MAAM,CAAA;AACnC,EAAA,OAAO;AAAA,IACL,GAIE,SAAA,EAAqD;AACrD,MAAAC,sBAAqB,SAAS,CAAA;AAC9B,MAAA,OAAO,eAAA,CAAqC,WAAW,SAAS,CAAA;AAAA,IAClE,CAAA;AAAA,IAEA,KAAK,YAAA,EAA4B;AAI/B,MAAA,OAAO,QAAA,CAAS,WAAW,YAAY,CAAA;AAAA,IACzC,CAAA;AAAA,IAEA,OAAA,EAAS,kBAAkB,SAAS,CAAA;AAAA,IAEpC,OAAA,CAAqB,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA4B;AAC7E,MAAA,OAAO,SAAA,CAAU,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAChD,CAAA;AAAA,IAEA,SAAA,CACE,MAAA,EACA,IAAA,EACA,IAAA,EACA,MAAA,EACmB;AACnB,MAAA,OAAO,SAAA,CAAU,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,MAAM,MAAM,CAAA;AAAA,IACvD,CAAA;AAAA,IAEA,MAAM,WAAA,CACJ,YAAA,EACA,UAAA,EACA,OACA,IAAA,EACkB;AAClB,MAAA,qBAAA,CAAsB,YAAY,CAAA;AAClC,MAAA,qBAAA,CAAsB,UAAU,CAAA;AAOhC,MAAA,MAAM,IAAA,GACJ,CAAA,mCAAA,EAAsC,MAAA,CAAO,cAAc,CAAA,MAAA,EAAS,kBAAA;AAAA,QAClE;AAAA,OACD,CAAA,SAAA,EAAY,kBAAA,CAAmB,UAAU,CAAC,CAAA,CAAA;AAC7C,MAAA,MAAM,IAAA,GAAgC,EAAE,KAAA,EAAM;AAC9C,MAAA,IAAI,IAAA,EAAM,mBAAmB,MAAA,EAAW;AACtC,QAAA,IAAA,CAAK,kBAAkB,IAAA,CAAK,cAAA;AAAA,MAC9B;AACA,MAAA,IAAI,IAAA,EAAM,cAAc,MAAA,EAAW;AACjC,QAAA,IAAA,CAAK,aAAa,IAAA,CAAK,SAAA;AAAA,MACzB;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,OAAA;AAAA,QAC/B,MAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAMA,MAAA,IAAI,QAAA,CAAS,OAAO,KAAA,EAAO;AACzB,QAAA,MAAM,SAAA,GAAY,QAAA,CAAS,YAAA,EAAc,UAAA,IAAc,IAAA;AACvD,QAAA,MAAM,mBAAA;AAAA,UACJ,GAAA;AAAA,UACA;AAAA,YACE,IAAA,EAAM,SAAS,KAAA,CAAM,IAAA;AAAA,YACrB,OAAA,EAAS,SAAS,KAAA,CAAM,OAAA;AAAA,YACxB,OAAA,EAAS,SAAS,KAAA,CAAM,KAAA,GACpB,EAAE,KAAA,EAAO,QAAA,CAAS,KAAA,CAAM,KAAA,EAAM,GAC9B;AAAA,WACN;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IAClB;AAAA,GACF;AACF;AA4BA,IAAM,iBAAA,GAAoB,iCAAA;AAC1B,IAAMC,kBAAAA,GAAoB,2BAAA;AAE1B,SAAS,sBAAsB,IAAA,EAAoB;AACjD,EAAA,IAAI,CAACA,kBAAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iCAAiC,IAAI,CAAA,wDAAA;AAAA,KACvC;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,IAAA,EAAoB;AACjD,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wBAAwB,IAAI,CAAA,iGAAA;AAAA,KAC9B;AAAA,EACF;AACF;AAOA,IAAMC,iBAAAA,GAAmB,mBAAA;AAEzB,SAASF,sBAAqB,IAAA,EAAoB;AAChD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAACE,iBAAAA,CAAiB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC5D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAI,CAAA,wCAAA;AAAA,KAC1C;AAAA,EACF;AACF;AASA,SAAS,kBAAkB,SAAA,EAAyC;AAClE,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,EAAqC;AACzC,MAAA,kBAAA,CAAmB,OAAO,CAAA;AAC1B,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA,KAAA,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,MAAM,KAAK,KAAA,EAA4D;AACrE,UAAA,MAAM,KAAK,KAAA,GAAQ,IAAI,gBAAgB,KAAK,CAAA,CAAE,UAAS,GAAI,EAAA;AAC3D,UAAA,MAAM,OAAO,EAAA,GAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,IAAA;AACpC,UAAA,OAAO,SAAA,CAAU,OAAA,CAA2B,KAAA,EAAO,IAAI,CAAA;AAAA,QACzD,CAAA;AAAA,QACA,MAAM,IAAI,KAAA,EAAiD;AACzD,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,KAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA;AAAA,WAClB;AAAA,QACF,CAAA;AAAA,QACA,MAAM,OACJ,IAAA,EACkC;AAClC,UAAA,OAAO,SAAA,CAAU,OAAA,CAAiC,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,QACtE,CAAA;AAAA,QACA,MAAM,MAAA,CACJ,KAAA,EACA,IAAA,EACkC;AAClC,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,OAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAAA,YAChB;AAAA,WACF;AAAA,QACF,CAAA;AAAA,QACA,MAAM,OAAO,KAAA,EAA2C;AACtD,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,QAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA;AAAA,WAClB;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,mBAAmB,OAAA,EAAuB;AACjD,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2CAA2C,OAAO,CAAA,8BAAA;AAAA,KACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAA,CAIP,WAA0B,SAAA,EAAqD;AAC/E,EAAA,MAAM,IAAA,GAAO,OAAO,SAAS,CAAA,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,IAAA,EAA0C;AAmBnD,MAAA,MAAM,GAAA,GAA+B;AAAA,QACnC,CAAA,EAAG,CAAA;AAAA,QACH,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,OACzC;AACA,MAAA,IAAI,IAAA,EAAM,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,QAAQ,IAAA,CAAK,MAAA;AACjD,MAAA,IAAI,MAAM,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AACpD,QAAA,GAAA,CAAI,UAAU,IAAA,CAAK,IAAA;AAAA,MACrB;AACA,MAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,EAAU,GAAA,CAAI,QAAQ,IAAA,CAAK,KAAA;AACtD,MAAA,IAAI,OAAO,IAAA,EAAM,MAAA,KAAW,QAAA,EAAU,GAAA,CAAI,SAAS,IAAA,CAAK,MAAA;AAExD,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,CAAmB,QAAQ,QAAA,EAAU,EAAE,KAAK,CAAA;AAK3E,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,MAAA,CAAO,MAAA;AAAA,UACd,KAAA,EAAO,IAAA,EAAM,KAAA,IAAS,MAAA,CAAO,MAAA;AAAA,UAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU;AAAA,SAC1B;AAAA,MACF;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,IAAI,EAAA,EAA0B;AAClC,MAAA,OAAO,UAAU,OAAA,CAAa,KAAA,EAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA;AAAA,IAEA,MAAM,OAAO,IAAA,EAA4B;AACvC,MAAA,OAAO,SAAA,CAAU,OAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,EAAA,EAAY,KAAA,EAA6B;AACpD,MAAA,OAAO,SAAA,CAAU,QAAa,OAAA,EAAS,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,KAAK,CAAA;AAAA,IAC/D,CAAA;AAAA,IAEA,MAAM,OAAO,EAAA,EAA2B;AACtC,MAAA,MAAM,UAAU,OAAA,CAAc,QAAA,EAAU,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IACzD;AAAA,GACF;AACF;;;ACrMO,SAAS,eAAA,CAAgB,SAAA,GAAoC,EAAC,EAAW;AAC9E,EAAA,MAAM,aAAa,iBAAA,EAAkB;AAErC,EAAA,MAAM,UACJ,SAAA,CAAU,OAAA,IACV,QAAQ,kBAAkB,CAAA,IAC1B,YAAY,MAAA,IACZ,IAAA;AACF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AAaA,EAAA,MAAM,cAAc,SAAA,CAAU,UAAA,GAC1B,YAAY,OAAA,GAAU,SAAA,CAAU,UAAU,CAAA,GAC1C,MAAA;AACJ,EAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,wBAAwB,CAAA,IAAK,aAAa,YAAA,IAAgB,IAAA;AAOpE,EAAA,MAAM,cAAA,GACJ,UAAU,cAAA,IACV,OAAA,CAAQ,0BAA0B,CAAA,KACjC,YAAA,KAAiB,OAAO,SAAA,GAAY,OAAA,CAAA;AAWvC,EAAA,MAAM,aAAA,GACJ,gBACA,OAAA,CAAQ,kBAAkB,KAC1B,OAAA,CAAQ,oBAAoB,CAAA,IAC5B,UAAA,EAAY,KAAA,IACZ,IAAA;AACF,EAAA,MAAM,gBAAA,GACJ,SAAA,CAAU,QAAA,KAAa,MAAM,aAAA,CAAA;AAE/B,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,GAAG,SAAA;AAAA,IACH,OAAA;AAAA,IACA,cAAA;AAAA,IACA,QAAA,EAAU;AAAA,GACX,CAAA;AACH;AAmCA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,CAAC,OAAA,CAAQ,KAAK,OAAO,MAAA;AAC3D,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,IAAI,CAAA,GAAI,MAAA;AACrD;AAOA,SAAS,aAAA,GAAyB;AAChC,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,KAAA;AAC3C,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,OAAO,OAAA,CAAQ,QAAA,CAAS,SAAS,QAAA,EAAU;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAkBA,SAAS,iBAAA,GAA+C;AACtD,EAAA,IAAI,CAAC,aAAA,EAAc,EAAG,OAAO,IAAA;AAC7B,EAAA,IAAI,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA,EAAc,OAAO,IAAA;AACjD,EAAA,IAAI;AAMF,IAAA,MAAM,EAAA,GAAK,UAAQ,IAAS,CAAA;AAE5B,IAAA,MAAM,IAAA,GAAO,UAAQ,MAAW,CAAA;AAEhC,IAAA,MAAM,EAAA,GAAK,UAAQ,IAAS,CAAA;AAE5B,IAAA,MAAM,GAAA,GAAM,gBAAA,CAAiB,IAAA,EAAM,EAAE,CAAA;AACrC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AACvC,IAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,IAAI,GAAG,OAAO,IAAA;AAEjC,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACzC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,CAAC,oBAAA,CAAqB,MAAM,CAAA,EAAG,OAAO,IAAA;AAC1C,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAMN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,SAAS,gBAAA,CACP,MACA,EAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,QAAQ,iBAAiB,CAAA;AACrC,EAAA,IAAI,GAAA,EAAK,OAAO,IAAA,CAAK,IAAA,CAAK,KAAK,UAAU,CAAA;AACzC,EAAA,IAAI,EAAA,CAAG,QAAA,EAAS,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,OAAA,GAAU,QAAQ,SAAS,CAAA;AACjC,IAAA,IAAI,OAAA,EAAS,OAAO,IAAA,CAAK,IAAA,CAAK,SAAS,UAAU,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,EAAA,CAAG,OAAA,EAAQ,EAAG,WAAW,UAAU,CAAA;AACtD;AAEA,SAAS,qBAAqB,CAAA,EAAqC;AACjE,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,KAAA;AACxC,EAAA,MAAM,CAAA,GAAI,CAAA;AAWV,EAAA,MAAM,WAAW,CAAA,CAAE,MAAA,KAAW,MAAA,IAAa,OAAO,EAAE,MAAA,KAAW,QAAA;AAC/D,EAAA,MAAM,UAAU,CAAA,CAAE,KAAA,KAAU,MAAA,IAAa,OAAO,EAAE,KAAA,KAAU,QAAA;AAC5D,EAAA,MAAM,SAAA,GACJ,EAAE,OAAA,KAAY,MAAA,IACb,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,IAAY,CAAA,CAAE,OAAA,KAAY,IAAA;AAClD,EAAA,OAAO,YAAY,OAAA,IAAW,SAAA;AAChC;;;AC1SO,IAAM,OAAA,GAC2B,OAAA","file":"index.cjs","sourcesContent":["/**\n * Borrowed-table accessor: `client.deps(providerSlug).db<Row>(tableSlug)`.\n *\n * Phase 1 of the SDK query plane — see\n * `dashwise-devops-docs/plans/modules-sdk-query-v1.md` §6.2.\n *\n * The factory is intentionally a thin wrapper around the existing\n * {@link HttpTransport}: cross-module reads target a parallel URL\n * shape (`/deps/<provider>/db/<table>/list` instead of\n * `/db/<table>/list`) but otherwise behave identically — same JSON\n * body, same {@link Page} envelope, same {@link DashwiseError} model.\n * No new transport, no new auth flow, no new caching.\n *\n * Cross-module **writes** are deliberately omitted: the returned\n * {@link ReadOnlyTableClient} has no `create` / `update` / `delete`.\n * See plan §4.3 — writes flow through provider-published actions in\n * a later phase, never as direct mutations across the trust boundary.\n *\n * Slug validation runs client-side as a fail-fast check so a typo\n * doesn't reach the backend as a 404 from a malformed URL. The\n * authoritative check is server-side: the backend re-validates\n * provider existence + contract coverage on every call.\n */\n\nimport type { HttpTransport } from './http.js';\nimport type {\n  BaseRow,\n  Deps,\n  ListOpts,\n  Page,\n  ReadOnlyTableClient,\n} from './types.js';\n\n/**\n * Module-slug character set matches the backend manifest validator's\n * `MODULE_SLUG_REGEX` exactly: kebab-case, 2-63 chars, starts with a\n * letter, ends with letter/digit, no leading/trailing dash.\n *\n * Mirrored here (not imported from the backend) because the SDK is\n * published independently — pulling backend code in would couple\n * release cycles. If the backend's regex changes, the SDK's mirror\n * must update in lockstep; covered by an integration test.\n */\nconst MODULE_SLUG_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;\n\n/**\n * Table-slug character set matches the backend's `SLUG_REGEX`: snake_case,\n * 2-63 chars, starts with a letter, ends with letter/digit. Same\n * mirror-vs-import tradeoff as {@link MODULE_SLUG_REGEX}.\n */\nconst TABLE_SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;\n\nfunction assertValidProviderSlug(slug: string): void {\n  if (typeof slug !== 'string' || !MODULE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid provider slug \"${slug}\". Provider slugs are the dependency module's slug (kebab-case, e.g. \"crm-app\"); must match /^[a-z][a-z0-9-]*[a-z0-9]$/.`,\n    );\n  }\n}\n\nfunction assertValidTableSlug(slug: string): void {\n  if (typeof slug !== 'string' || !TABLE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid table slug \"${slug}\". Table slugs must match /^[a-z][a-z0-9_]*[a-z0-9]$/ (snake_case).`,\n    );\n  }\n}\n\n/**\n * Build a {@link Deps} accessor for `providerSlug`. Validates the\n * slug shape eagerly; defers everything else to the backend.\n *\n * Exported for use by `createClient()` in `./client.ts`. Not part\n * of the public API directly — consumers reach it via `client.deps(...)`.\n */\nexport function makeDeps(transport: HttpTransport, providerSlug: string): Deps {\n  assertValidProviderSlug(providerSlug);\n\n  return {\n    db<Row extends BaseRow>(tableSlug: string): ReadOnlyTableClient<Row> {\n      assertValidTableSlug(tableSlug);\n      return makeBorrowedTableClient<Row>(transport, providerSlug, tableSlug);\n    },\n  };\n}\n\n/**\n * Internal: produce a {@link ReadOnlyTableClient} for one specific\n * `(providerSlug, tableSlug)` pair. Closure captures the transport +\n * the URL root so the public methods are tiny.\n */\nfunction makeBorrowedTableClient<Row extends BaseRow>(\n  transport: HttpTransport,\n  providerSlug: string,\n  tableSlug: string,\n): ReadOnlyTableClient<Row> {\n  // URL shape mirrors the owned-table CRUD pipeline but interpolates\n  // the provider's slug between the installation root + the table\n  // segment: `/deps/<provider>/db/<table>/...`. The full URL after\n  // the transport's base prefix is therefore\n  // `<baseUrl>/api/modules/<installationId>/deps/<provider>/db/<table>/<op>`.\n  const root = `/deps/${providerSlug}/db/${tableSlug}`;\n\n  return {\n    async list(opts?: ListOpts<Row>): Promise<Page<Row>> {\n      const body = opts ?? {};\n      const result = await transport.request<Page<Row>>('POST', `${root}/list`, body);\n      // Same defense-in-depth shape coercion as the owned-table client:\n      // if the backend ever responds with a bare array (older endpoint\n      // version, proxy stripping the envelope, etc.), wrap it so the\n      // consumer always sees `{ rows, ... }`.\n      if (Array.isArray(result)) {\n        return {\n          rows: result as Row[],\n          total: result.length,\n          limit: body.limit ?? result.length,\n          offset: body.offset ?? 0,\n        };\n      }\n      return result;\n    },\n\n    async get(id: number): Promise<Row> {\n      return transport.request<Row>('GET', `${root}/${id}`);\n    },\n  };\n}\n","/**\n * Error model for @dashai/sdk.\n *\n * The backend speaks a structured error envelope:\n *\n *   {\n *     \"code\": \"ROW_NOT_FOUND\",\n *     \"message\": \"Row 123 not found in tasks\",\n *     \"retriable\": false,\n *     \"context\": { ... }\n *   }\n *\n * This module wraps that envelope in a typed `DashwiseError` plus a small\n * set of subclasses for the codes consumers most commonly want to branch\n * on (network errors, auth failures, row-not-found, contract violations).\n *\n * Anything not matched by a specific subclass becomes a plain\n * `DashwiseError` carrying the raw `code`. Branch on `.code` for codes\n * we don't have a class for; use `instanceof` for the common cases.\n */\n\n/**\n * Known error codes. Not exhaustive — the backend emits many codes\n * specific to individual modules / endpoints. Use these constants when\n * you want compile-time safety; otherwise treat `err.code` as a string.\n *\n * The list is curated to the codes a module author is most likely to\n * branch on. Adding a new code here is a non-breaking change.\n */\nexport const DashwiseErrorCode = {\n  // Auth / authz\n  UNAUTHENTICATED: 'UNAUTHENTICATED',\n  FORBIDDEN: 'FORBIDDEN',\n  TOKEN_EXPIRED: 'TOKEN_EXPIRED',\n  INSTALLATION_NOT_FOUND: 'INSTALLATION_NOT_FOUND',\n  INSTALLATION_MODE_UNSUPPORTED: 'INSTALLATION_MODE_UNSUPPORTED',\n  // Contract enforcement\n  CONTRACT_VIOLATION: 'CONTRACT_VIOLATION',\n  FIELD_NOT_READABLE: 'FIELD_NOT_READABLE',\n  FILTER_OP_UNKNOWN: 'FILTER_OP_UNKNOWN',\n  OPERATION_NOT_ALLOWED: 'OPERATION_NOT_ALLOWED',\n  // Cross-module dependencies (Phase 1 of the SDK query plane —\n  // see dashwise-devops-docs/plans/modules-sdk-query-v1.md).\n  // Surfaced when reading borrowed tables via `client.deps(slug)`.\n  DEPENDENCY_NOT_DECLARED: 'DEPENDENCY_NOT_DECLARED',\n  TABLE_NOT_IN_CONTRACT: 'TABLE_NOT_IN_CONTRACT',\n  PROVIDER_TABLE_MISSING: 'PROVIDER_TABLE_MISSING',\n  OPERATION_NOT_ALLOWED_BY_PROVIDER: 'OPERATION_NOT_ALLOWED_BY_PROVIDER',\n  // Query-plane joins (Phase 3 — see\n  // dashwise-devops-docs/plans/modules-sdk-query-v1-p3-execution.md).\n  // Surfaced when `.join('<slug>')` / `.leftJoin('<slug>')` can't\n  // resolve the target. Pre-declared in slice 3.1 so slice 3.2's\n  // backend translator can emit them through fromBackendEnvelope\n  // without an SDK roundtrip.\n  LINK_FIELD_NOT_FOUND: 'LINK_FIELD_NOT_FOUND',\n  NOT_A_LINK_FIELD: 'NOT_A_LINK_FIELD',\n  JOIN_NOT_LINKED: 'JOIN_NOT_LINKED',\n  // Cross-module actions (Phase 7 slice 7.3a — see\n  // dashwise-devops-docs/plans/modules-sdk-query-v1-p7-cross-module-writes.md).\n  // Surfaced when `qb.deps.<dep>.actions.<name>(input)` (generated\n  // factory) dispatches against the new backend endpoint\n  // `POST :installationId/deps/:providerSlug/actions/:actionName`.\n  // Slice 7.2b ships the backend emitter; slice 7.3a (this slice)\n  // reserves the codes + maps them to DepActionError in the SDK.\n  ACTION_NOT_EXPOSED: 'ACTION_NOT_EXPOSED',\n  ACTION_NOT_DECLARED: 'ACTION_NOT_DECLARED',\n  ACTION_INPUT_INVALID: 'ACTION_INPUT_INVALID',\n  ACTION_OUTPUT_INVALID: 'ACTION_OUTPUT_INVALID',\n  ACTION_RATE_LIMITED: 'ACTION_RATE_LIMITED',\n  ACTION_EXECUTION_FAILED: 'ACTION_EXECUTION_FAILED',\n  // Data plane\n  ROW_NOT_FOUND: 'ROW_NOT_FOUND',\n  TABLE_NOT_FOUND: 'TABLE_NOT_FOUND',\n  VALIDATION_FAILED: 'VALIDATION_FAILED',\n  ROW_LIMIT_EXCEEDED: 'ROW_LIMIT_EXCEEDED',\n  STORAGE_LIMIT_EXCEEDED: 'STORAGE_LIMIT_EXCEEDED',\n  // Outbound / runtime\n  OUTBOUND_NOT_ALLOWED: 'OUTBOUND_NOT_ALLOWED',\n  OUTBOUND_CONCURRENCY_LIMITED: 'OUTBOUND_CONCURRENCY_LIMITED',\n  // Transport\n  NETWORK_ERROR: 'NETWORK_ERROR',\n  TIMEOUT: 'TIMEOUT',\n  // Server\n  INTERNAL_ERROR: 'INTERNAL_ERROR',\n} as const;\n\nexport type DashwiseErrorCode = (typeof DashwiseErrorCode)[keyof typeof DashwiseErrorCode];\n\n/**\n * Base class for every error thrown by @dashai/sdk. Carries the\n * structured envelope from the backend (or a synthetic one for\n * client-side failures like network errors / timeouts).\n *\n * Always thrown — never returned as a value. The async client methods\n * `.list()` / `.get()` etc. reject with one of these on failure.\n */\nexport class DashwiseError extends Error {\n  readonly code: string;\n  readonly status: number;\n  readonly retriable: boolean;\n  readonly context: Record<string, unknown> | undefined;\n  /**\n   * Backend-issued trace anchor (Phase 6 slice 6.2, 2026-05-19).\n   * Mirrors the `x-request-id` response header. Populated whenever\n   * the backend's `RuntimeQueryController` (or any future endpoint\n   * that echoes the header) is the origin of this error. `null` when\n   * the failure is client-side (NetworkError / TimeoutError — the\n   * request never reached the server, so there's no server-issued\n   * ID to surface).\n   *\n   * Use this as a debugging trace anchor when filing a bug against a\n   * specific failed query — the matching row in `module_query_log`\n   * carries the full backend context (ast_hash, error_code,\n   * duration_ms, etc.).\n   */\n  readonly requestId: string | null;\n\n  constructor(\n    code: string,\n    message: string,\n    options: {\n      status?: number;\n      retriable?: boolean;\n      context?: Record<string, unknown>;\n      cause?: unknown;\n      /**\n       * Phase 6 slice 6.2: backend `x-request-id` response header,\n       * captured by the transport before throwing. Pass `undefined`\n       * (or omit) for client-side errors that never hit the server.\n       */\n      requestId?: string | null;\n    } = {},\n  ) {\n    super(message);\n    this.name = this.constructor.name;\n    this.code = code;\n    this.status = options.status ?? 0;\n    this.retriable = options.retriable ?? false;\n    this.context = options.context;\n    this.requestId = options.requestId ?? null;\n    if (options.cause !== undefined) {\n      // Node 18+ and modern browsers support Error.cause natively.\n      // Use a property assignment because `super({ cause })` is awkward\n      // when the base class only takes a string.\n      (this as { cause?: unknown }).cause = options.cause;\n    }\n  }\n}\n\n/** Network-level failure (DNS, connection refused, TLS, fetch threw). */\nexport class NetworkError extends DashwiseError {\n  constructor(message: string, cause?: unknown) {\n    super(DashwiseErrorCode.NETWORK_ERROR, message, { retriable: true, cause });\n  }\n}\n\n/** Request exceeded the configured timeout (`timeoutMs`). */\nexport class TimeoutError extends DashwiseError {\n  constructor(message: string, timeoutMs: number) {\n    super(DashwiseErrorCode.TIMEOUT, message, {\n      retriable: true,\n      context: { timeout_ms: timeoutMs },\n    });\n  }\n}\n\n/** 401 — token missing/invalid. */\nexport class UnauthenticatedError extends DashwiseError {\n  constructor(message = 'Authentication required', requestId: string | null = null) {\n    super(DashwiseErrorCode.UNAUTHENTICATED, message, { status: 401, requestId });\n  }\n}\n\n/** 403 — caller lacks the role/scope for this operation. */\nexport class ForbiddenError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.FORBIDDEN, message, { status: 403, context, requestId });\n  }\n}\n\n/** 404 — `GET /db/<table>/<id>` for a missing or soft-deleted row. */\nexport class RowNotFoundError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.ROW_NOT_FOUND, message, { status: 404, context, requestId });\n  }\n}\n\n/**\n * Schema-level rejection: dep contract violated, table not exposed, field\n * not readable, filter op not allowed. Covers the family of \"you asked for\n * something the manifest doesn't permit\" errors.\n */\nexport class ContractViolationError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.CONTRACT_VIOLATION, message, {\n      status: 403,\n      context,\n      requestId,\n    });\n  }\n}\n\n/** 422-ish — request body failed validation. Inspect `context` for field-level errors. */\nexport class ValidationError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.VALIDATION_FAILED, message, {\n      status: 400,\n      context,\n      requestId,\n    });\n  }\n}\n\n// ── Cross-module dependency errors ─────────────────────────────────────\n//\n// Surfaced when calling `client.deps(slug).db<Row>(table).<op>(...)`.\n// Each subclass preserves the original backend `code` (unlike the older\n// `ContractViolationError` which collapses several codes onto a single\n// `CONTRACT_VIOLATION` string — that's a known wart we don't replicate\n// in new subclasses). Branch on `instanceof` for the common cases;\n// inspect `err.code` if you need to distinguish the two contract-error\n// codes (`DEPENDENCY_NOT_DECLARED` vs `TABLE_NOT_IN_CONTRACT`).\n\n/**\n * 404 — the caller's `module.json#dependencies` doesn't declare a\n * dependency on the requested provider module, OR the declared dep\n * exists but its `reads[]` block doesn't include the requested table.\n *\n * Either way the fix is on the **caller's** side: update the manifest\n * to declare the dep / add the table to `reads[]`, then re-publish.\n *\n * Covers both `DEPENDENCY_NOT_DECLARED` and `TABLE_NOT_IN_CONTRACT` —\n * inspect `err.code` to distinguish if you need different UX per case.\n */\nexport class DependencyContractError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, { status: 404, context, requestId });\n  }\n}\n\n/**\n * 404 — the provider's physical table no longer exists. This means the\n * provider published a version that dropped the table while the\n * consumer's installation still pinned the old contract. Recovery is\n * on the **provider's** side (republish with the table) or the\n * workspace admin's (downgrade the provider, or upgrade the consumer\n * to a version whose `dependencies[]` no longer references it).\n */\nexport class ProviderTableMissingError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.PROVIDER_TABLE_MISSING, message, {\n      status: 404,\n      context,\n      requestId,\n    });\n  }\n}\n\n/**\n * 403 — the provider's `exposes.operations.<verb>.allowed` is explicitly\n * `false` for the requested verb. Distinct from `OPERATION_NOT_ALLOWED`\n * (which is the **owner's** own-table policy) — `OPERATION_NOT_ALLOWED_BY_PROVIDER`\n * is the provider opting out of letting depending modules use a verb.\n *\n * No caller-side fix; either the provider needs to flip the gate, or\n * the consumer needs to find a different way to satisfy the use case.\n */\nexport class OperationNotAllowedByProviderError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.OPERATION_NOT_ALLOWED_BY_PROVIDER, message, {\n      status: 403,\n      context,\n      requestId,\n    });\n  }\n}\n\n// ── Join errors (Phase 3) ──────────────────────────────────────────────\n//\n// Surfaced when `.join('<slug>')` / `.leftJoin('<slug>')` on the\n// generated `qb` builder can't resolve the target against the\n// manifest. Pre-declared in slice 3.1; raised by the backend\n// translator in slice 3.2. Same one-subclass-with-preserved-code\n// pattern as DependencyContractError so authors can switch on\n// `err.code` for the three sub-cases:\n//\n//   LINK_FIELD_NOT_FOUND   `.join('xyz')` where `xyz` isn't a field\n//                          on the source table. Fix: pass an\n//                          explicit `on` argument, or correct the slug.\n//\n//   NOT_A_LINK_FIELD       `.join('title')` where `title` exists on\n//                          the source table but its type isn't\n//                          `link_row`. Fix: use a real link field,\n//                          or pass explicit `on`.\n//\n//   JOIN_NOT_LINKED        `.join('sibling_table')` where the target\n//                          is a sibling table but no link field\n//                          bridges them. Fix: pass explicit `on`.\n\n/**\n * 400 — `.join()` / `.leftJoin()` referenced a target the manifest\n * can't resolve. Covers the three sub-cases above; inspect\n * `err.code` to distinguish.\n *\n * Author-side fix in every case: either correct the slug, or pass\n * an explicit `on` argument to bypass link-field inference.\n */\nexport class JoinError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, { status: 400, context, requestId });\n  }\n}\n\n// ── Cross-module action errors (Phase 7 slice 7.3a, 2026-05-20) ──────\n//\n// Surfaced by the codegen-emitted `qb.deps.<dep>.actions.<name>(input)`\n// factory when the backend's cross-module dispatch\n// (`CrossModuleActionService.dispatch()`) rejects. Six sub-cases all\n// covered by `DepActionError`; inspect `err.code` to discriminate.\n//\n//   ACTION_NOT_EXPOSED      403 — provider's manifest doesn't expose\n//                                 the action, OR visibility='private'.\n//                                 Recovery: provider author needs to\n//                                 publish a version that exposes it.\n//   ACTION_NOT_DECLARED     403 — consumer's manifest doesn't list\n//                                 the action in dependencies[].actions[].\n//                                 Recovery: add it + republish.\n//   ACTION_INPUT_INVALID    400 — input fails Ajv against the\n//                                 provider's declared input schema.\n//                                 Recovery: fix the call site (typical\n//                                 with stale codegen + drift).\n//   ACTION_OUTPUT_INVALID   500 — provider returned a value that fails\n//                                 the declared output schema. This is a\n//                                 PROVIDER-author bug; consumer can\n//                                 only file an issue.\n//   ACTION_RATE_LIMITED     429 — per-actor or per-caller-installation\n//                                 rate limit exceeded. Retry with\n//                                 backoff after Retry-After (slice 7.4).\n//   ACTION_EXECUTION_FAILED 200-envelope — action body threw, timed out,\n//                                 or OOM-ed. Provider-author bug;\n//                                 trace surfaced in err.context.trace.\n\n/**\n * Single subclass for every cross-module action failure. The code\n * (and HTTP status) varies per sub-case; the wrapping class lets\n * consumers `catch (e) { if (e instanceof DepActionError) {...} }`\n * regardless of which sub-case fired.\n */\nexport class DepActionError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    status: number,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, {\n      status,\n      retriable: code === DashwiseErrorCode.ACTION_RATE_LIMITED,\n      context,\n      requestId,\n    });\n  }\n}\n\n// ── Factory: backend envelope → typed error ────────────────────────────\n\ninterface BackendErrorEnvelope {\n  code?: string;\n  message?: string;\n  retriable?: boolean;\n  context?: Record<string, unknown>;\n}\n\n/**\n * Build a typed `DashwiseError` from the backend's response envelope.\n *\n * The mapping picks the most specific subclass for codes we have a class\n * for; everything else becomes a plain `DashwiseError` carrying the raw\n * code. This keeps the type set small while still letting consumers\n * branch on string codes when they want to.\n *\n * Phase 6 slice 6.2 (2026-05-19): accepts an optional `requestId` —\n * the backend's `x-request-id` response header — and threads it onto\n * every produced error so consumers can use it as a debugging trace\n * anchor. Default `null` for backward compat; the transport always\n * passes it through.\n */\nexport function fromBackendEnvelope(\n  status: number,\n  envelope: BackendErrorEnvelope | null,\n  requestId: string | null = null,\n): DashwiseError {\n  const code = envelope?.code ?? codeFromStatus(status);\n  const message = envelope?.message ?? `HTTP ${status}`;\n  const context = envelope?.context;\n\n  switch (code) {\n    case DashwiseErrorCode.UNAUTHENTICATED:\n    case DashwiseErrorCode.TOKEN_EXPIRED:\n      return new UnauthenticatedError(message, requestId);\n    case DashwiseErrorCode.FORBIDDEN:\n      return new ForbiddenError(message, context, requestId);\n    case DashwiseErrorCode.ROW_NOT_FOUND:\n      return new RowNotFoundError(message, context, requestId);\n    case DashwiseErrorCode.CONTRACT_VIOLATION:\n    case DashwiseErrorCode.FIELD_NOT_READABLE:\n    case DashwiseErrorCode.FILTER_OP_UNKNOWN:\n    case DashwiseErrorCode.OPERATION_NOT_ALLOWED:\n      return new ContractViolationError(message, context, requestId);\n    case DashwiseErrorCode.VALIDATION_FAILED:\n      return new ValidationError(message, context, requestId);\n    case DashwiseErrorCode.DEPENDENCY_NOT_DECLARED:\n    case DashwiseErrorCode.TABLE_NOT_IN_CONTRACT:\n      return new DependencyContractError(code, message, context, requestId);\n    case DashwiseErrorCode.PROVIDER_TABLE_MISSING:\n      return new ProviderTableMissingError(message, context, requestId);\n    case DashwiseErrorCode.OPERATION_NOT_ALLOWED_BY_PROVIDER:\n      return new OperationNotAllowedByProviderError(message, context, requestId);\n    case DashwiseErrorCode.LINK_FIELD_NOT_FOUND:\n    case DashwiseErrorCode.NOT_A_LINK_FIELD:\n    case DashwiseErrorCode.JOIN_NOT_LINKED:\n      return new JoinError(code, message, context, requestId);\n    case DashwiseErrorCode.ACTION_NOT_EXPOSED:\n    case DashwiseErrorCode.ACTION_NOT_DECLARED:\n      return new DepActionError(code, message, 403, context, requestId);\n    case DashwiseErrorCode.ACTION_INPUT_INVALID:\n      return new DepActionError(code, message, 400, context, requestId);\n    case DashwiseErrorCode.ACTION_OUTPUT_INVALID:\n      return new DepActionError(code, message, 500, context, requestId);\n    case DashwiseErrorCode.ACTION_RATE_LIMITED:\n      return new DepActionError(code, message, 429, context, requestId);\n    case DashwiseErrorCode.ACTION_EXECUTION_FAILED:\n      // ACTION_EXECUTION_FAILED arrives as a 200 envelope from the\n      // backend (the host succeeded; the action body crashed). The\n      // _callAction helper unwraps the envelope and synthesizes this\n      // via the factory call — status 200 reflects \"the transport was\n      // fine; the failure is in the application layer\".\n      return new DepActionError(code, message, 200, context, requestId);\n    default:\n      return new DashwiseError(code, message, {\n        status,\n        retriable: envelope?.retriable ?? false,\n        context,\n        requestId,\n      });\n  }\n}\n\nfunction codeFromStatus(status: number): string {\n  if (status === 401) return DashwiseErrorCode.UNAUTHENTICATED;\n  if (status === 403) return DashwiseErrorCode.FORBIDDEN;\n  if (status === 404) return DashwiseErrorCode.ROW_NOT_FOUND;\n  if (status >= 500) return DashwiseErrorCode.INTERNAL_ERROR;\n  return 'HTTP_ERROR';\n}\n","/**\n * HTTP transport for @dashai/sdk.\n *\n * Wraps `globalThis.fetch` with:\n *   - configurable base URL + installation scoping\n *   - token attachment via the caller-supplied resolver\n *   - timeout enforcement via `AbortController`\n *   - response envelope parsing → typed `DashwiseError`\n *   - 204 No Content handling\n *\n * No retries here — retries are policy and belong one layer up. The\n * `retriable` flag on `DashwiseError` is hinting to the caller, not\n * something the transport acts on automatically. (We'd rather a module\n * author opt into retry per-call than have the SDK silently double-fire\n * an idempotent-looking POST that wasn't actually idempotent.)\n */\n\nimport {\n  DashwiseError,\n  NetworkError,\n  TimeoutError,\n  fromBackendEnvelope,\n} from './errors.js';\nimport type { ClientConfig, FetchImpl, SlowQueryInfo } from './types.js';\n\nexport interface HttpTransport {\n  /**\n   * Make a request to the DashWise API.\n   *\n   * @param method HTTP verb.\n   * @param path  Path appended to the installation-scoped base URL,\n   *              starting with `/`. Example: `/db/tasks/list`.\n   * @param body  JSON-serializable body. Omit/pass `undefined` to skip\n   *              the body entirely.\n   * @returns Parsed JSON response, or `undefined` for 204 No Content.\n   * @throws  `DashwiseError` (or a subclass) on any non-2xx response,\n   *          `NetworkError` on transport failure, `TimeoutError` on\n   *          aborted requests.\n   */\n  request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;\n\n  /**\n   * Phase 6 streaming (2026-05-19): low-level transport entry that\n   * returns the unparsed `Response` so the caller can stream the body\n   * chunk-by-chunk. Used by `qb.from(...).stream()` to consume the\n   * backend's SSE endpoint.\n   *\n   * Differs from `request()`:\n   *   - No body parsing — caller owns the `Response.body` ReadableStream.\n   *   - Caller MUST handle non-2xx (read the error envelope from the\n   *     response body + throw the typed `DashwiseError`); this method\n   *     returns the Response regardless of status so error JSON can\n   *     be read off the stream.\n   *   - Optional `signal` parameter for caller-side cancellation\n   *     (combined with the transport's own timeout). Abort propagates\n   *     to fetch, which cancels the underlying network read.\n   *   - Timeout handling: still applies via the transport's\n   *     `timeoutMs` config, but ONLY to the headers-arrival phase.\n   *     Streaming bodies can take arbitrarily long; the stream\n   *     reader's own backpressure handles the long tail.\n   */\n  streamRaw(\n    method: string,\n    path: string,\n    body?: unknown,\n    signal?: AbortSignal,\n  ): Promise<Response>;\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_SLOW_QUERY_THRESHOLD_MS = 500;\nconst TRAILING_SLASH = /\\/+$/;\nconst LEADING_SLASH = /^\\/+/;\n\n/**\n * Build the installation-scoped base URL. The runtime data API lives at\n * `/api/modules/<installation-id>` — every request from the SDK is\n * relative to that prefix.\n */\nfunction buildBaseUrl(baseUrl: string, installationId: number | string): string {\n  if (!baseUrl) {\n    throw new Error('@dashai/sdk: `baseUrl` is required');\n  }\n  const trimmed = baseUrl.replace(TRAILING_SLASH, '');\n  return `${trimmed}/api/modules/${installationId}`;\n}\n\nfunction resolveFetch(custom: FetchImpl | undefined): FetchImpl {\n  if (custom) return custom;\n  if (typeof globalThis.fetch !== 'function') {\n    throw new Error(\n      '@dashai/sdk: no `fetch` available. On Node < 18, pass an explicit `fetch` in `createClient({...})`.',\n    );\n  }\n  return globalThis.fetch.bind(globalThis);\n}\n\n/**\n * Parse a `Response` body, tolerating empty / non-JSON responses. Returns\n * `null` if there's no body or if the body fails to parse.\n *\n * We never throw from here — the caller decides what to do based on the\n * presence of an envelope.\n */\nasync function readBody(res: Response): Promise<unknown> {\n  if (res.status === 204) return undefined;\n  const contentType = res.headers.get('content-type') ?? '';\n  if (!contentType.includes('application/json')) {\n    // Non-JSON 200s shouldn't happen from DashWise, but handle them anyway.\n    try {\n      return await res.text();\n    } catch {\n      return null;\n    }\n  }\n  try {\n    return await res.json();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create an HTTP transport from the public client config.\n *\n * The returned `request` function captures the config + closes over it,\n * so the client can be shared across concurrent calls without rebuilding\n * the transport per call.\n */\nexport function createHttp(config: ClientConfig): HttpTransport {\n  const base = buildBaseUrl(config.baseUrl, config.installationId);\n  const doFetch = resolveFetch(config.fetch);\n  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const staticHeaders: Record<string, string> = {\n    Accept: 'application/json',\n    ...(config.headers ?? {}),\n  };\n  // Phase 6 slice 6.3 (2026-05-19): slow-query callback wiring.\n  // Read once at transport construction — config is immutable after\n  // createClient. If `onSlowQuery` is unset, the per-request hot path\n  // skips the duration comparison entirely (zero overhead).\n  const onSlowQuery = config.onSlowQuery;\n  const slowQueryThresholdMs =\n    config.slowQueryThresholdMs ?? DEFAULT_SLOW_QUERY_THRESHOLD_MS;\n\n  /**\n   * Fire the slow-query callback if (a) it's configured and (b) the\n   * round-trip exceeded the threshold. Always-safe: any exception the\n   * caller's callback throws is caught and silently dropped — a buggy\n   * observability hook MUST NOT crash the query path. Same failure-\n   * isolation contract the backend's `ModuleQueryLogService.record()`\n   * uses.\n   */\n  function maybeFireSlowQuery(info: SlowQueryInfo): void {\n    if (!onSlowQuery) return;\n    if (info.durationMs <= slowQueryThresholdMs) return;\n    try {\n      onSlowQuery(info);\n    } catch {\n      // Swallow — observability is best-effort.\n    }\n  }\n\n  async function request<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const normalizedPath = `/${path.replace(LEADING_SLASH, '')}`;\n    // Paths starting with `/api/` are treated as absolute (rooted at\n    // baseUrl) instead of installation-scoped. Used by Phase 7's\n    // `_callAction()` which hits `/api/modules/runtime/installations/...`\n    // — a sibling namespace to the installation-scoped CRUD endpoints.\n    // All existing call sites use installation-relative paths\n    // (e.g. `/db/tasks/list`), so this is backward-compatible.\n    const url = normalizedPath.startsWith('/api/')\n      ? `${config.baseUrl.replace(/\\/+$/, '')}${normalizedPath}`\n      : `${base}${normalizedPath}`;\n\n    // Resolve token AFTER building URL so a failing resolver still gives\n    // the consumer a useful error path-context. The resolver may be async\n    // (e.g. session lookup); the same instance is allowed to mutate\n    // between calls (token refresh).\n    //\n    // Precedence: a non-null `getToken()` result wins; otherwise fall back\n    // to the static `apiKey` (Custom Modules Platform v1 — a deployed\n    // module's long-lived `dwk_` key).\n    const token =\n      (config.getToken ? await config.getToken() : null) ?? config.apiKey ?? null;\n\n    const headers: Record<string, string> = { ...staticHeaders };\n    if (body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n    }\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n    // Phase 6 slice 6.3: capture the round-trip start AFTER token\n    // resolution (which can be slow if the resolver hits a network)\n    // but BEFORE the fetch — measures what the consumer cares about:\n    // the actual HTTP request's perceived latency.\n    const start = Date.now();\n\n    let res: Response;\n    try {\n      res = await doFetch(url, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: controller.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      const durationMs = Date.now() - start;\n      if (isAbortError(err)) {\n        maybeFireSlowQuery({\n          method,\n          path: normalizedPath,\n          durationMs,\n          status: 0,\n          success: false,\n          requestId: null,\n        });\n        throw new TimeoutError(`Request to ${method} ${normalizedPath} timed out`, timeoutMs);\n      }\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: 0,\n        success: false,\n        requestId: null,\n      });\n      throw new NetworkError(\n        `Network failure on ${method} ${normalizedPath}: ${describeError(err)}`,\n        err,\n      );\n    }\n    clearTimeout(timer);\n\n    const parsed = await readBody(res);\n    const durationMs = Date.now() - start;\n\n    // Phase 6 slice 6.2 (2026-05-19): capture the backend's\n    // `x-request-id` response header so we can attach it to any\n    // thrown `DashwiseError` as a debugging trace anchor. The\n    // backend echoes this header on every query/explain response\n    // (and will on more endpoints as Phase 6 rolls out); for\n    // endpoints that don't echo it yet, we get `null` and the\n    // error carries `requestId: null` — same semantic as a\n    // client-side NetworkError / TimeoutError.\n    const requestId = res.headers.get('x-request-id');\n\n    if (!res.ok) {\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: res.status,\n        success: false,\n        requestId,\n      });\n      const envelope = isEnvelope(parsed) ? parsed : null;\n      throw fromBackendEnvelope(res.status, envelope, requestId);\n    }\n\n    maybeFireSlowQuery({\n      method,\n      path: normalizedPath,\n      durationMs,\n      status: res.status,\n      success: true,\n      requestId,\n    });\n\n    // 204 / empty body → caller gets `undefined` typed as `T`. The data\n    // plane's `delete` is the only operation that legitimately produces\n    // a void result; everything else returns a body.\n    return parsed as T;\n  }\n\n  /**\n   * Phase 6 streaming (2026-05-19): low-level streaming entry — see\n   * `HttpTransport.streamRaw` JSDoc for the contract.\n   *\n   * Implementation mirrors `request()`'s setup (URL + token + static\n   * headers + AbortController) but skips body parsing entirely. The\n   * caller's `signal`, if provided, is combined with the transport's\n   * own timeout controller so EITHER trigger cancels the fetch.\n   */\n  async function streamRaw(\n    method: string,\n    path: string,\n    body?: unknown,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const normalizedPath = `/${path.replace(LEADING_SLASH, '')}`;\n    const url = `${base}${normalizedPath}`;\n    const token = config.getToken ? await config.getToken() : null;\n\n    const headers: Record<string, string> = { ...staticHeaders };\n    if (body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n    }\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    // Combine the caller's signal with our timeout controller.\n    // Either trigger cancels the fetch.\n    const timeoutController = new AbortController();\n    const timer = setTimeout(() => timeoutController.abort(), timeoutMs);\n    const combinedController = new AbortController();\n    if (signal) {\n      if (signal.aborted) combinedController.abort();\n      else signal.addEventListener('abort', () => combinedController.abort(), { once: true });\n    }\n    timeoutController.signal.addEventListener(\n      'abort',\n      () => combinedController.abort(),\n      { once: true },\n    );\n\n    // onSlowQuery wiring: measure round-trip from fetch start to\n    // headers-arrival. Streaming responses linger after headers; we\n    // fire `onSlowQuery` once when headers come back, NOT once per\n    // chunk. The `success` flag reflects HTTP status at that point;\n    // in-band SSE error events are observable by the caller separately.\n    const start = Date.now();\n    let res: Response;\n    try {\n      res = await doFetch(url, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: combinedController.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      const durationMs = Date.now() - start;\n      if (isAbortError(err)) {\n        maybeFireSlowQuery({\n          method,\n          path: normalizedPath,\n          durationMs,\n          status: 0,\n          success: false,\n          requestId: null,\n        });\n        // If the caller-supplied signal aborted, surface that as a\n        // standard AbortError (consumer can branch on `e.name`).\n        // Otherwise it's our timeout firing.\n        if (signal?.aborted) {\n          const e = new Error('Aborted by caller');\n          e.name = 'AbortError';\n          throw e;\n        }\n        throw new TimeoutError(\n          `Streaming request to ${method} ${normalizedPath} timed out before headers arrived`,\n          timeoutMs,\n        );\n      }\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: 0,\n        success: false,\n        requestId: null,\n      });\n      throw new NetworkError(\n        `Network failure on ${method} ${normalizedPath}: ${describeError(err)}`,\n        err,\n      );\n    }\n    clearTimeout(timer);\n\n    const requestId = res.headers.get('x-request-id');\n    maybeFireSlowQuery({\n      method,\n      path: normalizedPath,\n      durationMs: Date.now() - start,\n      status: res.status,\n      success: res.ok,\n      requestId,\n    });\n\n    // Hand the Response back regardless of status — caller reads the\n    // error envelope from the body (the standard JSON error path) OR\n    // streams the body when ok.\n    return res;\n  }\n\n  return { request, streamRaw };\n}\n\n// ── Helpers ─────────────────────────────────────────────────────────────\n\nfunction isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false;\n  const e = err as { name?: string; code?: string };\n  return e.name === 'AbortError' || e.code === 'ABORT_ERR';\n}\n\nfunction describeError(err: unknown): string {\n  if (err instanceof Error) return err.message;\n  if (typeof err === 'string') return err;\n  try {\n    return JSON.stringify(err);\n  } catch {\n    return '<unknown error>';\n  }\n}\n\nfunction isEnvelope(value: unknown): value is {\n  code?: string;\n  message?: string;\n  retriable?: boolean;\n  context?: Record<string, unknown>;\n} {\n  if (!value || typeof value !== 'object') return false;\n  const v = value as Record<string, unknown>;\n  // We accept the envelope if it has at least `code` OR `message` —\n  // matches what `DomainError` filters emit from the backend.\n  return typeof v.code === 'string' || typeof v.message === 'string';\n}\n\n// Re-export DashwiseError so consumers of the http module alone get the\n// full error model without a second import.\nexport { DashwiseError };\n","/**\n * `createClient()` — the public factory for talking to the DashWise\n * runtime data API.\n *\n * Returns a `Client` whose `db<Row>(slug)` method binds a table slug +\n * row type and produces a chainable `{ list, get, create, update, delete }`\n * surface.\n *\n * Two-layer use:\n *   1. Generated per-module typed wrappers call this and re-export a\n *      typed `db.tasks` / `db.notes` / etc. — the user-facing API for\n *      modules that ran `dashwise module generate`.\n *   2. Direct use for hand-authored scripts, integration tooling, custom\n *      modules that don't run codegen — operate on\n *      `Record<string, unknown>` rows with the generic `db<Row>(slug)`\n *      shape.\n *\n * The HTTP path layout mirrors the existing runtime data plane in\n * `dashwise-backend/src/modules/modules/runtime/data/runtime-table.controller.ts`:\n *\n *   POST   /api/modules/<installation>/db/<table>/list\n *   GET    /api/modules/<installation>/db/<table>/<id>\n *   POST   /api/modules/<installation>/db/<table>\n *   PATCH  /api/modules/<installation>/db/<table>/<id>\n *   DELETE /api/modules/<installation>/db/<table>/<id>\n */\n\nimport { makeDeps } from './deps.js';\nimport { fromBackendEnvelope } from './errors.js';\nimport { createHttp, type HttpTransport } from './http.js';\nimport type {\n  BaseInsert,\n  BaseRow,\n  BaseUpdate,\n  Client,\n  ClientConfig,\n  DatahubClient,\n  DatahubListResult,\n  DatahubTableClient,\n  Deps,\n  ListOpts,\n  Page,\n  TableClient,\n} from './types.js';\n\n/**\n * Create a DashWise SDK client. The returned client is thread-safe and\n * can be cached for the lifetime of the process (or the Next.js request).\n *\n * @example\n *   const client = createClient({\n *     baseUrl: 'https://api.dashwise.io',\n *     installationId: 'sandbox',\n *     getToken: () => process.env.DASHWISE_TOKEN ?? null,\n *   });\n *\n *   const page = await client.db<TasksRow>('tasks').list({\n *     filter: { done: false },\n *     limit: 50,\n *   });\n */\nexport function createClient(config: ClientConfig): Client {\n  const transport = createHttp(config);\n  return {\n    db<\n      Row extends BaseRow,\n      Insert extends BaseInsert = BaseInsert,\n      Update extends BaseUpdate = BaseUpdate,\n    >(tableSlug: string): TableClient<Row, Insert, Update> {\n      assertValidTableSlug(tableSlug);\n      return makeTableClient<Row, Insert, Update>(transport, tableSlug);\n    },\n\n    deps(providerSlug: string): Deps {\n      // Validation lives inside `makeDeps` so the same checks apply\n      // whether deps is reached via `createClient` or via a test\n      // harness that constructs the transport directly.\n      return makeDeps(transport, providerSlug);\n    },\n\n    datahub: makeDatahubClient(transport),\n\n    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T> {\n      return transport.request<T>(method, path, body);\n    },\n\n    streamRaw(\n      method: string,\n      path: string,\n      body?: unknown,\n      signal?: AbortSignal,\n    ): Promise<Response> {\n      return transport.streamRaw(method, path, body, signal);\n    },\n\n    async _callAction<TOutput = unknown>(\n      providerSlug: string,\n      actionName: string,\n      input: unknown,\n      opts?: { timeoutMs?: number; idempotencyKey?: string },\n    ): Promise<TOutput> {\n      assertValidModuleSlug(providerSlug);\n      assertValidActionName(actionName);\n      // The backend endpoint is rooted at\n      // `<baseUrl>/api/modules/runtime/installations/<consumerId>/deps/<slug>/actions/<name>`\n      // — a sibling namespace to the installation-scoped CRUD\n      // endpoints. The transport's `request()` treats paths starting\n      // with `/api/` as absolute (rooted at baseUrl) instead of\n      // installation-scoped.\n      const path =\n        `/api/modules/runtime/installations/${config.installationId}/deps/${encodeURIComponent(\n          providerSlug,\n        )}/actions/${encodeURIComponent(actionName)}`;\n      const body: Record<string, unknown> = { input };\n      if (opts?.idempotencyKey !== undefined) {\n        body.idempotency_key = opts.idempotencyKey;\n      }\n      if (opts?.timeoutMs !== undefined) {\n        body.timeout_ms = opts.timeoutMs;\n      }\n      const envelope = await transport.request<CrossModuleActionEnvelope<TOutput>>(\n        'POST',\n        path,\n        body,\n      );\n      // The transport throws on HTTP 4xx/5xx with the envelope mapped\n      // to typed errors via fromBackendEnvelope. A successful HTTP\n      // status with `ok: false` is the action-body-failure path — we\n      // synthesize a DepActionError so consumers have one place to\n      // catch.\n      if (envelope.ok === false) {\n        const requestId = envelope.cross_module?.request_id ?? null;\n        throw fromBackendEnvelope(\n          200,\n          {\n            code: envelope.error.code,\n            message: envelope.error.message,\n            context: envelope.error.trace\n              ? { trace: envelope.error.trace }\n              : undefined,\n          },\n          requestId,\n        );\n      }\n      return envelope.result;\n    },\n  };\n}\n\ninterface CrossModuleActionEnvelopeOk<T> {\n  ok: true;\n  result: T;\n  elapsed_ms: number;\n  executor: string;\n  cross_module: {\n    caller_installation_id: number;\n    provider_installation_id: number;\n    provider_module_slug: string;\n    provider_module_version: string;\n    request_id: string;\n  };\n}\n\ninterface CrossModuleActionEnvelopeErr {\n  ok: false;\n  error: { code: string; message: string; trace?: string };\n  elapsed_ms: number;\n  executor: string;\n  cross_module: CrossModuleActionEnvelopeOk<unknown>['cross_module'];\n}\n\ntype CrossModuleActionEnvelope<T> =\n  | CrossModuleActionEnvelopeOk<T>\n  | CrossModuleActionEnvelopeErr;\n\nconst ACTION_NAME_REGEX = /^[a-zA-Z_$][a-zA-Z0-9_$]{0,63}$/;\nconst MODULE_SLUG_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;\n\nfunction assertValidModuleSlug(slug: string): void {\n  if (!MODULE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `Invalid provider module slug \"${slug}\" — must be kebab-case (^[a-z][a-z0-9-]*[a-z0-9]$).`,\n    );\n  }\n}\n\nfunction assertValidActionName(name: string): void {\n  if (!ACTION_NAME_REGEX.test(name)) {\n    throw new Error(\n      `Invalid action name \"${name}\" — must be a JS identifier (letters/digits/underscore/$, starts non-digit, ≤64 chars).`,\n    );\n  }\n}\n\n/**\n * Module-slug character set matches the manifest validator's table-slug\n * rule (`^[a-z][a-z0-9_]*$`). Slugs are baked into URL paths, so\n * unsafe characters would route to the wrong resource (or 400).\n */\nconst TABLE_SLUG_REGEX = /^[a-z][a-z0-9_]*$/;\n\nfunction assertValidTableSlug(slug: string): void {\n  if (typeof slug !== 'string' || !TABLE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid table slug \"${slug}\". Slugs must match /^[a-z][a-z0-9_]*$/.`,\n    );\n  }\n}\n\n/**\n * Custom Modules Platform v1 (P1b) — Data Hub access surface. Hits the\n * runtime Data Hub bridge (`:installationId/datahub/tables/:tableId/rows…`),\n * which enforces the authenticating key's datahub grants. Table id (not\n * slug) keys the URL, matching the bridge route + the Data Hub's numeric\n * table identity.\n */\nfunction makeDatahubClient(transport: HttpTransport): DatahubClient {\n  return {\n    table(tableId: number): DatahubTableClient {\n      assertValidTableId(tableId);\n      const root = `/datahub/tables/${tableId}/rows`;\n      return {\n        async list(query?: Record<string, string>): Promise<DatahubListResult> {\n          const qs = query ? new URLSearchParams(query).toString() : '';\n          const path = qs ? `${root}?${qs}` : root;\n          return transport.request<DatahubListResult>('GET', path);\n        },\n        async get(rowId: number): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>(\n            'GET',\n            `${root}/${rowId}`,\n          );\n        },\n        async create(\n          body: Record<string, unknown>,\n        ): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>('POST', root, body);\n        },\n        async update(\n          rowId: number,\n          body: Record<string, unknown>,\n        ): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>(\n            'PATCH',\n            `${root}/${rowId}`,\n            body,\n          );\n        },\n        async delete(rowId: number): Promise<{ success: true }> {\n          return transport.request<{ success: true }>(\n            'DELETE',\n            `${root}/${rowId}`,\n          );\n        },\n      };\n    },\n  };\n}\n\nfunction assertValidTableId(tableId: number): void {\n  if (!Number.isInteger(tableId) || tableId <= 0) {\n    throw new Error(\n      `@dashai/sdk: invalid Data Hub table id \"${tableId}\". Must be a positive integer.`,\n    );\n  }\n}\n\nfunction makeTableClient<\n  Row extends BaseRow,\n  Insert extends BaseInsert,\n  Update extends BaseUpdate,\n>(transport: HttpTransport, tableSlug: string): TableClient<Row, Insert, Update> {\n  const root = `/db/${tableSlug}`;\n\n  return {\n    async list(opts?: ListOpts<Row>): Promise<Page<Row>> {\n      // SDK Query Plane v1 Phase 2 slice 6 (2026-05-19): `.list()` now\n      // compiles to a Query AST and posts to the unified `/query`\n      // endpoint instead of `/db/<slug>/list`. The on-wire input\n      // shape is `{ ast: QueryAst }`; the output `Page<Row>` envelope\n      // is identical to what the legacy endpoint returned. Consumers\n      // see no behavior change — same fields accepted, same response.\n      //\n      // Why route through /query: single read path going forward.\n      // Future query-plane improvements (sub-query caching, observability,\n      // slow-query warnings) light up `.list()` automatically without\n      // touching this file again. The legacy `/db/<slug>/list` endpoint\n      // stays in place for non-SDK consumers (sandbox iframes, AI\n      // builder tooling that hits it directly).\n      //\n      // The other CRUD methods below (`.get` / `.create` / `.update` /\n      // `.delete`) keep using `/db/<slug>/...` — the query plane is\n      // read-only by design, and per-row reads + writes have no AST\n      // representation in v1.\n      const ast: Record<string, unknown> = {\n        v: 1,\n        from: { kind: 'owned', slug: tableSlug },\n      };\n      if (opts?.filter !== undefined) ast.where = opts.filter;\n      if (opts?.sort !== undefined && opts.sort.length > 0) {\n        ast.orderBy = opts.sort;\n      }\n      if (typeof opts?.limit === 'number') ast.limit = opts.limit;\n      if (typeof opts?.offset === 'number') ast.offset = opts.offset;\n\n      const result = await transport.request<Page<Row>>('POST', '/query', { ast });\n      // Defence in depth: same Page-envelope coercion as before. The\n      // query plane always returns a proper envelope today; this\n      // fallback covers misconfigured proxies + future endpoint shape\n      // drift.\n      if (Array.isArray(result)) {\n        return {\n          rows: result as Row[],\n          total: result.length,\n          limit: opts?.limit ?? result.length,\n          offset: opts?.offset ?? 0,\n        };\n      }\n      return result;\n    },\n\n    async get(id: number): Promise<Row> {\n      return transport.request<Row>('GET', `${root}/${id}`);\n    },\n\n    async create(body: Insert): Promise<Row> {\n      return transport.request<Row>('POST', root, body);\n    },\n\n    async update(id: number, patch: Update): Promise<Row> {\n      return transport.request<Row>('PATCH', `${root}/${id}`, patch);\n    },\n\n    async delete(id: number): Promise<void> {\n      await transport.request<void>('DELETE', `${root}/${id}`);\n    },\n  };\n}\n","/**\n * `createDevClient()` — `createClient()`'s zero-config sibling for local dev.\n *\n * Resolves `baseUrl`, `installationId`, and `getToken` from a layered\n * config chain so a developer who has run `dashwise login` (and, for the\n * full local-dev experience, `dashwise init`) can do:\n *\n * ```ts\n * import { createDevClient } from '@dashai/sdk';\n * const client = createDevClient({ moduleSlug: 'my-tasks' });\n * ```\n *\n * …without copying tokens or installation ids around. The flow this\n * enables is the end-to-end \"two-command bootstrap\" the CLI's\n * `dashwise login` + `dashwise init` pair targets.\n *\n * ## Resolution chain\n *\n * For each field, the first non-empty source wins:\n *\n *   1. Explicit `overrides` argument (per-call escape hatch).\n *   2. Environment variables — `DASHWISE_API_URL` / `DASHWISE_API_TOKEN`\n *      / `DASHWISE_INSTALLATION_ID` / `DASHWISE_RUNTIME_TOKEN` (HH-CC-LDI-5).\n *      Standard for CI, Docker, prod-like setups; also the path\n *      `dashwise dev` uses to inject per-module credentials into the\n *      Next.js child process.\n *   3. The CLI's saved config at `$XDG_CONFIG_HOME/dashwise/auth.json`\n *      (or platform default) — written by `dashwise login` (top-level\n *      `apiUrl` + `token`) and `dashwise init` (per-module entry under\n *      `modules[slug]`).\n *\n * ## Per-module local-dev tokens (HH-CC-LDI-5)\n *\n * When `overrides.moduleSlug` is set, the SDK looks up the per-module\n * entry in `auth.json`:\n *\n * ```jsonc\n * {\n *   \"apiUrl\": \"http://localhost:3000\",\n *   \"token\": \"dwc_...\",                // CLI bearer (login)\n *   \"modules\": {\n *     \"my-tasks\": {\n *       \"runtimeToken\": \"<JWT>\",       // long-lived runtime token (LDI-2)\n *       \"installationId\": 4242,        // numeric install id (LDI-2)\n *       \"expiresAt\": \"2026-08-22T...\"  // informational only\n *     }\n *   }\n * }\n * ```\n *\n * Per-module entries are written by `dashwise init` (HH-CC-LDI-6) when\n * a developer provisions a local-dev install. The SDK prefers the\n * `runtimeToken` over the legacy CLI bearer (`token`) when both\n * exist, and sets `installationId` to the literal `'sandbox'` — the\n * URL placeholder the backend's `RuntimeTokenGuard` accepts (the\n * token resolves to the actual install on the server side).\n *\n * If `moduleSlug` is unset, OR the named module isn't in the\n * `modules` map, OR the entry lacks a `runtimeToken`, the resolver\n * falls back to the legacy chain (`token` field + `'local'` install\n * id, which the backend will reject — surfacing as a typed\n * `UnauthenticatedError` on the first request).\n *\n * ## Safety rails\n *\n *   - **Production refusal.** When `NODE_ENV === 'production'`, the file\n *     fallback is skipped. Prod deploys MUST set env vars explicitly;\n *     accidentally shipping with `~/.config/dashwise/auth.json` baked into\n *     a Docker image would be a credential leak.\n *   - **Edge / browser refusal.** `fs` / `os` / `path` imports happen\n *     lazily inside a try/catch with a Node-detection guard. In edge or\n *     browser runtimes the file fallback is silently skipped — env vars\n *     are still honored.\n *   - **No throw on missing creds at construction time.** Same contract\n *     as `createClient()` — the throw happens at the first request when\n *     the resolver returns null AND the backend rejects the call. This\n *     lets bundlers tree-shake the function into builds where it's only\n *     called conditionally.\n *\n * ## When to use which\n *\n *   - `createClient(config)` — production, edge runtime, anywhere you\n *     want explicit control over auth resolution\n *   - `createDevClient()` — local development, REPL exploration, ad-hoc\n *     scripts where typing the env-var dance every time is friction\n *\n * Both return the same `Client` shape — switching is a one-line change.\n */\n\nimport { createClient } from './client.js';\nimport type { Client, ClientConfig, TokenResolver } from './types.js';\n\n/**\n * Subset of `ClientConfig` the caller can override on top of the\n * auto-resolved defaults. Anything omitted uses the resolution chain.\n *\n * `fetch`, `timeoutMs`, `headers`, `onSlowQuery`, `slowQueryThresholdMs`\n * are passed through unchanged when provided.\n */\nexport interface CreateDevClientOptions\n  extends Partial<Omit<ClientConfig, 'getToken'>> {\n  /**\n   * Per-request token resolver. If set, overrides the auto-resolved\n   * token entirely. Pass `() => null` to explicitly disable token\n   * attachment (rare — only useful for hitting public endpoints).\n   */\n  getToken?: TokenResolver;\n\n  /**\n   * HH-CC-LDI-5 — module slug for per-module runtime-token lookup.\n   *\n   * When set, `createDevClient` reads\n   * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for\n   * a `runtimeToken`. If found, that token is used as the bearer\n   * (overriding `DASHWISE_API_TOKEN` / file-level `token`) and the\n   * SDK sends `installationId='sandbox'` — the URL placeholder\n   * accepted by the backend's `RuntimeTokenGuard`. The runtime\n   * token itself binds to a specific install on the server side.\n   *\n   * If `moduleSlug` is unset or the entry is missing, the legacy\n   * resolution chain applies (CLI bearer + `'local'` installation\n   * id, which the backend will 401 — surfacing as a typed\n   * `UnauthenticatedError` on the first request).\n   *\n   * Typical usage: scaffolded modules read `module.json#module.slug`\n   * and pass it here. The CLI's `dashwise dev` command also exports\n   * it as the `DASHWISE_RUNTIME_TOKEN` env var so child processes\n   * (e.g. `next dev`) can authenticate without re-reading the file.\n   */\n  moduleSlug?: string;\n}\n\n/**\n * Resolve config from env + saved CLI file + overrides, then hand off\n * to `createClient`. Synchronous — all sources are sync-readable.\n *\n * Throws only on truly unrecoverable problems (no `baseUrl` anywhere).\n * Missing token is fine at construction — the resolver returns null and\n * the backend's 401 surfaces a clear `UnauthenticatedError`.\n */\nexport function createDevClient(overrides: CreateDevClientOptions = {}): Client {\n  const fileConfig = readCliConfigFile();\n\n  const baseUrl =\n    overrides.baseUrl ??\n    readEnv('DASHWISE_API_URL') ??\n    fileConfig?.apiUrl ??\n    null;\n  if (!baseUrl) {\n    throw new Error(\n      '@dashai/sdk: createDevClient() could not resolve a baseUrl. ' +\n        'Pass `{ baseUrl }` explicitly, set `DASHWISE_API_URL`, or run `dashwise login` ' +\n        'to create the CLI config file.',\n    );\n  }\n\n  // HH-CC-LDI-5: resolve the per-module runtime token if either an\n  // explicit `DASHWISE_RUNTIME_TOKEN` env (set by `dashwise dev`) or a\n  // file-level `modules[slug].runtimeToken` entry (set by\n  // `dashwise init`) is available. The env var wins, mirroring the\n  // env > file precedence of every other field.\n  //\n  // When this resolves to non-null, it's preferred over the legacy\n  // CLI bearer token (`token` field + `DASHWISE_API_TOKEN`). The two\n  // tokens have different lifecycles + scopes — the bearer is the\n  // user's long-lived CLI credential, the runtime token is a JWT\n  // bound to a specific local-dev install.\n  const moduleEntry = overrides.moduleSlug\n    ? fileConfig?.modules?.[overrides.moduleSlug]\n    : undefined;\n  const runtimeToken =\n    readEnv('DASHWISE_RUNTIME_TOKEN') ?? moduleEntry?.runtimeToken ?? null;\n\n  // installationId: explicit override > env var > 'sandbox' if we\n  // have a runtime token (URL placeholder for runtime-token auth) >\n  // legacy 'local' fallback. The 'local' fallback exists for\n  // backward compat with pre-LDI flows; the backend will 401 it,\n  // surfacing a clear UnauthenticatedError the developer can act on.\n  const installationId =\n    overrides.installationId ??\n    readEnv('DASHWISE_INSTALLATION_ID') ??\n    (runtimeToken !== null ? 'sandbox' : 'local');\n\n  // Token resolution: runtime token > API key > legacy bearer token.\n  // Snapshot at construction (same rationale as the original\n  // implementation — a developer would need to re-login + restart their\n  // dev server for the token to change).\n  //\n  // Custom Modules Platform v1: `DASHWISE_API_KEY` (a scoped `dwk_`\n  // service key) is the production-deploy credential. It sits below the\n  // dev `runtimeToken` (so `dashwise dev` keeps working) but above the\n  // legacy CLI bearer.\n  const snapshotToken =\n    runtimeToken ??\n    readEnv('DASHWISE_API_KEY') ??\n    readEnv('DASHWISE_API_TOKEN') ??\n    fileConfig?.token ??\n    null;\n  const resolvedGetToken: TokenResolver =\n    overrides.getToken ?? (() => snapshotToken);\n\n  return createClient({\n    ...overrides,\n    baseUrl,\n    installationId,\n    getToken: resolvedGetToken,\n  });\n}\n\n// ── Internals ───────────────────────────────────────────────────────────\n\n/** Minimal view of the CLI's `auth.json` — only the fields we use. */\ninterface CliConfigFileShape {\n  apiUrl?: string;\n  token?: string;\n  /**\n   * HH-CC-LDI-5 — per-module local-dev install metadata, keyed by\n   * the module's slug (matches `module.json#module.slug`).\n   *\n   * Written by `dashwise init` (LDI-6); read here for the\n   * per-module runtime-token lookup. The SDK only consumes\n   * `runtimeToken`; `installationId` + `expiresAt` are\n   * informational (the CLI uses them for `dashwise module\n   * status` / token-rotation flows).\n   */\n  modules?: Record<string, CliConfigModuleEntry>;\n}\n\n/** Per-module entry within `auth.json#modules`. */\ninterface CliConfigModuleEntry {\n  /** JWT runtime token minted by `POST /api/installations/dev`. */\n  runtimeToken?: string;\n  /** Numeric installation id the runtime token resolves to. */\n  installationId?: number;\n  /** ISO timestamp; informational only (not enforced client-side). */\n  expiresAt?: string;\n}\n\n/**\n * Read an env var with empty-string treated as unset. Safe on edge /\n * browser builds where `process` may be a polyfill shim with no `env`.\n */\nfunction readEnv(key: string): string | undefined {\n  if (typeof process === 'undefined' || !process.env) return undefined;\n  const v = process.env[key];\n  return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n\n/**\n * Detect whether we're in a Node-like runtime that can actually `import\n * 'node:fs'`. Edge runtime, Cloudflare Workers, Deno without compat,\n * and browsers all fail this check.\n */\nfunction isNodeRuntime(): boolean {\n  if (typeof process === 'undefined') return false;\n  if (!process.versions || typeof process.versions.node !== 'string') {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Load + parse `auth.json` from the CLI's config directory. Returns\n * `null` if:\n *   - We're not in Node (edge / browser)\n *   - `NODE_ENV === 'production'` (prod must use env vars; refusing the\n *     file fallback is the safety rail against accidental credential\n *     leaks into Docker images)\n *   - The file doesn't exist (user hasn't run `dashwise login`)\n *   - The file exists but is unreadable / unparseable (corrupt — caller\n *     should re-login; we don't surface a noisy warning because the\n *     env-var path is still valid)\n *\n * Mirrors the path resolution in `@dashai/cli`'s\n * `packages/cli/src/lib/config.ts#configPath()` — kept in sync by\n * convention since the SDK can't depend on the CLI.\n */\nfunction readCliConfigFile(): CliConfigFileShape | null {\n  if (!isNodeRuntime()) return null;\n  if (readEnv('NODE_ENV') === 'production') return null;\n  try {\n    // Lazy require so bundlers that don't tree-shake the function call\n    // (e.g. esbuild without `--platform=node`) still drop the imports\n    // when this branch is unreachable at build time.\n    //\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const fs = require('node:fs') as typeof import('node:fs');\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const path = require('node:path') as typeof import('node:path');\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const os = require('node:os') as typeof import('node:os');\n\n    const dir = resolveConfigDir(path, os);\n    const file = path.join(dir, 'auth.json');\n    if (!fs.existsSync(file)) return null;\n\n    const raw = fs.readFileSync(file, 'utf-8');\n    const parsed = JSON.parse(raw) as unknown;\n    if (!isPlausibleFileShape(parsed)) return null;\n    return parsed;\n  } catch {\n    // Any failure → fall through to env-var-only mode. We deliberately\n    // don't log here: a missing / corrupt file is \"no fallback\n    // available,\" not \"something is broken.\" If env vars are also\n    // missing, the createClient-level error message will guide the\n    // developer to run `dashwise login`.\n    return null;\n  }\n}\n\n/**\n * Resolve the CLI's config directory. Same priority as the CLI:\n *   1. `$XDG_CONFIG_HOME/dashwise/`\n *   2. `%APPDATA%\\dashwise\\` on Windows\n *   3. `~/.config/dashwise/` everywhere else\n */\nfunction resolveConfigDir(\n  path: typeof import('node:path'),\n  os: typeof import('node:os'),\n): string {\n  const xdg = readEnv('XDG_CONFIG_HOME');\n  if (xdg) return path.join(xdg, 'dashwise');\n  if (os.platform() === 'win32') {\n    const appdata = readEnv('APPDATA');\n    if (appdata) return path.join(appdata, 'dashwise');\n  }\n  return path.join(os.homedir(), '.config', 'dashwise');\n}\n\nfunction isPlausibleFileShape(v: unknown): v is CliConfigFileShape {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  // We accept anything that LOOKS like an auth.json. If `apiUrl` /\n  // `token` are missing or wrong-typed, our resolution chain falls\n  // through to the next source — same as if the file didn't exist.\n  //\n  // HH-CC-LDI-5: `modules` is a record-shaped optional. We don't\n  // deep-validate per-entry shapes — if a `modules[slug]` is\n  // garbage, the runtime-token resolver just returns null and the\n  // legacy chain takes over. Forgiveness over strictness keeps the\n  // SDK resilient to a partially-written `auth.json` (e.g. the CLI\n  // crashed mid-write during `init`).\n  const apiUrlOk = o.apiUrl === undefined || typeof o.apiUrl === 'string';\n  const tokenOk = o.token === undefined || typeof o.token === 'string';\n  const modulesOk =\n    o.modules === undefined ||\n    (typeof o.modules === 'object' && o.modules !== null);\n  return apiUrlOk && tokenOk && modulesOk;\n}\n","/**\n * @dashai/sdk — public entry point.\n *\n * Two planes:\n *   - **data**: typed table client (`createClient`, `db<Row>(slug)`,\n *     `Where<Row>`, `Page<T>`, `DashwiseError` + subclasses).\n *     Re-exported from the default barrel.\n *   - **auth**: server / middleware / client helpers for session\n *     management. Imported via subpaths so consumers don't pull in\n *     React / `next/headers` if they only need data.\n *\n * Auth surface (all subpath-imported):\n *   - `@dashai/sdk/auth/server`     — `getServerSession`, `exchangeCode`, `signOut`\n *   - `@dashai/sdk/auth/middleware` — `withAuth()` Next.js edge middleware factory\n *   - `@dashai/sdk/auth/client`     — `useSession`, `<AuthProvider>`, `<SignOutButton>`\n *   - `@dashai/sdk/auth/types`      — `Session`, `AuthOptions`, `AuthErrorCode`\n *\n * SemVer policy: every named export here AND every named export from\n * the `auth/*` subpaths is part of the stable API. Breaking changes\n * require a major bump; new optional fields, new types, and additional\n * named exports are minors.\n *\n * Distribution model (per the v1 plan in\n * `dashwise-devops-docs/plans/modules-p8-p10-execution-plan.md`):\n *   - **AI builder sandbox**: SDK is baked into the E2B template image.\n *   - **CLI / local dev**: workspace-local resolution via pnpm\n *     `workspace:*` protocol OR tarball-into-`.dashwise/sdk-tarball.tgz`.\n *   - **Published modules**: SDK is pre-bundled into the Lambda image\n *     by `next build`; no runtime fetch required.\n *\n * npm publication is intentionally deferred — the SDK is consumed by\n * trusted, in-workspace paths, not by external developers (yet).\n *\n * @packageDocumentation\n */\n\nexport * from './data/index.js';\n\n/**\n * SDK package version. Replaced at build time by `tsup`'s `define`\n * substitution (see `tsup.config.ts`) with the value of `version`\n * from `packages/sdk/package.json`. Consumers can read this to\n * version-skew-detect against the manifest's required SDK range.\n *\n * In non-tsup contexts (Vitest, raw `tsc`), the bare `__SDK_VERSION__`\n * identifier resolves to a static `'dev'` fallback declared below.\n * Production builds always go through tsup so the build-time value\n * is what ships.\n */\ndeclare const __SDK_VERSION__: string;\nexport const VERSION: string =\n  typeof __SDK_VERSION__ === 'string' ? __SDK_VERSION__ : 'dev';\n"]}
+{"version":3,"sources":["../src/data/deps.ts","../src/data/errors.ts","../src/data/http.ts","../src/data/client.ts","../src/data/dev-client.ts","../src/index.ts"],"names":["durationMs","assertValidTableSlug","MODULE_SLUG_REGEX","TABLE_SLUG_REGEX"],"mappings":";;;;;;;;;;AA2DA,IAAM,iBAAA,GAAoB,2BAAA;AAO1B,IAAM,gBAAA,GAAmB,2BAAA;AAEzB,SAAS,wBAAwB,IAAA,EAAoB;AACnD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uCAAuC,IAAI,CAAA,wHAAA;AAAA,KAC7C;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,IAAA,EAAoB;AAChD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC5D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAI,CAAA,mEAAA;AAAA,KAC1C;AAAA,EACF;AACF;AASO,SAAS,QAAA,CAAS,WAA0B,YAAA,EAA4B;AAC7E,EAAA,uBAAA,CAAwB,YAAY,CAAA;AAEpC,EAAA,OAAO;AAAA,IACL,GAAwB,SAAA,EAA6C;AACnE,MAAA,oBAAA,CAAqB,SAAS,CAAA;AAC9B,MAAA,OAAO,uBAAA,CAA6B,SAAA,EAAW,YAAA,EAAc,SAAS,CAAA;AAAA,IACxE;AAAA,GACF;AACF;AAOA,SAAS,uBAAA,CACP,SAAA,EACA,YAAA,EACA,SAAA,EAC0B;AAI1B,EAAA,MAAM,UAAA,GAAa,CAAA,MAAA,EAAS,YAAY,CAAA,QAAA,EAAW,SAAS,CAAA,CAAA;AAE5D,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,IAAA,EAA0C;AAgBnD,MAAA,MAAM,GAAA,GAA+B;AAAA,QACnC,CAAA,EAAG,CAAA;AAAA,QACH,MAAM,EAAE,IAAA,EAAM,OAAO,MAAA,EAAQ,YAAA,EAAc,MAAM,SAAA;AAAU,OAC7D;AACA,MAAA,IAAI,IAAA,EAAM,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,QAAQ,IAAA,CAAK,MAAA;AACjD,MAAA,IAAI,MAAM,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AACpD,QAAA,GAAA,CAAI,UAAU,IAAA,CAAK,IAAA;AAAA,MACrB;AACA,MAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,EAAU,GAAA,CAAI,QAAQ,IAAA,CAAK,KAAA;AACtD,MAAA,IAAI,OAAO,IAAA,EAAM,MAAA,KAAW,QAAA,EAAU,GAAA,CAAI,SAAS,IAAA,CAAK,MAAA;AAExD,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,CAAmB,QAAQ,QAAA,EAAU,EAAE,KAAK,CAAA;AAI3E,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,MAAA,CAAO,MAAA;AAAA,UACd,KAAA,EAAO,IAAA,EAAM,KAAA,IAAS,MAAA,CAAO,MAAA;AAAA,UAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU;AAAA,SAC1B;AAAA,MACF;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,IAAI,EAAA,EAA0B;AAKlC,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA;AAAA,QAC7B,KAAA;AAAA,QACA,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,OACrB;AACA,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,SAAS,MAAA,EAAQ;AAC3D,QAAA,OAAQ,MAAA,CAAwB,GAAA;AAAA,MAClC;AAGA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;;;ACpJO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,eAAA,EAAiB,iBAAA;AAAA,EACjB,SAAA,EAAW,WAAA;AAAA,EACX,aAAA,EAAe,eAAA;AAAA,EACf,sBAAA,EAAwB,wBAAA;AAAA,EACxB,6BAAA,EAA+B,+BAAA;AAAA;AAAA,EAE/B,kBAAA,EAAoB,oBAAA;AAAA,EACpB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,iBAAA,EAAmB,mBAAA;AAAA,EACnB,qBAAA,EAAuB,uBAAA;AAAA;AAAA;AAAA;AAAA,EAIvB,uBAAA,EAAyB,yBAAA;AAAA,EACzB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,sBAAA,EAAwB,wBAAA;AAAA,EACxB,iCAAA,EAAmC,mCAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnC,WAAA,EAAa,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBb,YAAA,EAAc,cAAA;AAAA,EACd,mBAAA,EAAqB,qBAAA;AAAA,EACrB,sBAAA,EAAwB,wBAAA;AAAA;AAAA;AAAA;AAAA,EAIxB,qBAAA,EAAuB,uBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvB,oBAAA,EAAsB,sBAAA;AAAA,EACtB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,eAAA,EAAiB,iBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,mBAAA,EAAqB,qBAAA;AAAA,EACrB,oBAAA,EAAsB,sBAAA;AAAA,EACtB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,mBAAA,EAAqB,qBAAA;AAAA,EACrB,uBAAA,EAAyB,yBAAA;AAAA;AAAA,EAEzB,aAAA,EAAe,eAAA;AAAA,EACf,eAAA,EAAiB,iBAAA;AAAA,EACjB,iBAAA,EAAmB,mBAAA;AAAA,EACnB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,sBAAA,EAAwB,wBAAA;AAAA;AAAA,EAExB,oBAAA,EAAsB,sBAAA;AAAA,EACtB,4BAAA,EAA8B,8BAAA;AAAA;AAAA,EAE9B,aAAA,EAAe,eAAA;AAAA,EACf,OAAA,EAAS,SAAA;AAAA;AAAA,EAET,cAAA,EAAgB;AAClB;AAYO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,SAAA;AAAA,EAET,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,GAWI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,QAAQ,MAAA,IAAU,CAAA;AAChC,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACtC,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACtC,IAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAI/B,MAAC,IAAA,CAA6B,QAAQ,OAAA,CAAQ,KAAA;AAAA,IAChD;AAAA,EACF;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,aAAA,CAAc;AAAA,EAC9C,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,kBAAkB,aAAA,EAAe,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,OAAO,CAAA;AAAA,EAC5E;AACF;AAGO,IAAM,YAAA,GAAN,cAA2B,aAAA,CAAc;AAAA,EAC9C,WAAA,CAAY,SAAiB,SAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,iBAAA,CAAkB,SAAS,OAAA,EAAS;AAAA,MACxC,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS,EAAE,UAAA,EAAY,SAAA;AAAU,KAClC,CAAA;AAAA,EACH;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EACtD,WAAA,CAAY,OAAA,GAAU,yBAAA,EAA2B,SAAA,GAA2B,IAAA,EAAM;AAChF,IAAA,KAAA,CAAM,kBAAkB,eAAA,EAAiB,OAAA,EAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,WAAW,CAAA;AAAA,EAC9E;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAChD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,WAAW,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EACjF;AACF;AAGO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EAClD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,eAAe,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EACrF;AACF;AAOO,IAAM,sBAAA,GAAN,cAAqC,aAAA,CAAc;AAAA,EACxD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,oBAAoB,OAAA,EAAS;AAAA,MACnD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,aAAA,CAAc;AAAA,EACjD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,mBAAmB,OAAA,EAAS;AAAA,MAClD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAuBO,IAAM,uBAAA,GAAN,cAAsC,aAAA,CAAc;AAAA,EACzD,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EAC1D;AACF;AAUO,IAAM,yBAAA,GAAN,cAAwC,aAAA,CAAc;AAAA,EAC3D,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,wBAAwB,OAAA,EAAS;AAAA,MACvD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAWO,IAAM,kCAAA,GAAN,cAAiD,aAAA,CAAc;AAAA,EACpE,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,mCAAmC,OAAA,EAAS;AAAA,MAClE,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAwBO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,kBAAA,EAAoB,oBAAA;AAAA,EACpB,2BAAA,EAA6B,6BAAA;AAAA,EAC7B,+BAAA,EAAiC,iCAAA;AAAA,EACjC,eAAA,EAAiB,iBAAA;AAAA,EACjB,eAAA,EAAiB,iBAAA;AAAA,EACjB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,uBAAA,EAAyB,yBAAA;AAAA,EACzB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,+BAAA,EAAiC,iCAAA;AAAA,EACjC,oBAAA,EAAsB;AACxB;AA6CO,IAAM,eAAA,GAAN,cAA8B,aAAA,CAAc;AAAA,EACjD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,aAAa,OAAA,EAAS;AAAA,MAC5C,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,QAAA,GAA+B;AACjC,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,QAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,KAAA,GAA4B;AAC9B,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,KAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAA,GAA6B;AAC/B,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,MAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AACF;AAsCO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,aAAA,EAAe,eAAA;AAAA,EACf,eAAA,EAAiB,iBAAA;AAAA,EACjB,QAAA,EAAU,UAAA;AAAA,EACV,aAAA,EAAe,eAAA;AAAA,EACf,2BAAA,EAA6B,6BAAA;AAAA,EAC7B,gBAAA,EAAkB;AACpB;AAwCO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EAClD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,cAAc,OAAA,EAAS;AAAA,MAC7C,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,QAAA,GAA+B;AACjC,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,SAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAA,GAA6B;AAC/B,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,MAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AACF;AAcO,IAAM,qBAAA,GAAN,cAAoC,aAAA,CAAc;AAAA,EACvD,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,qBAAqB,OAAA,EAAS;AAAA,MACpD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,IAAI,QAAA,GAA+B;AACjC,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,SAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,EAAA,GAAyB;AAC3B,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,EAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AACF;AAeO,IAAM,yBAAA,GAAN,cAAwC,aAAA,CAAc;AAAA,EAC3D,WAAA,CACE,OAAA,EACA,OAAA,EACA,SAAA,GAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,iBAAA,CAAkB,wBAAwB,OAAA,EAAS;AAAA,MACvD,MAAA,EAAQ,GAAA;AAAA,MACR,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,IAAI,QAAA,GAA+B;AACjC,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,SAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,KAAA,GAA4B;AAC9B,IAAA,MAAM,CAAA,GAAI,KAAK,OAAA,EAAS,KAAA;AACxB,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AAAA,EACrC;AACF;AAgCO,IAAM,SAAA,GAAN,cAAwB,aAAA,CAAc;AAAA,EAC3C,WAAA,CACE,IAAA,EACA,OAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,WAAW,CAAA;AAAA,EAC1D;AACF;AAqCO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAChD,YACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,EACA,YAA2B,IAAA,EAC3B;AACA,IAAA,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,MACnB,MAAA;AAAA,MACA,SAAA,EAAW,SAAS,iBAAA,CAAkB,mBAAA;AAAA,MACtC,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAA;AAyBO,SAAS,mBAAA,CACd,MAAA,EACA,QAAA,EACA,SAAA,GAA2B,IAAA,EACZ;AACf,EAAA,MAAM,IAAA,GAAO,QAAA,EAAU,IAAA,IAAQ,cAAA,CAAe,MAAM,CAAA;AACpD,EAAA,MAAM,OAAA,GAAU,QAAA,EAAU,OAAA,IAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA;AACnD,EAAA,MAAM,UAAU,QAAA,EAAU,OAAA;AAE1B,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,iBAAA,CAAkB,eAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,aAAA;AACrB,MAAA,OAAO,IAAI,oBAAA,CAAqB,OAAA,EAAS,SAAS,CAAA;AAAA,IACpD,KAAK,iBAAA,CAAkB,SAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACvD,KAAK,iBAAA,CAAkB,aAAA;AACrB,MAAA,OAAO,IAAI,gBAAA,CAAiB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACzD,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,iBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,sBAAA,CAAuB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAC/D,KAAK,iBAAA,CAAkB,iBAAA;AACrB,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACxD,KAAK,iBAAA,CAAkB,uBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,uBAAA,CAAwB,IAAA,EAAM,OAAA,EAAS,SAAS,SAAS,CAAA;AAAA,IACtE,KAAK,iBAAA,CAAkB,sBAAA;AACrB,MAAA,OAAO,IAAI,yBAAA,CAA0B,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,iCAAA;AACrB,MAAA,OAAO,IAAI,kCAAA,CAAmC,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAC3E,KAAK,iBAAA,CAAkB,WAAA;AACrB,MAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACxD,KAAK,iBAAA,CAAkB,YAAA;AACrB,MAAA,OAAO,IAAI,gBAAA,CAAiB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IACzD,KAAK,iBAAA,CAAkB,mBAAA;AACrB,MAAA,OAAO,IAAI,qBAAA,CAAsB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAC9D,KAAK,iBAAA,CAAkB,sBAAA;AACrB,MAAA,OAAO,IAAI,yBAAA,CAA0B,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,oBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,gBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,eAAA;AAAA;AAAA;AAAA;AAAA,IAIvB,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,SAAA,CAAU,IAAA,EAAM,OAAA,EAAS,SAAS,SAAS,CAAA;AAAA,IACxD,KAAK,iBAAA,CAAkB,kBAAA;AAAA,IACvB,KAAK,iBAAA,CAAkB,mBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,oBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,qBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,mBAAA;AACrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE,KAAK,iBAAA,CAAkB,uBAAA;AAMrB,MAAA,OAAO,IAAI,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,SAAS,SAAS,CAAA;AAAA,IAClE;AACE,MAAA,OAAO,IAAI,aAAA,CAAc,IAAA,EAAM,OAAA,EAAS;AAAA,QACtC,MAAA;AAAA,QACA,SAAA,EAAW,UAAU,SAAA,IAAa,KAAA;AAAA,QAClC,OAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA;AAEP;AAEA,SAAS,eAAe,MAAA,EAAwB;AAC9C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,eAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,SAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,GAAA,EAAK,OAAO,iBAAA,CAAkB,aAAA;AAC7C,EAAA,IAAI,MAAA,IAAU,GAAA,EAAK,OAAO,iBAAA,CAAkB,cAAA;AAC5C,EAAA,OAAO,YAAA;AACT;;;ACrxBA,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,+BAAA,GAAkC,GAAA;AACxC,IAAM,cAAA,GAAiB,MAAA;AACvB,IAAM,aAAA,GAAgB,MAAA;AAGtB,IAAM,iBAAA,GAAoB,iBAAA;AAY1B,SAAS,aAAa,MAAA,EAAoC;AACxD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AACjD,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,EAAG,iBAAiB,CAAA,CAAA;AACvC;AAEA,SAAS,aAAa,MAAA,EAA0C;AAC9D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,OAAO,UAAA,CAAW,KAAA,KAAU,UAAA,EAAY;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,UAAA,CAAW,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AACzC;AASA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,OAAO,MAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACvD,EAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAE7C,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAI,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,WAAW,MAAA,EAAqC;AAK9D,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,CAAO,MAAA,IAAU,OAAO,OAAO,CAAA;AACzD,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACzC,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AACtC,EAAA,MAAM,aAAA,GAAwC;AAAA,IAC5C,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,MAAA,CAAO,OAAA,IAAW;AAAC,GACzB;AAKA,EAAA,MAAM,cAAc,MAAA,CAAO,WAAA;AAC3B,EAAA,MAAM,oBAAA,GACJ,OAAO,oBAAA,IAAwB,+BAAA;AAUjC,EAAA,SAAS,mBAAmB,IAAA,EAA2B;AACrD,IAAA,IAAI,CAAC,WAAA,EAAa;AAClB,IAAA,IAAI,IAAA,CAAK,cAAc,oBAAA,EAAsB;AAC7C,IAAA,IAAI;AACF,MAAA,WAAA,CAAY,IAAI,CAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,eAAe,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA4B;AAClF,IAAA,MAAM,iBAAiB,CAAA,CAAA,EAAI,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAC,CAAA,CAAA;AAM1D,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,EAAG,cAAc,CAAA,CAAA;AAUpC,IAAA,MAAM,KAAA,GAAA,CACH,OAAO,QAAA,GAAW,MAAM,OAAO,QAAA,EAAS,GAAI,IAAA,KAAS,MAAA,CAAO,MAAA,IAAU,IAAA;AAEzE,IAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,aAAA,EAAc;AAC3D,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IAC5B;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,IAC5C;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAM5D,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AAEvB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,QAAQ,GAAA,EAAK;AAAA,QACvB,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAMA,WAAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAChC,MAAA,IAAI,YAAA,CAAa,GAAG,CAAA,EAAG;AACrB,QAAA,kBAAA,CAAmB;AAAA,UACjB,MAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,UAAA,EAAAA,WAAAA;AAAA,UACA,MAAA,EAAQ,CAAA;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,SAAA,EAAW;AAAA,SACZ,CAAA;AACD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,WAAA,EAAc,MAAM,CAAA,CAAA,EAAI,cAAc,cAAc,SAAS,CAAA;AAAA,MACtF;AACA,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA,EAAAA,WAAAA;AAAA,QACA,MAAA,EAAQ,CAAA;AAAA,QACR,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AACD,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,sBAAsB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,EAAA,EAAK,aAAA,CAAc,GAAG,CAAC,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAElB,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAUhC,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEhD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,KAAA;AAAA,QACT;AAAA,OACD,CAAA;AACD,MAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AAC/C,MAAA,MAAM,mBAAA,CAAoB,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,SAAS,CAAA;AAAA,IAC3D;AAEA,IAAA,kBAAA,CAAmB;AAAA,MACjB,MAAA;AAAA,MACA,IAAA,EAAM,cAAA;AAAA,MACN,UAAA;AAAA,MACA,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,OAAA,EAAS,IAAA;AAAA,MACT;AAAA,KACD,CAAA;AAKD,IAAA,OAAO,MAAA;AAAA,EACT;AAWA,EAAA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,MAAA,EACmB;AACnB,IAAA,MAAM,iBAAiB,CAAA,CAAA,EAAI,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAC,CAAA,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,EAAG,cAAc,CAAA,CAAA;AACpC,IAAA,MAAM,QAAQ,MAAA,CAAO,QAAA,GAAW,MAAM,MAAA,CAAO,UAAS,GAAI,IAAA;AAE1D,IAAA,MAAM,OAAA,GAAkC,EAAE,GAAG,aAAA,EAAc;AAC3D,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IAC5B;AACA,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA;AAAA,IAC5C;AAIA,IAAA,MAAM,iBAAA,GAAoB,IAAI,eAAA,EAAgB;AAC9C,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,iBAAA,CAAkB,KAAA,IAAS,SAAS,CAAA;AACnE,IAAA,MAAM,kBAAA,GAAqB,IAAI,eAAA,EAAgB;AAC/C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,MAAA,CAAO,OAAA,EAAS,kBAAA,CAAmB,KAAA,EAAM;AAAA,WACxC,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,MAAM,kBAAA,CAAmB,OAAM,EAAG,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,IACxF;AACA,IAAA,iBAAA,CAAkB,MAAA,CAAO,gBAAA;AAAA,MACvB,OAAA;AAAA,MACA,MAAM,mBAAmB,KAAA,EAAM;AAAA,MAC/B,EAAE,MAAM,IAAA;AAAK,KACf;AAOA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,QAAQ,GAAA,EAAK;AAAA,QACvB,MAAA;AAAA,QACA,OAAA;AAAA,QACA,MAAM,IAAA,KAAS,KAAA,CAAA,GAAY,KAAA,CAAA,GAAY,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,QAC1D,QAAQ,kBAAA,CAAmB;AAAA,OAC5B,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAChC,MAAA,IAAI,YAAA,CAAa,GAAG,CAAA,EAAG;AACrB,QAAA,kBAAA,CAAmB;AAAA,UACjB,MAAA;AAAA,UACA,IAAA,EAAM,cAAA;AAAA,UACN,UAAA;AAAA,UACA,MAAA,EAAQ,CAAA;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,SAAA,EAAW;AAAA,SACZ,CAAA;AAID,QAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,UAAA,MAAM,CAAA,GAAI,IAAI,KAAA,CAAM,mBAAmB,CAAA;AACvC,UAAA,CAAA,CAAE,IAAA,GAAO,YAAA;AACT,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,qBAAA,EAAwB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,iCAAA,CAAA;AAAA,UAChD;AAAA,SACF;AAAA,MACF;AACA,MAAA,kBAAA,CAAmB;AAAA,QACjB,MAAA;AAAA,QACA,IAAA,EAAM,cAAA;AAAA,QACN,UAAA;AAAA,QACA,MAAA,EAAQ,CAAA;AAAA,QACR,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW;AAAA,OACZ,CAAA;AACD,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,sBAAsB,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,EAAA,EAAK,aAAA,CAAc,GAAG,CAAC,CAAA,CAAA;AAAA,QACrE;AAAA,OACF;AAAA,IACF;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAElB,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,IAAA,kBAAA,CAAmB;AAAA,MACjB,MAAA;AAAA,MACA,IAAA,EAAM,cAAA;AAAA,MACN,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,MACzB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAS,GAAA,CAAI,EAAA;AAAA,MACb;AAAA,KACD,CAAA;AAKD,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAE,SAAS,SAAA,EAAU;AAC9B;AAIA,SAAS,aAAa,GAAA,EAAuB;AAC3C,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,YAAA,IAAgB,CAAA,CAAE,IAAA,KAAS,WAAA;AAC/C;AAEA,SAAS,cAAc,GAAA,EAAsB;AAC3C,EAAA,IAAI,GAAA,YAAe,KAAA,EAAO,OAAO,GAAA,CAAI,OAAA;AACrC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,GAAA;AACpC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,iBAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAA,EAKlB;AACA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,CAAA,GAAI,KAAA;AAGV,EAAA,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,OAAO,EAAE,OAAA,KAAY,QAAA;AAC5D;;;ACnXO,SAAS,aAAa,MAAA,EAA8B;AACzD,EAAA,MAAM,SAAA,GAAY,WAAW,MAAM,CAAA;AACnC,EAAA,OAAO;AAAA,IACL,GAIE,SAAA,EAAqD;AACrD,MAAAC,sBAAqB,SAAS,CAAA;AAC9B,MAAA,OAAO,eAAA,CAAqC,WAAW,SAAS,CAAA;AAAA,IAClE,CAAA;AAAA,IAEA,KAAK,YAAA,EAA4B;AAI/B,MAAA,OAAO,QAAA,CAAS,WAAW,YAAY,CAAA;AAAA,IACzC,CAAA;AAAA,IAEA,OAAA,EAAS,kBAAkB,SAAS,CAAA;AAAA,IAEpC,OAAA,CAAqB,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA4B;AAC7E,MAAA,OAAO,SAAA,CAAU,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAChD,CAAA;AAAA,IAEA,SAAA,CACE,MAAA,EACA,IAAA,EACA,IAAA,EACA,MAAA,EACmB;AACnB,MAAA,OAAO,SAAA,CAAU,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,MAAM,MAAM,CAAA;AAAA,IACvD,CAAA;AAAA,IAEA,MAAM,WAAA,CACJ,YAAA,EACA,UAAA,EACA,OACA,IAAA,EACkB;AAClB,MAAA,qBAAA,CAAsB,YAAY,CAAA;AAClC,MAAA,qBAAA,CAAsB,UAAU,CAAA;AAMhC,MAAA,MAAM,IAAA,GACJ,SAAS,kBAAA,CAAmB,YAAY,CAAC,CAAA,SAAA,EAAY,kBAAA,CAAmB,UAAU,CAAC,CAAA,CAAA;AACrF,MAAA,MAAM,IAAA,GAAgC,EAAE,KAAA,EAAM;AAC9C,MAAA,IAAI,IAAA,EAAM,mBAAmB,MAAA,EAAW;AACtC,QAAA,IAAA,CAAK,kBAAkB,IAAA,CAAK,cAAA;AAAA,MAC9B;AACA,MAAA,IAAI,IAAA,EAAM,cAAc,MAAA,EAAW;AACjC,QAAA,IAAA,CAAK,aAAa,IAAA,CAAK,SAAA;AAAA,MACzB;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,OAAA;AAAA,QAC/B,MAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAMA,MAAA,IAAI,QAAA,CAAS,OAAO,KAAA,EAAO;AACzB,QAAA,MAAM,SAAA,GAAY,QAAA,CAAS,YAAA,EAAc,UAAA,IAAc,IAAA;AACvD,QAAA,MAAM,mBAAA;AAAA,UACJ,GAAA;AAAA,UACA;AAAA,YACE,IAAA,EAAM,SAAS,KAAA,CAAM,IAAA;AAAA,YACrB,OAAA,EAAS,SAAS,KAAA,CAAM,OAAA;AAAA,YACxB,OAAA,EAAS,SAAS,KAAA,CAAM,KAAA,GACpB,EAAE,KAAA,EAAO,QAAA,CAAS,KAAA,CAAM,KAAA,EAAM,GAC9B;AAAA,WACN;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IAClB;AAAA,GACF;AACF;AA4BA,IAAM,iBAAA,GAAoB,iCAAA;AAC1B,IAAMC,kBAAAA,GAAoB,2BAAA;AAE1B,SAAS,sBAAsB,IAAA,EAAoB;AACjD,EAAA,IAAI,CAACA,kBAAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iCAAiC,IAAI,CAAA,wDAAA;AAAA,KACvC;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,IAAA,EAAoB;AACjD,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wBAAwB,IAAI,CAAA,iGAAA;AAAA,KAC9B;AAAA,EACF;AACF;AAOA,IAAMC,iBAAAA,GAAmB,mBAAA;AAEzB,SAASF,sBAAqB,IAAA,EAAoB;AAChD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAACE,iBAAAA,CAAiB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC5D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oCAAoC,IAAI,CAAA,wCAAA;AAAA,KAC1C;AAAA,EACF;AACF;AASA,SAAS,kBAAkB,SAAA,EAAyC;AAClE,EAAA,OAAO;AAAA,IACL,MACE,OAAA,EACyB;AACzB,MAAA,kBAAA,CAAmB,OAAO,CAAA;AAC1B,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA,KAAA,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,MAAM,KACJ,IAAA,EAC4B;AAQ5B,UAAA,MAAM,GAAA,GAAM,IAAA;AAIZ,UAAA,MAAM,IAAA,GAA2C,iBAAA;AAAA,YAC/C;AAAA,WACF,GACI,sBAAA,CAAuB,GAAG,CAAA,GAC1B,GAAA;AACJ,UAAA,MAAM,KAAK,IAAA,GAAO,IAAI,gBAAgB,IAAI,CAAA,CAAE,UAAS,GAAI,EAAA;AACzD,UAAA,MAAM,OAAO,EAAA,GAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,IAAA;AACpC,UAAA,OAAO,SAAA,CAAU,OAAA,CAA2B,KAAA,EAAO,IAAI,CAAA;AAAA,QACzD,CAAA;AAAA,QACA,MAAM,IAAI,KAAA,EAAiD;AACzD,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,KAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA;AAAA,WAClB;AAAA,QACF,CAAA;AAAA,QACA,MAAM,OACJ,IAAA,EACkC;AAClC,UAAA,OAAO,SAAA,CAAU,OAAA,CAAiC,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,QACtE,CAAA;AAAA,QACA,MAAM,MAAA,CACJ,KAAA,EACA,IAAA,EACkC;AAClC,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,OAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAAA,YAChB;AAAA,WACF;AAAA,QACF,CAAA;AAAA,QACA,MAAM,OAAO,KAAA,EAA2C;AACtD,UAAA,OAAO,SAAA,CAAU,OAAA;AAAA,YACf,QAAA;AAAA,YACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA;AAAA,WAClB;AAAA,QACF;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,mBAAmB,OAAA,EAAuB;AACjD,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2CAA2C,OAAO,CAAA,8BAAA;AAAA,KACpD;AAAA,EACF;AACF;AASA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,QAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQD,IAAM,oCAAoB,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAI,CAAC,CAAA;AAE/C,SAAS,kBACP,IAAA,EACkC;AAClC,EAAA,IAAI,SAAS,MAAA,IAAa,IAAA,KAAS,IAAA,IAAQ,OAAO,SAAS,QAAA,EAAU;AACnE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,qBAAA,CAAsB,GAAA,CAAI,CAAC,CAAC,CAAA;AACnE;AAgBA,SAAS,uBAAuB,IAAA,EAAwD;AACtF,EAAA,MAAM,MAA8B,EAAC;AAErC,EAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAW;AAC7B,IAAA,MAAM,QAAQ,IAAA,CAAK,MAAA;AACnB,IAAA,IAAI,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAO5B,MAAA,GAAA,CAAI,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,IACxD,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAClD,QAAA,IAAI,UAAU,MAAA,EAAW;AACzB,QAAA,IAAI,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAE5B,UAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACjD,YAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,YAAA,GAAA,CAAI,WAAW,KAAK,CAAA,EAAA,EAAK,EAAE,CAAA,CAAE,CAAA,GAAI,qBAAqB,OAAO,CAAA;AAAA,UAC/D;AAAA,QACF,CAAA,MAAO;AAEL,UAAA,GAAA,CAAI,CAAA,QAAA,EAAW,KAAK,CAAA,OAAA,CAAS,CAAA,GAAI,qBAAqB,KAAK,CAAA;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AACnD,IAAA,GAAA,CAAI,QAAA,GAAW,KAAK,IAAA,CACjB,GAAA;AAAA,MAAI,CAAC,MACJ,CAAA,CAAE,GAAA,KAAQ,SAAS,CAAA,CAAA,EAAI,CAAA,CAAE,KAAK,CAAA,CAAA,GAAK,CAAA,CAAE;AAAA,KACvC,CACC,KAAK,GAAG,CAAA;AAAA,EACb;AAEA,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,SAAS,IAAA,CAAK,MAAA;AACjD,EAAA,IAAI,OAAO,KAAK,KAAA,KAAU,QAAA,MAAc,IAAA,GAAO,MAAA,CAAO,KAAK,KAAK,CAAA;AAChE,EAAA,IAAI,OAAO,KAAK,IAAA,KAAS,QAAA,MAAc,IAAA,GAAO,MAAA,CAAO,KAAK,IAAI,CAAA;AAO9D,EAAA,IACE,IAAA,CAAK,WAAW,MAAA,IACf,IAAA,CAAK,SAAS,MAAA,IAAa,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,CAAA,EAC/C;AACA,IAAA,GAAA,CAAI,gBAAA,GAAmB,MAAA;AAAA,EACzB;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,kBAAkB,KAAA,EAAgD;AACzE,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA,CAAkB,GAAA,CAAI,CAAC,CAAC,CAAA;AAChE;AAgBA,SAAS,kBAAkB,IAAA,EAAwC;AACjE,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA,CAAkB,GAAA,CAAI,CAAC,CAAC,CAAA;AAC/D;AAGA,SAAS,YAAY,IAAA,EAAoD;AACvE,EAAA,MAAM,SAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AACjD,IAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,KAAK,CAAA,IAAK,UAAU,MAAA,EAAW;AACzD,IAAA,IAAI,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACjD,QAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,EAAM,IAAI,KAAA,EAAO,oBAAA,CAAqB,OAAO,CAAA,EAAG,CAAA;AAAA,MACvE;AAAA,IACF,CAAA,MAAO;AAEL,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,EAAM,SAAS,KAAA,EAAO,oBAAA,CAAqB,KAAK,CAAA,EAAG,CAAA;AAAA,IAC1E;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,kBAAA,CACP,KAAA,EACA,WAAA,GAA4B,KAAA,EACT;AACnB,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA,CAAkB,GAAA,CAAI,CAAC,CAAC,CAAA;AAItE,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,QAAA,GAAY,GAAA,CAAI,QAAQ,CAAA,IAA0C,EAAC;AACzE,IAAA,MAAM,UAA+B,EAAC;AACtC,IAAA,MAAM,gBAAqC,EAAC;AAC5C,IAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,MAAA,MAAM,QAAA,GAAW,KAAA;AACjB,MAAA,IAAI,iBAAA,CAAkB,QAAQ,CAAA,EAAG;AAC/B,QAAA,aAAA,CAAc,IAAA,CAAK,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,MAC9C,CAAA,MAAO;AACL,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,WAAA,CAAY,QAAQ,CAAC,CAAA;AAAA,MACvC;AAAA,IACF;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,QAAA,EAAU,OAAA,EAAS,aAAA,EAAc;AAAA,EACzD;AAEA,EAAA,OAAO,EAAE,aAAa,WAAA,EAAa,OAAA,EAAS,YAAY,GAAG,CAAA,EAAG,aAAA,EAAe,EAAC,EAAE;AAClF;AAUA,SAAS,kBAAkB,KAAA,EAAkD;AAC3E,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACV,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAExB;AAEA,SAAS,qBAAqB,KAAA,EAAwB;AAIpD,EAAA,IAAI,KAAA,KAAU,MAAM,OAAO,EAAA;AAC3B,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAEA,SAAS,eAAA,CAIP,WAA0B,SAAA,EAAqD;AAC/E,EAAA,MAAM,IAAA,GAAO,OAAO,SAAS,CAAA,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,IAAA,EAA0C;AAmBnD,MAAA,MAAM,GAAA,GAA+B;AAAA,QACnC,CAAA,EAAG,CAAA;AAAA,QACH,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,OACzC;AACA,MAAA,IAAI,IAAA,EAAM,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,QAAQ,IAAA,CAAK,MAAA;AACjD,MAAA,IAAI,MAAM,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AACpD,QAAA,GAAA,CAAI,UAAU,IAAA,CAAK,IAAA;AAAA,MACrB;AACA,MAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,EAAU,GAAA,CAAI,QAAQ,IAAA,CAAK,KAAA;AACtD,MAAA,IAAI,OAAO,IAAA,EAAM,MAAA,KAAW,QAAA,EAAU,GAAA,CAAI,SAAS,IAAA,CAAK,MAAA;AAExD,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,CAAmB,QAAQ,QAAA,EAAU,EAAE,KAAK,CAAA;AAK3E,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,QAAA,OAAO;AAAA,UACL,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,MAAA,CAAO,MAAA;AAAA,UACd,KAAA,EAAO,IAAA,EAAM,KAAA,IAAS,MAAA,CAAO,MAAA;AAAA,UAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU;AAAA,SAC1B;AAAA,MACF;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,IAAI,EAAA,EAA0B;AAClC,MAAA,OAAO,UAAU,OAAA,CAAa,KAAA,EAAO,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA;AAAA,IAEA,MAAM,OAAO,IAAA,EAA4B;AACvC,MAAA,OAAO,SAAA,CAAU,OAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,EAAA,EAAY,KAAA,EAA6B;AACpD,MAAA,OAAO,SAAA,CAAU,QAAa,OAAA,EAAS,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,KAAK,CAAA;AAAA,IAC/D,CAAA;AAAA,IAEA,MAAM,OAAO,EAAA,EAA2B;AACtC,MAAA,MAAM,UAAU,OAAA,CAAc,QAAA,EAAU,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IACzD;AAAA,GACF;AACF;;;ACxZO,SAAS,eAAA,CAAgB,SAAA,GAAoC,EAAC,EAAW;AAC9E,EAAA,MAAM,aAAa,iBAAA,EAAkB;AAErC,EAAA,MAAM,UACJ,SAAA,CAAU,OAAA,IACV,QAAQ,kBAAkB,CAAA,IAC1B,YAAY,MAAA,IACZ,IAAA;AACF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AAYA,EAAA,MAAM,cAAc,SAAA,CAAU,UAAA,GAC1B,YAAY,OAAA,GAAU,SAAA,CAAU,UAAU,CAAA,GAC1C,MAAA;AACJ,EAAA,MAAM,cAAA,GACJ,WAAA,EAAa,MAAA,IAAU,WAAA,EAAa,YAAA,IAAgB,IAAA;AAatD,EAAA,MAAM,gBACJ,cAAA,IACA,OAAA,CAAQ,kBAAkB,CAAA,IAC1B,YAAY,KAAA,IACZ,IAAA;AACF,EAAA,MAAM,gBAAA,GACJ,SAAA,CAAU,QAAA,KAAa,MAAM,aAAA,CAAA;AAE/B,EAAA,OAAO,YAAA,CAAa;AAAA,IAClB,GAAG,SAAA;AAAA,IACH,OAAA;AAAA,IACA,QAAA,EAAU;AAAA,GACX,CAAA;AACH;AAgDA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,CAAC,OAAA,CAAQ,KAAK,OAAO,MAAA;AAC3D,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,IAAI,CAAA,GAAI,MAAA;AACrD;AAOA,SAAS,aAAA,GAAyB;AAChC,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,KAAA;AAC3C,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,OAAO,OAAA,CAAQ,QAAA,CAAS,SAAS,QAAA,EAAU;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAkBA,SAAS,iBAAA,GAA+C;AACtD,EAAA,IAAI,CAAC,aAAA,EAAc,EAAG,OAAO,IAAA;AAC7B,EAAA,IAAI,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA,EAAc,OAAO,IAAA;AACjD,EAAA,IAAI;AAMF,IAAA,MAAM,EAAA,GAAK,UAAQ,IAAS,CAAA;AAE5B,IAAA,MAAM,IAAA,GAAO,UAAQ,MAAW,CAAA;AAEhC,IAAA,MAAM,EAAA,GAAK,UAAQ,IAAS,CAAA;AAE5B,IAAA,MAAM,GAAA,GAAM,gBAAA,CAAiB,IAAA,EAAM,EAAE,CAAA;AACrC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,WAAW,CAAA;AACvC,IAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,IAAI,GAAG,OAAO,IAAA;AAEjC,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACzC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,CAAC,oBAAA,CAAqB,MAAM,CAAA,EAAG,OAAO,IAAA;AAC1C,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAMN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,SAAS,gBAAA,CACP,MACA,EAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,QAAQ,iBAAiB,CAAA;AACrC,EAAA,IAAI,GAAA,EAAK,OAAO,IAAA,CAAK,IAAA,CAAK,KAAK,UAAU,CAAA;AACzC,EAAA,IAAI,EAAA,CAAG,QAAA,EAAS,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,OAAA,GAAU,QAAQ,SAAS,CAAA;AACjC,IAAA,IAAI,OAAA,EAAS,OAAO,IAAA,CAAK,IAAA,CAAK,SAAS,UAAU,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,EAAA,CAAG,OAAA,EAAQ,EAAG,WAAW,UAAU,CAAA;AACtD;AAEA,SAAS,qBAAqB,CAAA,EAAqC;AACjE,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,KAAA;AACxC,EAAA,MAAM,CAAA,GAAI,CAAA;AAWV,EAAA,MAAM,WAAW,CAAA,CAAE,MAAA,KAAW,MAAA,IAAa,OAAO,EAAE,MAAA,KAAW,QAAA;AAC/D,EAAA,MAAM,UAAU,CAAA,CAAE,KAAA,KAAU,MAAA,IAAa,OAAO,EAAE,KAAA,KAAU,QAAA;AAC5D,EAAA,MAAM,SAAA,GACJ,EAAE,OAAA,KAAY,MAAA,IACb,OAAO,CAAA,CAAE,OAAA,KAAY,QAAA,IAAY,CAAA,CAAE,OAAA,KAAY,IAAA;AAClD,EAAA,OAAO,YAAY,OAAA,IAAW,SAAA;AAChC;;;ACxTO,IAAM,OAAA,GAC2B,OAAA","file":"index.cjs","sourcesContent":["/**\n * Borrowed-table accessor: `client.deps(providerSlug).db<Row>(tableSlug)`.\n *\n * Phase 1 of the SDK query plane — see\n * `dashwise-devops-docs/plans/modules-sdk-query-v1.md` §6.2.\n *\n * The factory is intentionally a thin wrapper around the existing\n * {@link HttpTransport}. Phase 2 wire protocol (contract W1) split the\n * cross-module read surface by verb:\n *\n *   - `.list()` compiles to a Query AST with a `dep` table ref and posts\n *     to the unified `/query` endpoint — EXACTLY mirroring the owned-\n *     table client (which also routes `.list()` through `/query`). The\n *     backend's `executeDep` resolves the consumer's declared-dep\n *     contract + field projection and returns the same {@link Page}\n *     envelope owned-table reads produce. No filter/sort/pagination\n *     serialization lives here — the AST carries it, the backend\n *     translates it, so there is a single source of truth for query\n *     semantics.\n *   - `.get(id)` hits the REST route `GET /deps/<provider>/tables/<table>/<id>`\n *     (the query plane has no by-id representation). The backend returns\n *     a `{ row, fields }` envelope; we unwrap `.row`.\n *\n * Same {@link DashwiseError} model on both paths — the contract error\n * codes (`DEPENDENCY_NOT_DECLARED`, `TABLE_NOT_IN_CONTRACT`,\n * `PROVIDER_TABLE_MISSING`, `OPERATION_NOT_ALLOWED_BY_PROVIDER`) surface\n * identically whether they come back from `/query` or `/deps/.../tables/...`.\n * No new transport, no new auth flow, no new caching.\n *\n * Cross-module **writes** are deliberately omitted: the returned\n * {@link ReadOnlyTableClient} has no `create` / `update` / `delete`.\n * See plan §4.3 — writes flow through provider-published actions in\n * a later phase, never as direct mutations across the trust boundary.\n *\n * Slug validation runs client-side as a fail-fast check so a typo\n * doesn't reach the backend as a 404 from a malformed URL. The\n * authoritative check is server-side: the backend re-validates\n * provider existence + contract coverage on every call.\n */\n\nimport type { HttpTransport } from './http.js';\nimport type {\n  BaseRow,\n  Deps,\n  ListOpts,\n  Page,\n  ReadOnlyTableClient,\n} from './types.js';\n\n/**\n * Module-slug character set matches the backend manifest validator's\n * `MODULE_SLUG_REGEX` exactly: kebab-case, 2-63 chars, starts with a\n * letter, ends with letter/digit, no leading/trailing dash.\n *\n * Mirrored here (not imported from the backend) because the SDK is\n * published independently — pulling backend code in would couple\n * release cycles. If the backend's regex changes, the SDK's mirror\n * must update in lockstep; covered by an integration test.\n */\nconst MODULE_SLUG_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;\n\n/**\n * Table-slug character set matches the backend's `SLUG_REGEX`: snake_case,\n * 2-63 chars, starts with a letter, ends with letter/digit. Same\n * mirror-vs-import tradeoff as {@link MODULE_SLUG_REGEX}.\n */\nconst TABLE_SLUG_REGEX = /^[a-z][a-z0-9_]*[a-z0-9]$/;\n\nfunction assertValidProviderSlug(slug: string): void {\n  if (typeof slug !== 'string' || !MODULE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid provider slug \"${slug}\". Provider slugs are the dependency module's slug (kebab-case, e.g. \"crm-app\"); must match /^[a-z][a-z0-9-]*[a-z0-9]$/.`,\n    );\n  }\n}\n\nfunction assertValidTableSlug(slug: string): void {\n  if (typeof slug !== 'string' || !TABLE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid table slug \"${slug}\". Table slugs must match /^[a-z][a-z0-9_]*[a-z0-9]$/ (snake_case).`,\n    );\n  }\n}\n\n/**\n * Build a {@link Deps} accessor for `providerSlug`. Validates the\n * slug shape eagerly; defers everything else to the backend.\n *\n * Exported for use by `createClient()` in `./client.ts`. Not part\n * of the public API directly — consumers reach it via `client.deps(...)`.\n */\nexport function makeDeps(transport: HttpTransport, providerSlug: string): Deps {\n  assertValidProviderSlug(providerSlug);\n\n  return {\n    db<Row extends BaseRow>(tableSlug: string): ReadOnlyTableClient<Row> {\n      assertValidTableSlug(tableSlug);\n      return makeBorrowedTableClient<Row>(transport, providerSlug, tableSlug);\n    },\n  };\n}\n\n/**\n * Internal: produce a {@link ReadOnlyTableClient} for one specific\n * `(providerSlug, tableSlug)` pair. Closure captures the transport +\n * the provider/table slugs so the public methods are tiny.\n */\nfunction makeBorrowedTableClient<Row extends BaseRow>(\n  transport: HttpTransport,\n  providerSlug: string,\n  tableSlug: string,\n): ReadOnlyTableClient<Row> {\n  // Per-id REST route (contract W1): the full URL after the transport's\n  // `/api/module-api` base prefix is\n  // `<baseUrl>/api/module-api/deps/<provider>/tables/<table>/<id>`.\n  const tablesRoot = `/deps/${providerSlug}/tables/${tableSlug}`;\n\n  return {\n    async list(opts?: ListOpts<Row>): Promise<Page<Row>> {\n      // Phase 2 wire protocol (W1): `.list()` compiles to a Query AST\n      // with a `dep` table ref and posts to the unified `/query`\n      // endpoint — identical to how the owned-table client routes its\n      // `.list()`, only the `from` ref differs (`kind: 'dep'` +\n      // provider module slug instead of `kind: 'owned'`). The backend's\n      // `executeDep` enforces the consumer's declared-dep contract +\n      // field projection and returns the same `Page<Row>` envelope.\n      //\n      // Why route through /query instead of the REST list route: the\n      // owned-table client already made this choice, so cross-module\n      // reads inherit every query-plane improvement (observability,\n      // slow-query hooks, future caching) for free, and the filter /\n      // sort / pagination semantics have a single translation site\n      // (the backend), not a re-implementation of the Baserow\n      // query-param encoding here.\n      const ast: Record<string, unknown> = {\n        v: 1,\n        from: { kind: 'dep', module: providerSlug, slug: tableSlug },\n      };\n      if (opts?.filter !== undefined) ast.where = opts.filter;\n      if (opts?.sort !== undefined && opts.sort.length > 0) {\n        ast.orderBy = opts.sort;\n      }\n      if (typeof opts?.limit === 'number') ast.limit = opts.limit;\n      if (typeof opts?.offset === 'number') ast.offset = opts.offset;\n\n      const result = await transport.request<Page<Row>>('POST', '/query', { ast });\n      // Defence in depth: same Page-envelope coercion the owned-table\n      // client uses — if a proxy ever strips the envelope to a bare\n      // array, wrap it so the consumer always sees `{ rows, ... }`.\n      if (Array.isArray(result)) {\n        return {\n          rows: result as Row[],\n          total: result.length,\n          limit: opts?.limit ?? result.length,\n          offset: opts?.offset ?? 0,\n        };\n      }\n      return result;\n    },\n\n    async get(id: number): Promise<Row> {\n      // Contract W1: `GET /deps/<provider>/tables/<table>/<id>` returns\n      // a `{ row, fields }` envelope (the query plane has no by-id\n      // representation). Unwrap `.row` so the consumer gets the bare\n      // typed row — matching the owned-table `.get()` shape.\n      const result = await transport.request<{ row: Row } | Row>(\n        'GET',\n        `${tablesRoot}/${id}`,\n      );\n      if (result && typeof result === 'object' && 'row' in result) {\n        return (result as { row: Row }).row;\n      }\n      // Defence in depth: tolerate a bare row (proxy stripping the\n      // envelope / future shape drift), mirroring the list fallback.\n      return result as Row;\n    },\n  };\n}\n","/**\n * Error model for @dashai/sdk.\n *\n * The backend speaks a structured error envelope:\n *\n *   {\n *     \"code\": \"ROW_NOT_FOUND\",\n *     \"message\": \"Row 123 not found in tasks\",\n *     \"retriable\": false,\n *     \"context\": { ... }\n *   }\n *\n * This module wraps that envelope in a typed `DashwiseError` plus a small\n * set of subclasses for the codes consumers most commonly want to branch\n * on (network errors, auth failures, row-not-found, contract violations).\n *\n * Anything not matched by a specific subclass becomes a plain\n * `DashwiseError` carrying the raw `code`. Branch on `.code` for codes\n * we don't have a class for; use `instanceof` for the common cases.\n */\n\n/**\n * Known error codes. Not exhaustive — the backend emits many codes\n * specific to individual modules / endpoints. Use these constants when\n * you want compile-time safety; otherwise treat `err.code` as a string.\n *\n * The list is curated to the codes a module author is most likely to\n * branch on. Adding a new code here is a non-breaking change.\n */\nexport const DashwiseErrorCode = {\n  // Auth / authz\n  UNAUTHENTICATED: 'UNAUTHENTICATED',\n  FORBIDDEN: 'FORBIDDEN',\n  TOKEN_EXPIRED: 'TOKEN_EXPIRED',\n  INSTALLATION_NOT_FOUND: 'INSTALLATION_NOT_FOUND',\n  INSTALLATION_MODE_UNSUPPORTED: 'INSTALLATION_MODE_UNSUPPORTED',\n  // Contract enforcement\n  CONTRACT_VIOLATION: 'CONTRACT_VIOLATION',\n  FIELD_NOT_READABLE: 'FIELD_NOT_READABLE',\n  FILTER_OP_UNKNOWN: 'FILTER_OP_UNKNOWN',\n  OPERATION_NOT_ALLOWED: 'OPERATION_NOT_ALLOWED',\n  // Cross-module dependencies (Phase 1 of the SDK query plane —\n  // see dashwise-devops-docs/plans/modules-sdk-query-v1.md).\n  // Surfaced when reading borrowed tables via `client.deps(slug)`.\n  DEPENDENCY_NOT_DECLARED: 'DEPENDENCY_NOT_DECLARED',\n  TABLE_NOT_IN_CONTRACT: 'TABLE_NOT_IN_CONTRACT',\n  PROVIDER_TABLE_MISSING: 'PROVIDER_TABLE_MISSING',\n  OPERATION_NOT_ALLOWED_BY_PROVIDER: 'OPERATION_NOT_ALLOWED_BY_PROVIDER',\n  // Cross-module dependency PARK state (Phase 3 modules-platform-v2 —\n  // dependency connect/bind lifecycle). Surfaced at RUNTIME (409) when a\n  // module reads a borrowed table (`client.deps(slug)` / `qb.deps.<slug>`)\n  // or invokes a dep action whose `module_dependencies` row is currently\n  // `status='unbound'` — the dependency is declared but not connected to a\n  // provider installation (no provider in the workspace, version mismatch,\n  // manually unbound, provider uninstalled, etc.). The consumer app should\n  // render a \"connect your provider\" state rather than treating this as a\n  // hard failure. `err.context` carries `{ provider, range, reason }`.\n  DEP_UNBOUND: 'DEP_UNBOUND',\n  // Workspace-table `uses` plane (Phase 4 modules-platform-v2 — the\n  // declared/portable path for a module to read+write a WORKSPACE table\n  // the workspace already owns, as opposed to `deps` = another module's\n  // tables). Surfaced at RUNTIME against `client.uses(slug)` /\n  // `qb.uses.<slug>` / the `POST /api/module-api/uses/:slug/...` REST\n  // plane. The BINDING is the grant on this plane (for sandbox AND\n  // api_key auth alike — a kind-local key does NOT bypass it):\n  //   - USES_UNBOUND         409 — the `uses` slot is declared but its\n  //     `module_table_bindings` row isn't `status='bound'` (never bound,\n  //     ambiguous match, no match, table trashed, ops widened pending\n  //     re-consent, manually unbound). `err.context` carries\n  //     `{ uses_slug, reason }`. Recoverable: a workspace admin binds a\n  //     table (`dashwise bind <uses_slug>`), then the read succeeds.\n  //   - USES_OP_NOT_ALLOWED  403 — the operation isn't in the binding's\n  //     enforcement set (manifest `ops` ∩ `consented_ops`). `err.context`\n  //     carries `{ uses_slug, op }`. Fix: widen the manifest ops +\n  //     re-consent (re-bind), or the admin re-binds to consent.\n  //   - CONTRACT_FIELD_MISSING 409 — a field the binding maps no longer\n  //     exists on the physical table (schema drift). `err.context`\n  //     carries `{ uses_slug, field }`. The binding is best-effort parked\n  //     on detection; an admin re-binds to a table that has the field.\n  USES_UNBOUND: 'USES_UNBOUND',\n  USES_OP_NOT_ALLOWED: 'USES_OP_NOT_ALLOWED',\n  CONTRACT_FIELD_MISSING: 'CONTRACT_FIELD_MISSING',\n  // `uses`-plane query joins are NOT supported in v1 — a\n  // `qb.uses.<slug>.join(...)` / cross-plane join is rejected with a\n  // typed 400. (Joins WITH a uses table as a target are v2 territory.)\n  USES_JOIN_UNSUPPORTED: 'USES_JOIN_UNSUPPORTED',\n  // Query-plane joins (Phase 3 — see\n  // dashwise-devops-docs/plans/modules-sdk-query-v1-p3-execution.md).\n  // Surfaced when `.join('<slug>')` / `.leftJoin('<slug>')` can't\n  // resolve the target. Pre-declared in slice 3.1 so slice 3.2's\n  // backend translator can emit them through fromBackendEnvelope\n  // without an SDK roundtrip.\n  LINK_FIELD_NOT_FOUND: 'LINK_FIELD_NOT_FOUND',\n  NOT_A_LINK_FIELD: 'NOT_A_LINK_FIELD',\n  JOIN_NOT_LINKED: 'JOIN_NOT_LINKED',\n  // Cross-module actions (Phase 7 slice 7.3a — see\n  // dashwise-devops-docs/plans/modules-sdk-query-v1-p7-cross-module-writes.md).\n  // Surfaced when `qb.deps.<dep>.actions.<name>(input)` (generated\n  // factory) dispatches against the backend endpoint\n  // `POST /api/module-api/deps/:providerSlug/actions/:actionName`.\n  // Slice 7.2b ships the backend emitter; slice 7.3a (this slice)\n  // reserves the codes + maps them to DepActionError in the SDK.\n  ACTION_NOT_EXPOSED: 'ACTION_NOT_EXPOSED',\n  ACTION_NOT_DECLARED: 'ACTION_NOT_DECLARED',\n  ACTION_INPUT_INVALID: 'ACTION_INPUT_INVALID',\n  ACTION_OUTPUT_INVALID: 'ACTION_OUTPUT_INVALID',\n  ACTION_RATE_LIMITED: 'ACTION_RATE_LIMITED',\n  ACTION_EXECUTION_FAILED: 'ACTION_EXECUTION_FAILED',\n  // Data plane\n  ROW_NOT_FOUND: 'ROW_NOT_FOUND',\n  TABLE_NOT_FOUND: 'TABLE_NOT_FOUND',\n  VALIDATION_FAILED: 'VALIDATION_FAILED',\n  ROW_LIMIT_EXCEEDED: 'ROW_LIMIT_EXCEEDED',\n  STORAGE_LIMIT_EXCEEDED: 'STORAGE_LIMIT_EXCEEDED',\n  // Outbound / runtime\n  OUTBOUND_NOT_ALLOWED: 'OUTBOUND_NOT_ALLOWED',\n  OUTBOUND_CONCURRENCY_LIMITED: 'OUTBOUND_CONCURRENCY_LIMITED',\n  // Transport\n  NETWORK_ERROR: 'NETWORK_ERROR',\n  TIMEOUT: 'TIMEOUT',\n  // Server\n  INTERNAL_ERROR: 'INTERNAL_ERROR',\n} as const;\n\nexport type DashwiseErrorCode = (typeof DashwiseErrorCode)[keyof typeof DashwiseErrorCode];\n\n/**\n * Base class for every error thrown by @dashai/sdk. Carries the\n * structured envelope from the backend (or a synthetic one for\n * client-side failures like network errors / timeouts).\n *\n * Always thrown — never returned as a value. The async client methods\n * `.list()` / `.get()` etc. reject with one of these on failure.\n */\nexport class DashwiseError extends Error {\n  readonly code: string;\n  readonly status: number;\n  readonly retriable: boolean;\n  readonly context: Record<string, unknown> | undefined;\n  /**\n   * Backend-issued trace anchor (Phase 6 slice 6.2, 2026-05-19).\n   * Mirrors the `x-request-id` response header. Populated whenever\n   * the backend's `RuntimeQueryController` (or any future endpoint\n   * that echoes the header) is the origin of this error. `null` when\n   * the failure is client-side (NetworkError / TimeoutError — the\n   * request never reached the server, so there's no server-issued\n   * ID to surface).\n   *\n   * Use this as a debugging trace anchor when filing a bug against a\n   * specific failed query — the matching row in `module_query_log`\n   * carries the full backend context (ast_hash, error_code,\n   * duration_ms, etc.).\n   */\n  readonly requestId: string | null;\n\n  constructor(\n    code: string,\n    message: string,\n    options: {\n      status?: number;\n      retriable?: boolean;\n      context?: Record<string, unknown>;\n      cause?: unknown;\n      /**\n       * Phase 6 slice 6.2: backend `x-request-id` response header,\n       * captured by the transport before throwing. Pass `undefined`\n       * (or omit) for client-side errors that never hit the server.\n       */\n      requestId?: string | null;\n    } = {},\n  ) {\n    super(message);\n    this.name = this.constructor.name;\n    this.code = code;\n    this.status = options.status ?? 0;\n    this.retriable = options.retriable ?? false;\n    this.context = options.context;\n    this.requestId = options.requestId ?? null;\n    if (options.cause !== undefined) {\n      // Node 18+ and modern browsers support Error.cause natively.\n      // Use a property assignment because `super({ cause })` is awkward\n      // when the base class only takes a string.\n      (this as { cause?: unknown }).cause = options.cause;\n    }\n  }\n}\n\n/** Network-level failure (DNS, connection refused, TLS, fetch threw). */\nexport class NetworkError extends DashwiseError {\n  constructor(message: string, cause?: unknown) {\n    super(DashwiseErrorCode.NETWORK_ERROR, message, { retriable: true, cause });\n  }\n}\n\n/** Request exceeded the configured timeout (`timeoutMs`). */\nexport class TimeoutError extends DashwiseError {\n  constructor(message: string, timeoutMs: number) {\n    super(DashwiseErrorCode.TIMEOUT, message, {\n      retriable: true,\n      context: { timeout_ms: timeoutMs },\n    });\n  }\n}\n\n/** 401 — token missing/invalid. */\nexport class UnauthenticatedError extends DashwiseError {\n  constructor(message = 'Authentication required', requestId: string | null = null) {\n    super(DashwiseErrorCode.UNAUTHENTICATED, message, { status: 401, requestId });\n  }\n}\n\n/** 403 — caller lacks the role/scope for this operation. */\nexport class ForbiddenError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.FORBIDDEN, message, { status: 403, context, requestId });\n  }\n}\n\n/** 404 — `GET /db/<table>/<id>` for a missing or soft-deleted row. */\nexport class RowNotFoundError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.ROW_NOT_FOUND, message, { status: 404, context, requestId });\n  }\n}\n\n/**\n * Schema-level rejection: dep contract violated, table not exposed, field\n * not readable, filter op not allowed. Covers the family of \"you asked for\n * something the manifest doesn't permit\" errors.\n */\nexport class ContractViolationError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.CONTRACT_VIOLATION, message, {\n      status: 403,\n      context,\n      requestId,\n    });\n  }\n}\n\n/** 422-ish — request body failed validation. Inspect `context` for field-level errors. */\nexport class ValidationError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.VALIDATION_FAILED, message, {\n      status: 400,\n      context,\n      requestId,\n    });\n  }\n}\n\n// ── Cross-module dependency errors ─────────────────────────────────────\n//\n// Surfaced when calling `client.deps(slug).db<Row>(table).<op>(...)`.\n// Each subclass preserves the original backend `code` (unlike the older\n// `ContractViolationError` which collapses several codes onto a single\n// `CONTRACT_VIOLATION` string — that's a known wart we don't replicate\n// in new subclasses). Branch on `instanceof` for the common cases;\n// inspect `err.code` if you need to distinguish the two contract-error\n// codes (`DEPENDENCY_NOT_DECLARED` vs `TABLE_NOT_IN_CONTRACT`).\n\n/**\n * 404 — the caller's `module.json#dependencies` doesn't declare a\n * dependency on the requested provider module, OR the declared dep\n * exists but its `reads[]` block doesn't include the requested table.\n *\n * Either way the fix is on the **caller's** side: update the manifest\n * to declare the dep / add the table to `reads[]`, then re-publish.\n *\n * Covers both `DEPENDENCY_NOT_DECLARED` and `TABLE_NOT_IN_CONTRACT` —\n * inspect `err.code` to distinguish if you need different UX per case.\n */\nexport class DependencyContractError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, { status: 404, context, requestId });\n  }\n}\n\n/**\n * 404 — the provider's physical table no longer exists. This means the\n * provider published a version that dropped the table while the\n * consumer's installation still pinned the old contract. Recovery is\n * on the **provider's** side (republish with the table) or the\n * workspace admin's (downgrade the provider, or upgrade the consumer\n * to a version whose `dependencies[]` no longer references it).\n */\nexport class ProviderTableMissingError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.PROVIDER_TABLE_MISSING, message, {\n      status: 404,\n      context,\n      requestId,\n    });\n  }\n}\n\n/**\n * 403 — the provider's `exposes.operations.<verb>.allowed` is explicitly\n * `false` for the requested verb. Distinct from `OPERATION_NOT_ALLOWED`\n * (which is the **owner's** own-table policy) — `OPERATION_NOT_ALLOWED_BY_PROVIDER`\n * is the provider opting out of letting depending modules use a verb.\n *\n * No caller-side fix; either the provider needs to flip the gate, or\n * the consumer needs to find a different way to satisfy the use case.\n */\nexport class OperationNotAllowedByProviderError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.OPERATION_NOT_ALLOWED_BY_PROVIDER, message, {\n      status: 403,\n      context,\n      requestId,\n    });\n  }\n}\n\n/**\n * The vocabulary of `unbound_reason` values a parked dependency can\n * carry, surfaced in {@link DepUnboundError.reason}. Mirrors the\n * backend's `module_dependencies.unbound_reason` enum (Phase 3\n * modules-platform-v2). Not exhaustive by design — treat `.reason` as a\n * string and branch on these constants when you want compile-time\n * safety. Adding a new reason is a non-breaking change.\n *\n * Resolve/bind-time reasons (why the dep never bound):\n *   - `MISSING_DEPENDENCY`            no install of the provider module in the workspace\n *   - `DEPENDENCY_VERSION_MISMATCH`   an install exists but its version is outside the declared range\n *   - `PROVIDER_VERSION_RECORD_MISSING` the provider's version row is gone (data-integrity edge)\n *   - `EXPOSES_MISSING`               the provider no longer exposes a table/field the dep reads\n *   - `EXPOSES_PRIVATE`               the exposed surface is `private` to the consumer\n *   - `ACTION_NOT_EXPOSED`            a declared dep action isn't exposed by the provider (Rule #11)\n *   - `PROVIDER_NOT_PRODUCTION`       kind hygiene: a production consumer can only bind a production provider\n *\n * Lifecycle reasons (the dep bound once, then got parked):\n *   - `MANUALLY_UNBOUND`              a workspace admin ran `deps unbind` / the unbind endpoint\n *   - `PROVIDER_UPGRADE_BROKE_CONTRACT` a provider upgrade (with `force`) broke this consumer's contract\n *   - `PROVIDER_UNINSTALLED`          the provider was uninstalled with `park_consumers`\n */\nexport const DepUnboundReason = {\n  MISSING_DEPENDENCY: 'MISSING_DEPENDENCY',\n  DEPENDENCY_VERSION_MISMATCH: 'DEPENDENCY_VERSION_MISMATCH',\n  PROVIDER_VERSION_RECORD_MISSING: 'PROVIDER_VERSION_RECORD_MISSING',\n  EXPOSES_MISSING: 'EXPOSES_MISSING',\n  EXPOSES_PRIVATE: 'EXPOSES_PRIVATE',\n  ACTION_NOT_EXPOSED: 'ACTION_NOT_EXPOSED',\n  PROVIDER_NOT_PRODUCTION: 'PROVIDER_NOT_PRODUCTION',\n  MANUALLY_UNBOUND: 'MANUALLY_UNBOUND',\n  PROVIDER_UPGRADE_BROKE_CONTRACT: 'PROVIDER_UPGRADE_BROKE_CONTRACT',\n  PROVIDER_UNINSTALLED: 'PROVIDER_UNINSTALLED',\n} as const;\n\nexport type DepUnboundReason =\n  (typeof DepUnboundReason)[keyof typeof DepUnboundReason];\n\n/**\n * 409 — a runtime read (borrowed-table `list` / `get`, query-plane\n * `qb.deps.<slug>.<table>`, or a cross-module action) targeted a\n * dependency whose `module_dependencies` row is `status='unbound'`\n * (Phase 3 modules-platform-v2 dependency connect lifecycle).\n *\n * \"Unbound\" means the dependency is *declared* in the consumer's\n * manifest but not *connected* to a provider installation. It happens\n * when the resolver PARKED the dep at install/apply time (no provider\n * in the workspace, version mismatch, exposes/action coverage gap) or\n * when the dependency was later parked (manually unbound, provider\n * upgrade broke the contract, provider uninstalled).\n *\n * This is a *recoverable* state, not a bug in the consumer. Catch it and\n * render a \"connect your provider\" prompt — a workspace admin resolves it\n * by installing/binding the provider (`dashwise deps bind <slug>` or the\n * `POST /api/installations/:id/dependencies/:providerSlug/bind` endpoint).\n * Once bound, the same read succeeds with no code change.\n *\n * Convenience accessors ({@link DepUnboundError.provider},\n * {@link DepUnboundError.range}, {@link DepUnboundError.reason}) read the\n * backend's `context: { provider, range, reason }` so callers don't have\n * to reach into `err.context` by hand.\n *\n * @example\n * ```ts\n * import { DepUnboundError } from '@dashai/sdk';\n *\n * try {\n *   const contacts = await client.deps('crm').db<ContactRow>('contacts').list();\n *   // …or the typed builder: await qb.deps.crm.contacts.execute();\n * } catch (err) {\n *   if (err instanceof DepUnboundError) {\n *     // Declared but not connected — show a connect-your-provider CTA.\n *     return <ConnectProvider provider={err.provider} range={err.range} reason={err.reason} />;\n *   }\n *   throw err;\n * }\n * ```\n */\nexport class DepUnboundError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.DEP_UNBOUND, message, {\n      status: 409,\n      context,\n      requestId,\n    });\n  }\n\n  /**\n   * The provider module slug the parked dependency points at (kebab-case,\n   * e.g. `crm`). Read from `context.provider`; `undefined` if the backend\n   * omitted it.\n   */\n  get provider(): string | undefined {\n    const v = this.context?.provider;\n    return typeof v === 'string' ? v : undefined;\n  }\n\n  /**\n   * The SemVer range the consumer's manifest declared for this dependency\n   * (e.g. `^1.2.0`). Read from `context.range`; `undefined` if omitted.\n   */\n  get range(): string | undefined {\n    const v = this.context?.range;\n    return typeof v === 'string' ? v : undefined;\n  }\n\n  /**\n   * Why the dependency is unbound — one of {@link DepUnboundReason} (but\n   * typed as `string` for forward-compat with reasons the backend may add).\n   * Read from `context.reason`; `undefined` if omitted.\n   */\n  get reason(): string | undefined {\n    const v = this.context?.reason;\n    return typeof v === 'string' ? v : undefined;\n  }\n}\n\n// ── Workspace-table `uses` errors (Phase 4 modules-platform-v2) ────────\n//\n// The `uses` plane lets a module read+write a WORKSPACE table the\n// workspace already owns — the declared, portable counterpart to the\n// ad-hoc numeric-tableId Data Hub bridge. A module declares an ABSTRACT\n// contract in `module.json#uses[].tables[]` (slug + fields + abstract\n// types + ops); at install/bind time that slot is BOUND to a physical\n// workspace table via a `field_map` (declared field → physical field id).\n// The binding IS the grant: even a kind-local `dwk_` key can't touch a\n// uses table until its slot is bound.\n//\n// Surfaced against `client.uses(slug).db<Row>(table)` /\n// `qb.uses.<slug>.<table>` / the REST plane at\n// `POST /api/module-api/uses/:usesSlug/rows/...`. Same\n// preserve-the-code, convenience-accessor pattern as DepUnboundError.\n\n/**\n * The vocabulary of `reason` values a parked `uses` binding can carry,\n * surfaced in {@link UsesUnboundError.reason}. Mirrors the backend's\n * `module_table_bindings` unbound_reason enum for this plane\n * (Phase 4 modules-platform-v2). Not exhaustive by design — treat\n * `.reason` as a string; branch on these constants for compile-time\n * safety. Adding a new reason is non-breaking.\n *\n *   - `NOT_BOUND_YET`                the slot has never been bound (declared\n *                                    but no workspace table connected yet)\n *   - `AMBIGUOUS_MATCH`             auto-match found >1 candidate table; a\n *                                    human must pick one (`dashwise bind`)\n *   - `NO_MATCH`                     auto-match found no candidate table\n *   - `TABLE_DELETED`               the bound table was trashed (or a mapped\n *                                    field drifted away) → the row parked\n *   - `OPS_WIDENED_PENDING_CONSENT` the manifest widened `ops` beyond what\n *                                    was consented at bind time; re-bind to\n *                                    refresh consent\n *   - `MANUALLY_UNBOUND`            a workspace admin ran `dashwise unbind`\n */\nexport const UsesUnboundReason = {\n  NOT_BOUND_YET: 'NOT_BOUND_YET',\n  AMBIGUOUS_MATCH: 'AMBIGUOUS_MATCH',\n  NO_MATCH: 'NO_MATCH',\n  TABLE_DELETED: 'TABLE_DELETED',\n  OPS_WIDENED_PENDING_CONSENT: 'OPS_WIDENED_PENDING_CONSENT',\n  MANUALLY_UNBOUND: 'MANUALLY_UNBOUND',\n} as const;\n\nexport type UsesUnboundReason =\n  (typeof UsesUnboundReason)[keyof typeof UsesUnboundReason];\n\n/**\n * 409 — a runtime read/write against a `uses` table whose\n * `module_table_bindings` row is not `status='bound'` (Phase 4\n * modules-platform-v2 workspace-table binding lifecycle).\n *\n * \"Unbound\" means the workspace-table slot is *declared* in the module's\n * manifest `uses` block but not *connected* to a physical workspace\n * table. It happens when install-time auto-match parked the slot (no\n * candidate / ambiguous candidates / a write contract that never\n * auto-binds), the bound table was later trashed, the manifest widened\n * `ops` beyond consent, or an admin manually unbound it.\n *\n * A *recoverable* state, not a bug. Catch it and render a \"connect a\n * table\" prompt — a workspace admin resolves it by binding a workspace\n * table to the slot (`dashwise bind <uses_slug>` / the\n * `PUT /api/installations/:id/bindings/:usesSlug` endpoint). Once bound,\n * the same call succeeds with no code change.\n *\n * Convenience accessors read the backend's `context: { uses_slug, reason }`.\n *\n * @example\n * ```ts\n * import { UsesUnboundError } from '@dashai/sdk';\n *\n * try {\n *   const staff = await client.uses('employees').db<EmployeeRow>('employees').list();\n *   // …or the typed builder: await qb.uses.employees.execute();\n * } catch (err) {\n *   if (err instanceof UsesUnboundError) {\n *     return <BindWorkspaceTable slot={err.usesSlug} reason={err.reason} />;\n *   }\n *   throw err;\n * }\n * ```\n */\nexport class UsesUnboundError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.USES_UNBOUND, message, {\n      status: 409,\n      context,\n      requestId,\n    });\n  }\n\n  /**\n   * The manifest `uses[].tables[].slug` of the unbound slot (kebab-case,\n   * e.g. `employees`). Read from `context.uses_slug`; `undefined` if the\n   * backend omitted it.\n   */\n  get usesSlug(): string | undefined {\n    const v = this.context?.uses_slug;\n    return typeof v === 'string' ? v : undefined;\n  }\n\n  /**\n   * Why the slot is unbound — one of {@link UsesUnboundReason} (typed as\n   * `string` for forward-compat with reasons the backend may add). Read\n   * from `context.reason`; `undefined` if omitted.\n   */\n  get reason(): string | undefined {\n    const v = this.context?.reason;\n    return typeof v === 'string' ? v : undefined;\n  }\n}\n\n/**\n * 403 — a `uses`-plane operation that isn't in the binding's enforced\n * operation set (the manifest's declared `ops` INTERSECT the admin's\n * `consented_ops` at bind time). E.g. the manifest declares\n * `ops: ['read','update']` but the admin consented only to `read` when\n * binding, so an `update` is rejected.\n *\n * Fix: either narrow the call to a consented op, or widen the manifest\n * `ops` + have an admin re-bind (which refreshes `consented_ops`).\n *\n * `err.op` / `err.usesSlug` read the backend's `context: { uses_slug, op }`.\n */\nexport class UsesOpNotAllowedError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.USES_OP_NOT_ALLOWED, message, {\n      status: 403,\n      context,\n      requestId,\n    });\n  }\n\n  /** The `uses` slot slug the rejected op targeted. Read from `context.uses_slug`. */\n  get usesSlug(): string | undefined {\n    const v = this.context?.uses_slug;\n    return typeof v === 'string' ? v : undefined;\n  }\n\n  /**\n   * The operation that was rejected — one of `create` / `read` /\n   * `update` / `delete`. Read from `context.op`; `undefined` if omitted.\n   */\n  get op(): string | undefined {\n    const v = this.context?.op;\n    return typeof v === 'string' ? v : undefined;\n  }\n}\n\n/**\n * 409 — a field the `uses` binding's `field_map` points at no longer\n * exists on the physical workspace table (schema drift: the table owner\n * deleted or renamed the column after the bind). The backend best-effort\n * parks the binding (reason `TABLE_DELETED`/field-drift) on detection.\n *\n * Recovery is the workspace admin's: re-bind the slot to a table that\n * still has the field, or re-map the field (`dashwise bind <uses_slug>\n * --map <usesField>=<physicalField>`).\n *\n * `err.field` / `err.usesSlug` read the backend's\n * `context: { uses_slug, field }`.\n */\nexport class ContractFieldMissingError extends DashwiseError {\n  constructor(\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(DashwiseErrorCode.CONTRACT_FIELD_MISSING, message, {\n      status: 409,\n      context,\n      requestId,\n    });\n  }\n\n  /** The `uses` slot slug whose contract broke. Read from `context.uses_slug`. */\n  get usesSlug(): string | undefined {\n    const v = this.context?.uses_slug;\n    return typeof v === 'string' ? v : undefined;\n  }\n\n  /**\n   * The declared field slug (the `uses` side name) whose mapped physical\n   * field is gone. Read from `context.field`; `undefined` if omitted.\n   */\n  get field(): string | undefined {\n    const v = this.context?.field;\n    return typeof v === 'string' ? v : undefined;\n  }\n}\n\n// ── Join errors (Phase 3) ──────────────────────────────────────────────\n//\n// Surfaced when `.join('<slug>')` / `.leftJoin('<slug>')` on the\n// generated `qb` builder can't resolve the target against the\n// manifest. Pre-declared in slice 3.1; raised by the backend\n// translator in slice 3.2. Same one-subclass-with-preserved-code\n// pattern as DependencyContractError so authors can switch on\n// `err.code` for the three sub-cases:\n//\n//   LINK_FIELD_NOT_FOUND   `.join('xyz')` where `xyz` isn't a field\n//                          on the source table. Fix: pass an\n//                          explicit `on` argument, or correct the slug.\n//\n//   NOT_A_LINK_FIELD       `.join('title')` where `title` exists on\n//                          the source table but its type isn't\n//                          `link_row`. Fix: use a real link field,\n//                          or pass explicit `on`.\n//\n//   JOIN_NOT_LINKED        `.join('sibling_table')` where the target\n//                          is a sibling table but no link field\n//                          bridges them. Fix: pass explicit `on`.\n\n/**\n * 400 — `.join()` / `.leftJoin()` referenced a target the manifest\n * can't resolve. Covers the three sub-cases above; inspect\n * `err.code` to distinguish.\n *\n * Author-side fix in every case: either correct the slug, or pass\n * an explicit `on` argument to bypass link-field inference.\n */\nexport class JoinError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, { status: 400, context, requestId });\n  }\n}\n\n// ── Cross-module action errors (Phase 7 slice 7.3a, 2026-05-20) ──────\n//\n// Surfaced by the codegen-emitted `qb.deps.<dep>.actions.<name>(input)`\n// factory when the backend's cross-module dispatch\n// (`CrossModuleActionService.dispatch()`) rejects. Six sub-cases all\n// covered by `DepActionError`; inspect `err.code` to discriminate.\n//\n//   ACTION_NOT_EXPOSED      403 — provider's manifest doesn't expose\n//                                 the action, OR visibility='private'.\n//                                 Recovery: provider author needs to\n//                                 publish a version that exposes it.\n//   ACTION_NOT_DECLARED     403 — consumer's manifest doesn't list\n//                                 the action in dependencies[].actions[].\n//                                 Recovery: add it + republish.\n//   ACTION_INPUT_INVALID    400 — input fails Ajv against the\n//                                 provider's declared input schema.\n//                                 Recovery: fix the call site (typical\n//                                 with stale codegen + drift).\n//   ACTION_OUTPUT_INVALID   500 — provider returned a value that fails\n//                                 the declared output schema. This is a\n//                                 PROVIDER-author bug; consumer can\n//                                 only file an issue.\n//   ACTION_RATE_LIMITED     429 — per-actor or per-caller-installation\n//                                 rate limit exceeded. Retry with\n//                                 backoff after Retry-After (slice 7.4).\n//   ACTION_EXECUTION_FAILED 200-envelope — action body threw, timed out,\n//                                 or OOM-ed. Provider-author bug;\n//                                 trace surfaced in err.context.trace.\n\n/**\n * Single subclass for every cross-module action failure. The code\n * (and HTTP status) varies per sub-case; the wrapping class lets\n * consumers `catch (e) { if (e instanceof DepActionError) {...} }`\n * regardless of which sub-case fired.\n */\nexport class DepActionError extends DashwiseError {\n  constructor(\n    code: string,\n    message: string,\n    status: number,\n    context?: Record<string, unknown>,\n    requestId: string | null = null,\n  ) {\n    super(code, message, {\n      status,\n      retriable: code === DashwiseErrorCode.ACTION_RATE_LIMITED,\n      context,\n      requestId,\n    });\n  }\n}\n\n// ── Factory: backend envelope → typed error ────────────────────────────\n\ninterface BackendErrorEnvelope {\n  code?: string;\n  message?: string;\n  retriable?: boolean;\n  context?: Record<string, unknown>;\n}\n\n/**\n * Build a typed `DashwiseError` from the backend's response envelope.\n *\n * The mapping picks the most specific subclass for codes we have a class\n * for; everything else becomes a plain `DashwiseError` carrying the raw\n * code. This keeps the type set small while still letting consumers\n * branch on string codes when they want to.\n *\n * Phase 6 slice 6.2 (2026-05-19): accepts an optional `requestId` —\n * the backend's `x-request-id` response header — and threads it onto\n * every produced error so consumers can use it as a debugging trace\n * anchor. Default `null` for backward compat; the transport always\n * passes it through.\n */\nexport function fromBackendEnvelope(\n  status: number,\n  envelope: BackendErrorEnvelope | null,\n  requestId: string | null = null,\n): DashwiseError {\n  const code = envelope?.code ?? codeFromStatus(status);\n  const message = envelope?.message ?? `HTTP ${status}`;\n  const context = envelope?.context;\n\n  switch (code) {\n    case DashwiseErrorCode.UNAUTHENTICATED:\n    case DashwiseErrorCode.TOKEN_EXPIRED:\n      return new UnauthenticatedError(message, requestId);\n    case DashwiseErrorCode.FORBIDDEN:\n      return new ForbiddenError(message, context, requestId);\n    case DashwiseErrorCode.ROW_NOT_FOUND:\n      return new RowNotFoundError(message, context, requestId);\n    case DashwiseErrorCode.CONTRACT_VIOLATION:\n    case DashwiseErrorCode.FIELD_NOT_READABLE:\n    case DashwiseErrorCode.FILTER_OP_UNKNOWN:\n    case DashwiseErrorCode.OPERATION_NOT_ALLOWED:\n      return new ContractViolationError(message, context, requestId);\n    case DashwiseErrorCode.VALIDATION_FAILED:\n      return new ValidationError(message, context, requestId);\n    case DashwiseErrorCode.DEPENDENCY_NOT_DECLARED:\n    case DashwiseErrorCode.TABLE_NOT_IN_CONTRACT:\n      return new DependencyContractError(code, message, context, requestId);\n    case DashwiseErrorCode.PROVIDER_TABLE_MISSING:\n      return new ProviderTableMissingError(message, context, requestId);\n    case DashwiseErrorCode.OPERATION_NOT_ALLOWED_BY_PROVIDER:\n      return new OperationNotAllowedByProviderError(message, context, requestId);\n    case DashwiseErrorCode.DEP_UNBOUND:\n      return new DepUnboundError(message, context, requestId);\n    case DashwiseErrorCode.USES_UNBOUND:\n      return new UsesUnboundError(message, context, requestId);\n    case DashwiseErrorCode.USES_OP_NOT_ALLOWED:\n      return new UsesOpNotAllowedError(message, context, requestId);\n    case DashwiseErrorCode.CONTRACT_FIELD_MISSING:\n      return new ContractFieldMissingError(message, context, requestId);\n    case DashwiseErrorCode.LINK_FIELD_NOT_FOUND:\n    case DashwiseErrorCode.NOT_A_LINK_FIELD:\n    case DashwiseErrorCode.JOIN_NOT_LINKED:\n    // `uses`-plane joins are unsupported in v1; the backend emits a 400\n    // with this code. Map to JoinError so it lands in the same\n    // \"your join can't be resolved\" family (code preserved for `err.code`).\n    case DashwiseErrorCode.USES_JOIN_UNSUPPORTED:\n      return new JoinError(code, message, context, requestId);\n    case DashwiseErrorCode.ACTION_NOT_EXPOSED:\n    case DashwiseErrorCode.ACTION_NOT_DECLARED:\n      return new DepActionError(code, message, 403, context, requestId);\n    case DashwiseErrorCode.ACTION_INPUT_INVALID:\n      return new DepActionError(code, message, 400, context, requestId);\n    case DashwiseErrorCode.ACTION_OUTPUT_INVALID:\n      return new DepActionError(code, message, 500, context, requestId);\n    case DashwiseErrorCode.ACTION_RATE_LIMITED:\n      return new DepActionError(code, message, 429, context, requestId);\n    case DashwiseErrorCode.ACTION_EXECUTION_FAILED:\n      // ACTION_EXECUTION_FAILED arrives as a 200 envelope from the\n      // backend (the host succeeded; the action body crashed). The\n      // _callAction helper unwraps the envelope and synthesizes this\n      // via the factory call — status 200 reflects \"the transport was\n      // fine; the failure is in the application layer\".\n      return new DepActionError(code, message, 200, context, requestId);\n    default:\n      return new DashwiseError(code, message, {\n        status,\n        retriable: envelope?.retriable ?? false,\n        context,\n        requestId,\n      });\n  }\n}\n\nfunction codeFromStatus(status: number): string {\n  if (status === 401) return DashwiseErrorCode.UNAUTHENTICATED;\n  if (status === 403) return DashwiseErrorCode.FORBIDDEN;\n  if (status === 404) return DashwiseErrorCode.ROW_NOT_FOUND;\n  if (status >= 500) return DashwiseErrorCode.INTERNAL_ERROR;\n  return 'HTTP_ERROR';\n}\n","/**\n * HTTP transport for @dashai/sdk.\n *\n * Wraps `globalThis.fetch` with:\n *   - a fixed `/api/module-api` base prefix (Phase 2 wire protocol —\n *     the install is resolved server-side from the credential, never\n *     from the URL, so there is no per-installation URL segment anymore)\n *   - token attachment via the caller-supplied resolver\n *   - timeout enforcement via `AbortController`\n *   - response envelope parsing → typed `DashwiseError`\n *   - 204 No Content handling\n *\n * No retries here — retries are policy and belong one layer up. The\n * `retriable` flag on `DashwiseError` is hinting to the caller, not\n * something the transport acts on automatically. (We'd rather a module\n * author opt into retry per-call than have the SDK silently double-fire\n * an idempotent-looking POST that wasn't actually idempotent.)\n */\n\nimport {\n  DashwiseError,\n  NetworkError,\n  TimeoutError,\n  fromBackendEnvelope,\n} from './errors.js';\nimport type { ClientConfig, FetchImpl, SlowQueryInfo } from './types.js';\n\nexport interface HttpTransport {\n  /**\n   * Make a request to the DashWise API.\n   *\n   * @param method HTTP verb.\n   * @param path  Path appended to the `/api/module-api` base, starting\n   *              with `/`. Example: `/db/tasks/list`.\n   * @param body  JSON-serializable body. Omit/pass `undefined` to skip\n   *              the body entirely.\n   * @returns Parsed JSON response, or `undefined` for 204 No Content.\n   * @throws  `DashwiseError` (or a subclass) on any non-2xx response,\n   *          `NetworkError` on transport failure, `TimeoutError` on\n   *          aborted requests.\n   */\n  request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;\n\n  /**\n   * Phase 6 streaming (2026-05-19): low-level transport entry that\n   * returns the unparsed `Response` so the caller can stream the body\n   * chunk-by-chunk. Used by `qb.from(...).stream()` to consume the\n   * backend's SSE endpoint.\n   *\n   * Differs from `request()`:\n   *   - No body parsing — caller owns the `Response.body` ReadableStream.\n   *   - Caller MUST handle non-2xx (read the error envelope from the\n   *     response body + throw the typed `DashwiseError`); this method\n   *     returns the Response regardless of status so error JSON can\n   *     be read off the stream.\n   *   - Optional `signal` parameter for caller-side cancellation\n   *     (combined with the transport's own timeout). Abort propagates\n   *     to fetch, which cancels the underlying network read.\n   *   - Timeout handling: still applies via the transport's\n   *     `timeoutMs` config, but ONLY to the headers-arrival phase.\n   *     Streaming bodies can take arbitrarily long; the stream\n   *     reader's own backpressure handles the long tail.\n   */\n  streamRaw(\n    method: string,\n    path: string,\n    body?: unknown,\n    signal?: AbortSignal,\n  ): Promise<Response>;\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_SLOW_QUERY_THRESHOLD_MS = 500;\nconst TRAILING_SLASH = /\\/+$/;\nconst LEADING_SLASH = /^\\/+/;\n\n/** Phase 2 wire protocol — the single, install-agnostic module API root. */\nconst MODULE_API_PREFIX = '/api/module-api';\n\n/**\n * Build the module-API base URL. The Phase 2 runtime data API lives at\n * a fixed `/api/module-api` — the install is resolved server-side from\n * the bearer credential (a scoped `dwk_` key or a sandbox session\n * token), never from the URL. Every request from the SDK is relative\n * to this prefix.\n *\n * Accepts either the Phase-2 `apiUrl` or the legacy `baseUrl` alias (see\n * {@link ClientConfig.apiUrl}); the caller passes `apiUrl ?? baseUrl`.\n */\nfunction buildBaseUrl(apiUrl: string | undefined): string {\n  if (!apiUrl) {\n    throw new Error('@dashai/sdk: `apiUrl` is required');\n  }\n  const trimmed = apiUrl.replace(TRAILING_SLASH, '');\n  return `${trimmed}${MODULE_API_PREFIX}`;\n}\n\nfunction resolveFetch(custom: FetchImpl | undefined): FetchImpl {\n  if (custom) return custom;\n  if (typeof globalThis.fetch !== 'function') {\n    throw new Error(\n      '@dashai/sdk: no `fetch` available. On Node < 18, pass an explicit `fetch` in `createClient({...})`.',\n    );\n  }\n  return globalThis.fetch.bind(globalThis);\n}\n\n/**\n * Parse a `Response` body, tolerating empty / non-JSON responses. Returns\n * `null` if there's no body or if the body fails to parse.\n *\n * We never throw from here — the caller decides what to do based on the\n * presence of an envelope.\n */\nasync function readBody(res: Response): Promise<unknown> {\n  if (res.status === 204) return undefined;\n  const contentType = res.headers.get('content-type') ?? '';\n  if (!contentType.includes('application/json')) {\n    // Non-JSON 200s shouldn't happen from DashWise, but handle them anyway.\n    try {\n      return await res.text();\n    } catch {\n      return null;\n    }\n  }\n  try {\n    return await res.json();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create an HTTP transport from the public client config.\n *\n * The returned `request` function captures the config + closes over it,\n * so the client can be shared across concurrent calls without rebuilding\n * the transport per call.\n */\nexport function createHttp(config: ClientConfig): HttpTransport {\n  // Phase 2 wire protocol (contract W2): the generated production/local\n  // module bootstrap calls `createClient({ apiUrl, apiKey })`. Accept\n  // `apiUrl` as the primary field, falling back to the legacy `baseUrl`\n  // alias the frozen sandbox generation still emits.\n  const base = buildBaseUrl(config.apiUrl ?? config.baseUrl);\n  const doFetch = resolveFetch(config.fetch);\n  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const staticHeaders: Record<string, string> = {\n    Accept: 'application/json',\n    ...(config.headers ?? {}),\n  };\n  // Phase 6 slice 6.3 (2026-05-19): slow-query callback wiring.\n  // Read once at transport construction — config is immutable after\n  // createClient. If `onSlowQuery` is unset, the per-request hot path\n  // skips the duration comparison entirely (zero overhead).\n  const onSlowQuery = config.onSlowQuery;\n  const slowQueryThresholdMs =\n    config.slowQueryThresholdMs ?? DEFAULT_SLOW_QUERY_THRESHOLD_MS;\n\n  /**\n   * Fire the slow-query callback if (a) it's configured and (b) the\n   * round-trip exceeded the threshold. Always-safe: any exception the\n   * caller's callback throws is caught and silently dropped — a buggy\n   * observability hook MUST NOT crash the query path. Same failure-\n   * isolation contract the backend's `ModuleQueryLogService.record()`\n   * uses.\n   */\n  function maybeFireSlowQuery(info: SlowQueryInfo): void {\n    if (!onSlowQuery) return;\n    if (info.durationMs <= slowQueryThresholdMs) return;\n    try {\n      onSlowQuery(info);\n    } catch {\n      // Swallow — observability is best-effort.\n    }\n  }\n\n  async function request<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const normalizedPath = `/${path.replace(LEADING_SLASH, '')}`;\n    // Phase 2 wire protocol: EVERY path is relative to `/api/module-api`\n    // — including cross-module action dispatch (`_callAction` now posts\n    // to `/deps/<provider>/actions/<name>`). There is no absolute-path\n    // escape hatch anymore; the old `/api/modules/runtime/...` sibling\n    // namespace is gone.\n    const url = `${base}${normalizedPath}`;\n\n    // Resolve token AFTER building URL so a failing resolver still gives\n    // the consumer a useful error path-context. The resolver may be async\n    // (e.g. session lookup); the same instance is allowed to mutate\n    // between calls (token refresh).\n    //\n    // Precedence: a non-null `getToken()` result wins; otherwise fall back\n    // to the static `apiKey` (Custom Modules Platform v1 — a deployed\n    // module's long-lived `dwk_` key).\n    const token =\n      (config.getToken ? await config.getToken() : null) ?? config.apiKey ?? null;\n\n    const headers: Record<string, string> = { ...staticHeaders };\n    if (body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n    }\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n    // Phase 6 slice 6.3: capture the round-trip start AFTER token\n    // resolution (which can be slow if the resolver hits a network)\n    // but BEFORE the fetch — measures what the consumer cares about:\n    // the actual HTTP request's perceived latency.\n    const start = Date.now();\n\n    let res: Response;\n    try {\n      res = await doFetch(url, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: controller.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      const durationMs = Date.now() - start;\n      if (isAbortError(err)) {\n        maybeFireSlowQuery({\n          method,\n          path: normalizedPath,\n          durationMs,\n          status: 0,\n          success: false,\n          requestId: null,\n        });\n        throw new TimeoutError(`Request to ${method} ${normalizedPath} timed out`, timeoutMs);\n      }\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: 0,\n        success: false,\n        requestId: null,\n      });\n      throw new NetworkError(\n        `Network failure on ${method} ${normalizedPath}: ${describeError(err)}`,\n        err,\n      );\n    }\n    clearTimeout(timer);\n\n    const parsed = await readBody(res);\n    const durationMs = Date.now() - start;\n\n    // Phase 6 slice 6.2 (2026-05-19): capture the backend's\n    // `x-request-id` response header so we can attach it to any\n    // thrown `DashwiseError` as a debugging trace anchor. The\n    // backend echoes this header on every query/explain response\n    // (and will on more endpoints as Phase 6 rolls out); for\n    // endpoints that don't echo it yet, we get `null` and the\n    // error carries `requestId: null` — same semantic as a\n    // client-side NetworkError / TimeoutError.\n    const requestId = res.headers.get('x-request-id');\n\n    if (!res.ok) {\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: res.status,\n        success: false,\n        requestId,\n      });\n      const envelope = isEnvelope(parsed) ? parsed : null;\n      throw fromBackendEnvelope(res.status, envelope, requestId);\n    }\n\n    maybeFireSlowQuery({\n      method,\n      path: normalizedPath,\n      durationMs,\n      status: res.status,\n      success: true,\n      requestId,\n    });\n\n    // 204 / empty body → caller gets `undefined` typed as `T`. The data\n    // plane's `delete` is the only operation that legitimately produces\n    // a void result; everything else returns a body.\n    return parsed as T;\n  }\n\n  /**\n   * Phase 6 streaming (2026-05-19): low-level streaming entry — see\n   * `HttpTransport.streamRaw` JSDoc for the contract.\n   *\n   * Implementation mirrors `request()`'s setup (URL + token + static\n   * headers + AbortController) but skips body parsing entirely. The\n   * caller's `signal`, if provided, is combined with the transport's\n   * own timeout controller so EITHER trigger cancels the fetch.\n   */\n  async function streamRaw(\n    method: string,\n    path: string,\n    body?: unknown,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const normalizedPath = `/${path.replace(LEADING_SLASH, '')}`;\n    const url = `${base}${normalizedPath}`;\n    const token = config.getToken ? await config.getToken() : null;\n\n    const headers: Record<string, string> = { ...staticHeaders };\n    if (body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n    }\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    // Combine the caller's signal with our timeout controller.\n    // Either trigger cancels the fetch.\n    const timeoutController = new AbortController();\n    const timer = setTimeout(() => timeoutController.abort(), timeoutMs);\n    const combinedController = new AbortController();\n    if (signal) {\n      if (signal.aborted) combinedController.abort();\n      else signal.addEventListener('abort', () => combinedController.abort(), { once: true });\n    }\n    timeoutController.signal.addEventListener(\n      'abort',\n      () => combinedController.abort(),\n      { once: true },\n    );\n\n    // onSlowQuery wiring: measure round-trip from fetch start to\n    // headers-arrival. Streaming responses linger after headers; we\n    // fire `onSlowQuery` once when headers come back, NOT once per\n    // chunk. The `success` flag reflects HTTP status at that point;\n    // in-band SSE error events are observable by the caller separately.\n    const start = Date.now();\n    let res: Response;\n    try {\n      res = await doFetch(url, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n        signal: combinedController.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      const durationMs = Date.now() - start;\n      if (isAbortError(err)) {\n        maybeFireSlowQuery({\n          method,\n          path: normalizedPath,\n          durationMs,\n          status: 0,\n          success: false,\n          requestId: null,\n        });\n        // If the caller-supplied signal aborted, surface that as a\n        // standard AbortError (consumer can branch on `e.name`).\n        // Otherwise it's our timeout firing.\n        if (signal?.aborted) {\n          const e = new Error('Aborted by caller');\n          e.name = 'AbortError';\n          throw e;\n        }\n        throw new TimeoutError(\n          `Streaming request to ${method} ${normalizedPath} timed out before headers arrived`,\n          timeoutMs,\n        );\n      }\n      maybeFireSlowQuery({\n        method,\n        path: normalizedPath,\n        durationMs,\n        status: 0,\n        success: false,\n        requestId: null,\n      });\n      throw new NetworkError(\n        `Network failure on ${method} ${normalizedPath}: ${describeError(err)}`,\n        err,\n      );\n    }\n    clearTimeout(timer);\n\n    const requestId = res.headers.get('x-request-id');\n    maybeFireSlowQuery({\n      method,\n      path: normalizedPath,\n      durationMs: Date.now() - start,\n      status: res.status,\n      success: res.ok,\n      requestId,\n    });\n\n    // Hand the Response back regardless of status — caller reads the\n    // error envelope from the body (the standard JSON error path) OR\n    // streams the body when ok.\n    return res;\n  }\n\n  return { request, streamRaw };\n}\n\n// ── Helpers ─────────────────────────────────────────────────────────────\n\nfunction isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false;\n  const e = err as { name?: string; code?: string };\n  return e.name === 'AbortError' || e.code === 'ABORT_ERR';\n}\n\nfunction describeError(err: unknown): string {\n  if (err instanceof Error) return err.message;\n  if (typeof err === 'string') return err;\n  try {\n    return JSON.stringify(err);\n  } catch {\n    return '<unknown error>';\n  }\n}\n\nfunction isEnvelope(value: unknown): value is {\n  code?: string;\n  message?: string;\n  retriable?: boolean;\n  context?: Record<string, unknown>;\n} {\n  if (!value || typeof value !== 'object') return false;\n  const v = value as Record<string, unknown>;\n  // We accept the envelope if it has at least `code` OR `message` —\n  // matches what `DomainError` filters emit from the backend.\n  return typeof v.code === 'string' || typeof v.message === 'string';\n}\n\n// Re-export DashwiseError so consumers of the http module alone get the\n// full error model without a second import.\nexport { DashwiseError };\n","/**\n * `createClient()` — the public factory for talking to the DashWise\n * runtime data API.\n *\n * Returns a `Client` whose `db<Row>(slug)` method binds a table slug +\n * row type and produces a chainable `{ list, get, create, update, delete }`\n * surface.\n *\n * Two-layer use:\n *   1. Generated per-module typed wrappers call this and re-export a\n *      typed `db.tasks` / `db.notes` / etc. — the user-facing API for\n *      modules that ran `dashwise module generate`.\n *   2. Direct use for hand-authored scripts, integration tooling, custom\n *      modules that don't run codegen — operate on\n *      `Record<string, unknown>` rows with the generic `db<Row>(slug)`\n *      shape.\n *\n * The HTTP path layout targets the Phase 2 module-API plane. Every\n * route is install-agnostic — the backend resolves the install from\n * the bearer credential (a scoped `dwk_` key or a sandbox session\n * token), so no installation id appears in the URL:\n *\n *   POST   /api/module-api/db/<table>/list\n *   GET    /api/module-api/db/<table>/<id>\n *   POST   /api/module-api/db/<table>\n *   PATCH  /api/module-api/db/<table>/<id>\n *   DELETE /api/module-api/db/<table>/<id>\n */\n\nimport { makeDeps } from './deps.js';\nimport { fromBackendEnvelope } from './errors.js';\nimport { createHttp, type HttpTransport } from './http.js';\nimport type {\n  BaseInsert,\n  BaseRow,\n  BaseUpdate,\n  Client,\n  ClientConfig,\n  DatahubClient,\n  DatahubListOpts,\n  DatahubListResult,\n  DatahubTableClient,\n  Deps,\n  ListOpts,\n  Page,\n  SortClause,\n  TableClient,\n  Where,\n} from './types.js';\n\n/**\n * Create a DashWise SDK client. The returned client is thread-safe and\n * can be cached for the lifetime of the process (or the Next.js request).\n *\n * @example\n *   const client = createClient({\n *     baseUrl: 'https://api.dashwise.net',\n *     apiKey: process.env.DASHWISE_API_KEY,\n *   });\n *\n *   const page = await client.db<TasksRow>('tasks').list({\n *     filter: { done: false },\n *     limit: 50,\n *   });\n */\nexport function createClient(config: ClientConfig): Client {\n  const transport = createHttp(config);\n  return {\n    db<\n      Row extends BaseRow,\n      Insert extends BaseInsert = BaseInsert,\n      Update extends BaseUpdate = BaseUpdate,\n    >(tableSlug: string): TableClient<Row, Insert, Update> {\n      assertValidTableSlug(tableSlug);\n      return makeTableClient<Row, Insert, Update>(transport, tableSlug);\n    },\n\n    deps(providerSlug: string): Deps {\n      // Validation lives inside `makeDeps` so the same checks apply\n      // whether deps is reached via `createClient` or via a test\n      // harness that constructs the transport directly.\n      return makeDeps(transport, providerSlug);\n    },\n\n    datahub: makeDatahubClient(transport),\n\n    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T> {\n      return transport.request<T>(method, path, body);\n    },\n\n    streamRaw(\n      method: string,\n      path: string,\n      body?: unknown,\n      signal?: AbortSignal,\n    ): Promise<Response> {\n      return transport.streamRaw(method, path, body, signal);\n    },\n\n    async _callAction<TOutput = unknown>(\n      providerSlug: string,\n      actionName: string,\n      input: unknown,\n      opts?: { timeoutMs?: number; idempotencyKey?: string },\n    ): Promise<TOutput> {\n      assertValidModuleSlug(providerSlug);\n      assertValidActionName(actionName);\n      // Phase 2 wire protocol: cross-module action dispatch is now a\n      // plain module-API route — `/api/module-api/deps/<slug>/actions/<name>`\n      // — with the consumer install resolved server-side from the bearer\n      // credential (no `installationId` in the URL). The transport\n      // prepends the `/api/module-api` base, so we pass the relative tail.\n      const path =\n        `/deps/${encodeURIComponent(providerSlug)}/actions/${encodeURIComponent(actionName)}`;\n      const body: Record<string, unknown> = { input };\n      if (opts?.idempotencyKey !== undefined) {\n        body.idempotency_key = opts.idempotencyKey;\n      }\n      if (opts?.timeoutMs !== undefined) {\n        body.timeout_ms = opts.timeoutMs;\n      }\n      const envelope = await transport.request<CrossModuleActionEnvelope<TOutput>>(\n        'POST',\n        path,\n        body,\n      );\n      // The transport throws on HTTP 4xx/5xx with the envelope mapped\n      // to typed errors via fromBackendEnvelope. A successful HTTP\n      // status with `ok: false` is the action-body-failure path — we\n      // synthesize a DepActionError so consumers have one place to\n      // catch.\n      if (envelope.ok === false) {\n        const requestId = envelope.cross_module?.request_id ?? null;\n        throw fromBackendEnvelope(\n          200,\n          {\n            code: envelope.error.code,\n            message: envelope.error.message,\n            context: envelope.error.trace\n              ? { trace: envelope.error.trace }\n              : undefined,\n          },\n          requestId,\n        );\n      }\n      return envelope.result;\n    },\n  };\n}\n\ninterface CrossModuleActionEnvelopeOk<T> {\n  ok: true;\n  result: T;\n  elapsed_ms: number;\n  executor: string;\n  cross_module: {\n    caller_installation_id: number;\n    provider_installation_id: number;\n    provider_module_slug: string;\n    provider_module_version: string;\n    request_id: string;\n  };\n}\n\ninterface CrossModuleActionEnvelopeErr {\n  ok: false;\n  error: { code: string; message: string; trace?: string };\n  elapsed_ms: number;\n  executor: string;\n  cross_module: CrossModuleActionEnvelopeOk<unknown>['cross_module'];\n}\n\ntype CrossModuleActionEnvelope<T> =\n  | CrossModuleActionEnvelopeOk<T>\n  | CrossModuleActionEnvelopeErr;\n\nconst ACTION_NAME_REGEX = /^[a-zA-Z_$][a-zA-Z0-9_$]{0,63}$/;\nconst MODULE_SLUG_REGEX = /^[a-z][a-z0-9-]*[a-z0-9]$/;\n\nfunction assertValidModuleSlug(slug: string): void {\n  if (!MODULE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `Invalid provider module slug \"${slug}\" — must be kebab-case (^[a-z][a-z0-9-]*[a-z0-9]$).`,\n    );\n  }\n}\n\nfunction assertValidActionName(name: string): void {\n  if (!ACTION_NAME_REGEX.test(name)) {\n    throw new Error(\n      `Invalid action name \"${name}\" — must be a JS identifier (letters/digits/underscore/$, starts non-digit, ≤64 chars).`,\n    );\n  }\n}\n\n/**\n * Module-slug character set matches the manifest validator's table-slug\n * rule (`^[a-z][a-z0-9_]*$`). Slugs are baked into URL paths, so\n * unsafe characters would route to the wrong resource (or 400).\n */\nconst TABLE_SLUG_REGEX = /^[a-z][a-z0-9_]*$/;\n\nfunction assertValidTableSlug(slug: string): void {\n  if (typeof slug !== 'string' || !TABLE_SLUG_REGEX.test(slug)) {\n    throw new Error(\n      `@dashai/sdk: invalid table slug \"${slug}\". Slugs must match /^[a-z][a-z0-9_]*$/.`,\n    );\n  }\n}\n\n/**\n * Custom Modules Platform v1 (P1b) — Data Hub access surface. Hits the\n * runtime Data Hub bridge (`/api/module-api/datahub/tables/:tableId/rows…`),\n * which enforces the authenticating key's datahub grants. Table id (not\n * slug) keys the URL, matching the bridge route + the Data Hub's numeric\n * table identity.\n */\nfunction makeDatahubClient(transport: HttpTransport): DatahubClient {\n  return {\n    table<Row = Record<string, unknown>>(\n      tableId: number,\n    ): DatahubTableClient<Row> {\n      assertValidTableId(tableId);\n      const root = `/datahub/tables/${tableId}/rows`;\n      return {\n        async list(\n          opts?: DatahubListOpts<Row> | Record<string, string>,\n        ): Promise<DatahubListResult> {\n          // Two input shapes: a typed `DatahubListOpts` (which we compile\n          // to the Data Hub bridge's flat query protocol) or a raw\n          // `Record<string, string>` of flat params (back-compat\n          // passthrough). They're distinguished structurally — see\n          // `isDatahubListOpts`. Widen `Row` to `unknown` here so the\n          // guard + compiler don't fight generic variance; the wire shape\n          // is identical regardless of the row type argument.\n          const arg = opts as\n            | DatahubListOpts<unknown>\n            | Record<string, string>\n            | undefined;\n          const flat: Record<string, string> | undefined = isDatahubListOpts(\n            arg,\n          )\n            ? compileDatahubListOpts(arg)\n            : arg;\n          const qs = flat ? new URLSearchParams(flat).toString() : '';\n          const path = qs ? `${root}?${qs}` : root;\n          return transport.request<DatahubListResult>('GET', path);\n        },\n        async get(rowId: number): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>(\n            'GET',\n            `${root}/${rowId}`,\n          );\n        },\n        async create(\n          body: Record<string, unknown>,\n        ): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>('POST', root, body);\n        },\n        async update(\n          rowId: number,\n          body: Record<string, unknown>,\n        ): Promise<Record<string, unknown>> {\n          return transport.request<Record<string, unknown>>(\n            'PATCH',\n            `${root}/${rowId}`,\n            body,\n          );\n        },\n        async delete(rowId: number): Promise<{ success: true }> {\n          return transport.request<{ success: true }>(\n            'DELETE',\n            `${root}/${rowId}`,\n          );\n        },\n      };\n    },\n  };\n}\n\nfunction assertValidTableId(tableId: number): void {\n  if (!Number.isInteger(tableId) || tableId <= 0) {\n    throw new Error(\n      `@dashai/sdk: invalid Data Hub table id \"${tableId}\". Must be a positive integer.`,\n    );\n  }\n}\n\n/**\n * The keys that mark an argument to `datahub.table().list()` as a typed\n * {@link DatahubListOpts} rather than a raw flat-param record. If the\n * argument is a plain object carrying any of these, we compile it; any\n * other object is treated as a raw `Record<string, string>` passthrough\n * (back-compat).\n */\nconst DATAHUB_LIST_OPT_KEYS = new Set([\n  'filter',\n  'sort',\n  'search',\n  'limit',\n  'page',\n]);\n\n/**\n * Filter-clause keys that are logical grouping operators rather than\n * field names. Presence of either forces the JSON-tree (`filters=`)\n * compilation path, since the flat `filter__<field>__<op>` protocol\n * can't express grouping.\n */\nconst FILTER_GROUP_KEYS = new Set(['AND', 'OR']);\n\nfunction isDatahubListOpts(\n  opts: DatahubListOpts<unknown> | Record<string, string> | undefined,\n): opts is DatahubListOpts<unknown> {\n  if (opts === undefined || opts === null || typeof opts !== 'object') {\n    return false;\n  }\n  // An empty object is ambiguous; treat it as no-op opts (compiles to an\n  // empty query, same as the raw path would).\n  return Object.keys(opts).some((k) => DATAHUB_LIST_OPT_KEYS.has(k));\n}\n\n/**\n * Compile a typed {@link DatahubListOpts} into the Data Hub bridge's\n * flat query protocol:\n *   - simple filters → repeated `filter__<field>__<op>=<value>` params\n *   - grouped filters (`AND` / `OR`) → a single `filters=<json>` tree\n *   - `sort` → `order_by` (comma-joined, `-` prefix for desc)\n *   - `search` → `search`\n *   - `limit` → `size`\n *   - `page` → `page`\n *\n * Mirrors how `client.db().list()` compiles `ListOpts` (and the\n * frontend `rows.api.ts` flat-param builder). Returns a flat string map\n * ready to feed `URLSearchParams`.\n */\nfunction compileDatahubListOpts(opts: DatahubListOpts<unknown>): Record<string, string> {\n  const out: Record<string, string> = {};\n\n  if (opts.filter !== undefined) {\n    const where = opts.filter as Where<Record<string, unknown>>;\n    if (hasFilterGrouping(where)) {\n      // The flat `filter__field__op` syntax can't express AND/OR grouping;\n      // use the backend's JSON-tree param — but translate the SDK's\n      // `{ AND/OR: [...] }` shape into the wire shape the backend parser\n      // expects (`{ filter_type, filters:[{field,type,value}], filter_groups }`).\n      // A raw JSON.stringify of the SDK shape parses to an empty tree → the\n      // whole filter would be silently dropped (all rows returned).\n      out.filters = JSON.stringify(whereToBackendTree(where));\n    } else {\n      for (const [field, value] of Object.entries(where)) {\n        if (value === undefined) continue;\n        if (isFilterOpsObject(value)) {\n          // Operator object: one flat param per operator on this field.\n          for (const [op, opValue] of Object.entries(value)) {\n            if (opValue === undefined) continue;\n            out[`filter__${field}__${op}`] = stringifyFilterValue(opValue);\n          }\n        } else {\n          // Bare primitive: shorthand for `{ equal: value }`.\n          out[`filter__${field}__equal`] = stringifyFilterValue(value);\n        }\n      }\n    }\n  }\n\n  if (opts.sort !== undefined && opts.sort.length > 0) {\n    out.order_by = opts.sort\n      .map((s: SortClause<unknown>) =>\n        s.dir === 'desc' ? `-${s.field}` : s.field,\n      )\n      .join(',');\n  }\n\n  if (opts.search !== undefined) out.search = opts.search;\n  if (typeof opts.limit === 'number') out.size = String(opts.limit);\n  if (typeof opts.page === 'number') out.page = String(opts.page);\n\n  // The typed surface addresses fields by their human NAME (the keys of the\n  // generic `Row`), but the Data Hub bridge defaults to resolving refs as\n  // `field_<id>` and 400s on a name. Whenever we emitted a name-based filter\n  // or sort, tell the backend to resolve by user field name (mirrors the\n  // frontend `rows.api.ts`). Harmless when no filter/sort was emitted.\n  if (\n    opts.filter !== undefined ||\n    (opts.sort !== undefined && opts.sort.length > 0)\n  ) {\n    out.user_field_names = 'true';\n  }\n\n  return out;\n}\n\nfunction hasFilterGrouping(where: Where<Record<string, unknown>>): boolean {\n  return Object.keys(where).some((k) => FILTER_GROUP_KEYS.has(k));\n}\n\n/** One leaf of the backend's JSON filter-tree (`filters=` param). */\ninterface BackendFilterLeaf {\n  field: string;\n  type: string;\n  value: string;\n}\n/** The backend's recursive filter-tree wire shape. */\ninterface BackendFilterTree {\n  filter_type: 'AND' | 'OR';\n  filters: BackendFilterLeaf[];\n  filter_groups: BackendFilterTree[];\n}\n\n/** True when a Where node is a logical group (`{ AND: [...] }` / `{ OR: [...] }`). */\nfunction isFilterGroupNode(node: Record<string, unknown>): boolean {\n  return Object.keys(node).some((k) => FILTER_GROUP_KEYS.has(k));\n}\n\n/** Flatten a field-bag Where node (`{ field: value | FilterOps }`) into leaves. */\nfunction fieldLeaves(node: Record<string, unknown>): BackendFilterLeaf[] {\n  const leaves: BackendFilterLeaf[] = [];\n  for (const [field, value] of Object.entries(node)) {\n    if (FILTER_GROUP_KEYS.has(field) || value === undefined) continue;\n    if (isFilterOpsObject(value)) {\n      for (const [op, opValue] of Object.entries(value)) {\n        if (opValue === undefined) continue;\n        leaves.push({ field, type: op, value: stringifyFilterValue(opValue) });\n      }\n    } else {\n      // Bare primitive → `equal`.\n      leaves.push({ field, type: 'equal', value: stringifyFilterValue(value) });\n    }\n  }\n  return leaves;\n}\n\n/**\n * Translate the SDK's recursive `Where` tree into the backend's filter-tree\n * wire shape. A grouping node maps to `{ filter_type, filters:[leaves],\n * filter_groups:[nested groups] }`; a bare field-bag maps to an AND of its\n * leaves.\n */\nfunction whereToBackendTree(\n  where: Where<Record<string, unknown>>,\n  defaultType: 'AND' | 'OR' = 'AND',\n): BackendFilterTree {\n  const obj = where as Record<string, unknown>;\n  const groupKey = Object.keys(obj).find((k) => FILTER_GROUP_KEYS.has(k)) as\n    | 'AND'\n    | 'OR'\n    | undefined;\n  if (groupKey) {\n    const children = (obj[groupKey] as Where<Record<string, unknown>>[]) ?? [];\n    const filters: BackendFilterLeaf[] = [];\n    const filter_groups: BackendFilterTree[] = [];\n    for (const child of children) {\n      const childObj = child as Record<string, unknown>;\n      if (isFilterGroupNode(childObj)) {\n        filter_groups.push(whereToBackendTree(child));\n      } else {\n        filters.push(...fieldLeaves(childObj));\n      }\n    }\n    return { filter_type: groupKey, filters, filter_groups };\n  }\n  // No grouping at this node — AND its field leaves.\n  return { filter_type: defaultType, filters: fieldLeaves(obj), filter_groups: [] };\n}\n\n/**\n * Distinguish a `FilterOps` operator object (`{ higher_than: 5 }`) from a\n * bare object value. We treat a plain object as a `FilterOps` bag; arrays\n * and `null` are bare values. This matches `FilterValue<V>`'s `V |\n * FilterOps` shape — the only object-typed bare values DashWise field\n * types carry (e.g. link-row arrays, file refs) are arrays or are filtered\n * by primitive ops anyway.\n */\nfunction isFilterOpsObject(value: unknown): value is Record<string, unknown> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    !Array.isArray(value)\n  );\n}\n\nfunction stringifyFilterValue(value: unknown): string {\n  // Booleans/numbers stringify to their literal form; `null` becomes the\n  // empty string (the backend reads an empty value for null-ish filters,\n  // matching the frontend `f.value ?? ''` convention).\n  if (value === null) return '';\n  return String(value);\n}\n\nfunction makeTableClient<\n  Row extends BaseRow,\n  Insert extends BaseInsert,\n  Update extends BaseUpdate,\n>(transport: HttpTransport, tableSlug: string): TableClient<Row, Insert, Update> {\n  const root = `/db/${tableSlug}`;\n\n  return {\n    async list(opts?: ListOpts<Row>): Promise<Page<Row>> {\n      // SDK Query Plane v1 Phase 2 slice 6 (2026-05-19): `.list()` now\n      // compiles to a Query AST and posts to the unified `/query`\n      // endpoint instead of `/db/<slug>/list`. The on-wire input\n      // shape is `{ ast: QueryAst }`; the output `Page<Row>` envelope\n      // is identical to what the legacy endpoint returned. Consumers\n      // see no behavior change — same fields accepted, same response.\n      //\n      // Why route through /query: single read path going forward.\n      // Future query-plane improvements (sub-query caching, observability,\n      // slow-query warnings) light up `.list()` automatically without\n      // touching this file again. The legacy `/db/<slug>/list` endpoint\n      // stays in place for non-SDK consumers (sandbox iframes, AI\n      // builder tooling that hits it directly).\n      //\n      // The other CRUD methods below (`.get` / `.create` / `.update` /\n      // `.delete`) keep using `/db/<slug>/...` — the query plane is\n      // read-only by design, and per-row reads + writes have no AST\n      // representation in v1.\n      const ast: Record<string, unknown> = {\n        v: 1,\n        from: { kind: 'owned', slug: tableSlug },\n      };\n      if (opts?.filter !== undefined) ast.where = opts.filter;\n      if (opts?.sort !== undefined && opts.sort.length > 0) {\n        ast.orderBy = opts.sort;\n      }\n      if (typeof opts?.limit === 'number') ast.limit = opts.limit;\n      if (typeof opts?.offset === 'number') ast.offset = opts.offset;\n\n      const result = await transport.request<Page<Row>>('POST', '/query', { ast });\n      // Defence in depth: same Page-envelope coercion as before. The\n      // query plane always returns a proper envelope today; this\n      // fallback covers misconfigured proxies + future endpoint shape\n      // drift.\n      if (Array.isArray(result)) {\n        return {\n          rows: result as Row[],\n          total: result.length,\n          limit: opts?.limit ?? result.length,\n          offset: opts?.offset ?? 0,\n        };\n      }\n      return result;\n    },\n\n    async get(id: number): Promise<Row> {\n      return transport.request<Row>('GET', `${root}/${id}`);\n    },\n\n    async create(body: Insert): Promise<Row> {\n      return transport.request<Row>('POST', root, body);\n    },\n\n    async update(id: number, patch: Update): Promise<Row> {\n      return transport.request<Row>('PATCH', `${root}/${id}`, patch);\n    },\n\n    async delete(id: number): Promise<void> {\n      await transport.request<void>('DELETE', `${root}/${id}`);\n    },\n  };\n}\n","/**\n * `createDevClient()` — `createClient()`'s zero-config sibling for local dev.\n *\n * Resolves `baseUrl` + `getToken` from a layered config chain so a\n * developer who has run `dashwise login` (and, for the full local-dev\n * experience, `dashwise init`) can do:\n *\n * ```ts\n * import { createDevClient } from '@dashai/sdk';\n * const client = createDevClient({ moduleSlug: 'my-tasks' });\n * ```\n *\n * …without copying tokens around. The flow this enables is the\n * end-to-end \"two-command bootstrap\" the CLI's `dashwise login` +\n * `dashwise init` pair targets.\n *\n * Phase 2 wire protocol: there is NO installation id anywhere in this\n * resolver — the backend resolves the install from the credential\n * (a scoped `dwk_` key or, in the AI builder sandbox, a session token),\n * and every request hits the install-agnostic `/api/module-api`.\n *\n * ## Resolution chain\n *\n * For each field, the first non-empty source wins:\n *\n *   1. Explicit `overrides` argument (per-call escape hatch).\n *   2. Environment variables — exactly `DASHWISE_API_URL` +\n *      `DASHWISE_API_KEY` (the Phase 2 two-var contract). Standard for\n *      CI, Docker, prod-like setups; also the path `dashwise dev` uses\n *      to inject the module's scoped `dwk_` key into the Next.js child.\n *   3. The CLI's saved config at `$XDG_CONFIG_HOME/dashwise/auth.json`\n *      (or platform default) — written by `dashwise login` (top-level\n *      `apiUrl` + `token`) and `dashwise init` / `register` (per-module\n *      entry under `modules[slug]`).\n *\n * ## Per-module local-dev credential (P1-C)\n *\n * When `overrides.moduleSlug` is set, the SDK looks up the per-module\n * entry in `auth.json`:\n *\n * ```jsonc\n * {\n *   \"apiUrl\": \"http://localhost:3000\",\n *   \"token\": \"dwc_...\",                // CLI bearer (login)\n *   \"modules\": {\n *     \"my-tasks\": {\n *       \"apiKey\": \"dwk_...\",           // scoped local-dev API key (P1-C)\n *       \"apiKeyId\": 88,                // module_api_keys row id\n *       \"installationId\": 4242,        // numeric install id (internal)\n *       \"expiresAt\": \"2026-08-22T...\"  // informational only\n *     }\n *   }\n * }\n * ```\n *\n * Per-module entries are written by `dashwise init` / `dashwise module\n * register` when a developer provisions a local-dev install. The SDK\n * prefers the per-module `apiKey` over the CLI bearer (`token`) when\n * both exist. The `installationId` on the entry is CLI-internal\n * bookkeeping (used only for admin URLs like `dashwise api-keys`); the\n * SDK never sends it — the key binds the install server-side.\n *\n * Back-compat: a pre-P1-C `auth.json` may carry a `runtimeToken` (90-day\n * JWT) instead of `apiKey`. The SDK still reads it as a last-resort\n * file fallback so old files keep working until `dashwise dev`\n * self-heals the entry to a `dwk_` key. The `DASHWISE_RUNTIME_TOKEN` /\n * `DASHWISE_API_TOKEN` / `DASHWISE_INSTALLATION_ID` env vars no longer\n * exist in Phase 2 and are not read here.\n *\n * If `moduleSlug` is unset, OR the named module isn't in the\n * `modules` map, OR the entry lacks a credential, the resolver\n * falls back to the deploy `DASHWISE_API_KEY` env, then the CLI bearer\n * (which the backend rejects on the module-API plane — surfacing as a\n * typed `UnauthenticatedError` on the first request).\n *\n * ## Safety rails\n *\n *   - **Production refusal.** When `NODE_ENV === 'production'`, the file\n *     fallback is skipped. Prod deploys MUST set env vars explicitly;\n *     accidentally shipping with `~/.config/dashwise/auth.json` baked into\n *     a Docker image would be a credential leak.\n *   - **Edge / browser refusal.** `fs` / `os` / `path` imports happen\n *     lazily inside a try/catch with a Node-detection guard. In edge or\n *     browser runtimes the file fallback is silently skipped — env vars\n *     are still honored.\n *   - **No throw on missing creds at construction time.** Same contract\n *     as `createClient()` — the throw happens at the first request when\n *     the resolver returns null AND the backend rejects the call. This\n *     lets bundlers tree-shake the function into builds where it's only\n *     called conditionally.\n *\n * ## When to use which\n *\n *   - `createClient(config)` — production, edge runtime, anywhere you\n *     want explicit control over auth resolution\n *   - `createDevClient()` — local development, REPL exploration, ad-hoc\n *     scripts where typing the env-var dance every time is friction\n *\n * Both return the same `Client` shape — switching is a one-line change.\n */\n\nimport { createClient } from './client.js';\nimport type { Client, ClientConfig, TokenResolver } from './types.js';\n\n/**\n * Subset of `ClientConfig` the caller can override on top of the\n * auto-resolved defaults. Anything omitted uses the resolution chain.\n *\n * `fetch`, `timeoutMs`, `headers`, `onSlowQuery`, `slowQueryThresholdMs`\n * are passed through unchanged when provided.\n */\nexport interface CreateDevClientOptions\n  extends Partial<Omit<ClientConfig, 'getToken'>> {\n  /**\n   * Per-request token resolver. If set, overrides the auto-resolved\n   * token entirely. Pass `() => null` to explicitly disable token\n   * attachment (rare — only useful for hitting public endpoints).\n   */\n  getToken?: TokenResolver;\n\n  /**\n   * P1-C — module slug for per-module API-key lookup.\n   *\n   * When set, `createDevClient` reads\n   * `~/.config/dashwise/auth.json#modules[<moduleSlug>]` looking for a\n   * scoped `dwk_` `apiKey` (a legacy `runtimeToken` is also honoured\n   * for old files). If found, it is used as the bearer (overriding the\n   * deploy `DASHWISE_API_KEY` / file-level `token`); the key binds to a\n   * specific install server-side, so no installation id is sent.\n   *\n   * If `moduleSlug` is unset or the entry is missing, the resolution\n   * chain falls through to the deploy `DASHWISE_API_KEY` env, then the\n   * CLI bearer (which the backend 401s on the module-API plane —\n   * surfacing as a typed `UnauthenticatedError` on the first request).\n   *\n   * Typical usage: scaffolded modules read `module.json#module.slug`\n   * and pass it here. The CLI's `dashwise dev` command instead exports\n   * the key as the `DASHWISE_API_KEY` env var so child processes (e.g.\n   * `next dev`) authenticate without re-reading the file or passing a\n   * slug.\n   */\n  moduleSlug?: string;\n}\n\n/**\n * Resolve config from env + saved CLI file + overrides, then hand off\n * to `createClient`. Synchronous — all sources are sync-readable.\n *\n * Throws only on truly unrecoverable problems (no `baseUrl` anywhere).\n * Missing token is fine at construction — the resolver returns null and\n * the backend's 401 surfaces a clear `UnauthenticatedError`.\n */\nexport function createDevClient(overrides: CreateDevClientOptions = {}): Client {\n  const fileConfig = readCliConfigFile();\n\n  const baseUrl =\n    overrides.baseUrl ??\n    readEnv('DASHWISE_API_URL') ??\n    fileConfig?.apiUrl ??\n    null;\n  if (!baseUrl) {\n    throw new Error(\n      '@dashai/sdk: createDevClient() could not resolve a baseUrl. ' +\n        'Pass `{ baseUrl }` explicitly, set `DASHWISE_API_URL`, or run `dashwise login` ' +\n        'to create the CLI config file.',\n    );\n  }\n\n  // P1-C: resolve the per-module dev credential. When `moduleSlug` is\n  // set, the file's `modules[slug]` carries a scoped `dwk_` `apiKey`\n  // (identity collapse — the 90-day runtime JWT is gone). We still read\n  // the legacy `runtimeToken` field as a last-resort file fallback for\n  // auth.json files written by an older CLI (self-heal tolerance); the\n  // `DASHWISE_RUNTIME_TOKEN` env is no longer honoured in Phase 2.\n  //\n  // A non-null dev credential here means the module authenticates as a\n  // specific local-dev install; it is preferred over both the deploy\n  // `DASHWISE_API_KEY` env and the user's CLI bearer.\n  const moduleEntry = overrides.moduleSlug\n    ? fileConfig?.modules?.[overrides.moduleSlug]\n    : undefined;\n  const devModuleToken =\n    moduleEntry?.apiKey ?? moduleEntry?.runtimeToken ?? null;\n\n  // Token resolution (Phase 2 two-var contract): per-module dev\n  // credential > deploy `DASHWISE_API_KEY` env > CLI bearer from the\n  // file. Snapshot at construction (same rationale as the original\n  // implementation — a developer would need to re-login + restart their\n  // dev server for the credential to change).\n  //\n  // `DASHWISE_API_KEY` (a scoped `dwk_` key) is the production-deploy\n  // credential AND what `dashwise dev` now injects for the child. It\n  // sits below the per-module dev credential (so an explicit\n  // `moduleSlug` file lookup wins) but above the CLI bearer. The legacy\n  // `DASHWISE_API_TOKEN` env is no longer read.\n  const snapshotToken =\n    devModuleToken ??\n    readEnv('DASHWISE_API_KEY') ??\n    fileConfig?.token ??\n    null;\n  const resolvedGetToken: TokenResolver =\n    overrides.getToken ?? (() => snapshotToken);\n\n  return createClient({\n    ...overrides,\n    baseUrl,\n    getToken: resolvedGetToken,\n  });\n}\n\n// ── Internals ───────────────────────────────────────────────────────────\n\n/** Minimal view of the CLI's `auth.json` — only the fields we use. */\ninterface CliConfigFileShape {\n  apiUrl?: string;\n  token?: string;\n  /**\n   * HH-CC-LDI-5 — per-module local-dev install metadata, keyed by\n   * the module's slug (matches `module.json#module.slug`).\n   *\n   * Written by `dashwise init` (LDI-6); read here for the per-module\n   * credential lookup. The SDK consumes `apiKey` (a legacy\n   * `runtimeToken` only as a fallback); `installationId` + `expiresAt`\n   * are CLI-internal (used for admin URLs / token-rotation flows) and\n   * never sent on the wire.\n   */\n  modules?: Record<string, CliConfigModuleEntry>;\n}\n\n/** Per-module entry within `auth.json#modules`. */\ninterface CliConfigModuleEntry {\n  /**\n   * P1-C — the module's scoped `dwk_` API key, minted by\n   * `POST /api/installations/dev`. Canonical per-module credential;\n   * preferred over `runtimeToken`.\n   */\n  apiKey?: string;\n  /** DB id of the `module_api_keys` row (informational). */\n  apiKeyId?: number;\n  /**\n   * @deprecated Legacy 90-day JWT runtime token (pre-identity-collapse).\n   * Present only in `auth.json` files written by an older CLI. Read here\n   * for back-compat until `dashwise dev` self-heals the entry to an\n   * `apiKey`.\n   */\n  runtimeToken?: string;\n  /** Numeric installation id the credential resolves to. */\n  installationId?: number;\n  /** ISO timestamp; informational only (not enforced client-side). */\n  expiresAt?: string;\n}\n\n/**\n * Read an env var with empty-string treated as unset. Safe on edge /\n * browser builds where `process` may be a polyfill shim with no `env`.\n */\nfunction readEnv(key: string): string | undefined {\n  if (typeof process === 'undefined' || !process.env) return undefined;\n  const v = process.env[key];\n  return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n\n/**\n * Detect whether we're in a Node-like runtime that can actually `import\n * 'node:fs'`. Edge runtime, Cloudflare Workers, Deno without compat,\n * and browsers all fail this check.\n */\nfunction isNodeRuntime(): boolean {\n  if (typeof process === 'undefined') return false;\n  if (!process.versions || typeof process.versions.node !== 'string') {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Load + parse `auth.json` from the CLI's config directory. Returns\n * `null` if:\n *   - We're not in Node (edge / browser)\n *   - `NODE_ENV === 'production'` (prod must use env vars; refusing the\n *     file fallback is the safety rail against accidental credential\n *     leaks into Docker images)\n *   - The file doesn't exist (user hasn't run `dashwise login`)\n *   - The file exists but is unreadable / unparseable (corrupt — caller\n *     should re-login; we don't surface a noisy warning because the\n *     env-var path is still valid)\n *\n * Mirrors the path resolution in `@dashai/cli`'s\n * `packages/cli/src/lib/config.ts#configPath()` — kept in sync by\n * convention since the SDK can't depend on the CLI.\n */\nfunction readCliConfigFile(): CliConfigFileShape | null {\n  if (!isNodeRuntime()) return null;\n  if (readEnv('NODE_ENV') === 'production') return null;\n  try {\n    // Lazy require so bundlers that don't tree-shake the function call\n    // (e.g. esbuild without `--platform=node`) still drop the imports\n    // when this branch is unreachable at build time.\n    //\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const fs = require('node:fs') as typeof import('node:fs');\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const path = require('node:path') as typeof import('node:path');\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const os = require('node:os') as typeof import('node:os');\n\n    const dir = resolveConfigDir(path, os);\n    const file = path.join(dir, 'auth.json');\n    if (!fs.existsSync(file)) return null;\n\n    const raw = fs.readFileSync(file, 'utf-8');\n    const parsed = JSON.parse(raw) as unknown;\n    if (!isPlausibleFileShape(parsed)) return null;\n    return parsed;\n  } catch {\n    // Any failure → fall through to env-var-only mode. We deliberately\n    // don't log here: a missing / corrupt file is \"no fallback\n    // available,\" not \"something is broken.\" If env vars are also\n    // missing, the createClient-level error message will guide the\n    // developer to run `dashwise login`.\n    return null;\n  }\n}\n\n/**\n * Resolve the CLI's config directory. Same priority as the CLI:\n *   1. `$XDG_CONFIG_HOME/dashwise/`\n *   2. `%APPDATA%\\dashwise\\` on Windows\n *   3. `~/.config/dashwise/` everywhere else\n */\nfunction resolveConfigDir(\n  path: typeof import('node:path'),\n  os: typeof import('node:os'),\n): string {\n  const xdg = readEnv('XDG_CONFIG_HOME');\n  if (xdg) return path.join(xdg, 'dashwise');\n  if (os.platform() === 'win32') {\n    const appdata = readEnv('APPDATA');\n    if (appdata) return path.join(appdata, 'dashwise');\n  }\n  return path.join(os.homedir(), '.config', 'dashwise');\n}\n\nfunction isPlausibleFileShape(v: unknown): v is CliConfigFileShape {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  // We accept anything that LOOKS like an auth.json. If `apiUrl` /\n  // `token` are missing or wrong-typed, our resolution chain falls\n  // through to the next source — same as if the file didn't exist.\n  //\n  // HH-CC-LDI-5: `modules` is a record-shaped optional. We don't\n  // deep-validate per-entry shapes — if a `modules[slug]` is\n  // garbage, the runtime-token resolver just returns null and the\n  // legacy chain takes over. Forgiveness over strictness keeps the\n  // SDK resilient to a partially-written `auth.json` (e.g. the CLI\n  // crashed mid-write during `init`).\n  const apiUrlOk = o.apiUrl === undefined || typeof o.apiUrl === 'string';\n  const tokenOk = o.token === undefined || typeof o.token === 'string';\n  const modulesOk =\n    o.modules === undefined ||\n    (typeof o.modules === 'object' && o.modules !== null);\n  return apiUrlOk && tokenOk && modulesOk;\n}\n","/**\n * @dashai/sdk — public entry point.\n *\n * Two planes:\n *   - **data**: typed table client (`createClient`, `db<Row>(slug)`,\n *     `Where<Row>`, `Page<T>`, `DashwiseError` + subclasses).\n *     Re-exported from the default barrel.\n *   - **auth**: server / middleware / client helpers for session\n *     management. Imported via subpaths so consumers don't pull in\n *     React / `next/headers` if they only need data.\n *\n * Auth surface (all subpath-imported):\n *   - `@dashai/sdk/auth/server`     — `getServerSession`, `exchangeCode`, `signOut`\n *   - `@dashai/sdk/auth/middleware` — `withAuth()` Next.js edge middleware factory\n *   - `@dashai/sdk/auth/client`     — `useSession`, `<AuthProvider>`, `<SignOutButton>`\n *   - `@dashai/sdk/auth/types`      — `Session`, `AuthOptions`, `AuthErrorCode`\n *\n * SemVer policy: every named export here AND every named export from\n * the `auth/*` subpaths is part of the stable API. Breaking changes\n * require a major bump; new optional fields, new types, and additional\n * named exports are minors.\n *\n * Distribution model (per the v1 plan in\n * `dashwise-devops-docs/plans/modules-p8-p10-execution-plan.md`):\n *   - **AI builder sandbox**: SDK is baked into the E2B template image.\n *   - **CLI / local dev**: workspace-local resolution via pnpm\n *     `workspace:*` protocol OR tarball-into-`.dashwise/sdk-tarball.tgz`.\n *   - **Published modules**: SDK is pre-bundled into the Lambda image\n *     by `next build`; no runtime fetch required.\n *\n * npm publication is intentionally deferred — the SDK is consumed by\n * trusted, in-workspace paths, not by external developers (yet).\n *\n * @packageDocumentation\n */\n\nexport * from './data/index.js';\n\n/**\n * SDK package version. Replaced at build time by `tsup`'s `define`\n * substitution (see `tsup.config.ts`) with the value of `version`\n * from `packages/sdk/package.json`. Consumers can read this to\n * version-skew-detect against the manifest's required SDK range.\n *\n * In non-tsup contexts (Vitest, raw `tsc`), the bare `__SDK_VERSION__`\n * identifier resolves to a static `'dev'` fallback declared below.\n * Production builds always go through tsup so the build-time value\n * is what ships.\n */\ndeclare const __SDK_VERSION__: string;\nexport const VERSION: string =\n  typeof __SDK_VERSION__ === 'string' ? __SDK_VERSION__ : 'dev';\n"]}