@k9o/core 1.2.0 → 1.3.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/data/from.ts","../src/projects.ts","../src/storage-buckets.ts","../src/provider-region.ts","../src/storage-locations.ts","../src/metadata.ts","../src/migrations.ts","../src/functions.ts","../src/policies.ts","../src/audit.ts","../src/orgs.ts","../src/org.ts","../src/me.ts","../src/studio/workflows.ts","../src/studio/dashboards.ts","../src/studio/index.ts","../src/internal/sse.ts","../src/compute/llms.ts","../src/ai.ts","../src/realtime.ts","../src/gate-bridge.ts","../src/extensions-bridge.ts","../src/index.ts","../src/byos.ts"],"sourcesContent":["/**\n * Data-plane DSL: `client.from(collection).select()` etc.\n *\n * The DSL is a\n * chainable builder that composes a query against a project's user-\n * collection. The chain terminates in a verb (`select`, `insert`,\n * `update`, `delete`) that issues the HTTP request and returns the\n * envelope.\n *\n * Wire mapping:\n *   - `from('posts').select()`                          → GET    /@<projectSlug>/data/posts\n *   - `from('posts').select().eq('id','rec_X')`         → GET    /@<projectSlug>/data/posts?id=eq.rec_X\n *   - `from('posts').insert({ title: '...' })`          → POST   /@<projectSlug>/data/posts\n *   - `from('posts').update({ title: '...' }).eq(...)`  → PATCH  /@<projectSlug>/data/posts/:id\n *   - `from('posts').delete().eq('id','rec_X')`         → DELETE /@<projectSlug>/data/posts/:id\n *\n * Filters compose as AND; multiple chained `.eq()` /\n * `.gt()` / etc. calls all attach to the query string.\n *\n * Pagination + counting: `.limit(n)`, `.cursor(opaque)`,\n * `.count('none' | 'exact' | 'estimated')`. The returned envelope's\n * `meta.cursor.next` is the cursor for the next page.\n *\n * Per KError delivery: every terminal verb throws KError on\n * non-2xx. Caller catches via `instanceof KError` + narrows on `.code`.\n */\n\nimport { projectPath, validateSlug } from \"../url-grammar.ts\";\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { KError } from \"../kerror.ts\";\nimport type { Envelope } from \"../envelope.ts\";\nimport type { FilterOp } from \"../types.ts\";\n\n/**\n * Internal filter representation. Serialised to query parameters at\n * terminal-verb time.\n */\ntype Filter = {\n  column: string;\n  op: FilterOp;\n  value: string | number | boolean | ReadonlyArray<string | number>;\n};\n\n/**\n * Query builder shared across all verbs. The `select`/`insert`/`update`/\n * `delete` factories below extend this via composition so the chainable\n * shape is consistent.\n */\nclass QueryBuilder {\n  protected filters: Filter[] = [];\n  protected limitVal?: number;\n  protected cursorVal?: string;\n  protected countMode?: \"none\" | \"exact\" | \"estimated\";\n\n  /**\n   * Attach an equality filter. Composes with other filters via AND.\n   */\n  eq(column: string, value: string | number | boolean): this {\n    this.filters.push({ column, op: \"eq\", value });\n    return this;\n  }\n\n  neq(column: string, value: string | number | boolean): this {\n    this.filters.push({ column, op: \"neq\", value });\n    return this;\n  }\n\n  gt(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"gt\", value });\n    return this;\n  }\n\n  gte(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"gte\", value });\n    return this;\n  }\n\n  lt(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"lt\", value });\n    return this;\n  }\n\n  lte(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"lte\", value });\n    return this;\n  }\n\n  in(column: string, values: ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op: \"in\", value: values });\n    return this;\n  }\n\n  notIn(column: string, values: ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op: \"notIn\", value: values });\n    return this;\n  }\n\n  like(column: string, pattern: string): this {\n    this.filters.push({ column, op: \"like\", value: pattern });\n    return this;\n  }\n\n  ilike(column: string, pattern: string): this {\n    this.filters.push({ column, op: \"ilike\", value: pattern });\n    return this;\n  }\n\n  is(column: string, value: \"null\" | \"true\" | \"false\"): this {\n    this.filters.push({ column, op: \"is\", value });\n    return this;\n  }\n\n  /**\n   * Attach a `.filter(column, op, value)` for explicit op selection.\n   */\n  filter(column: string, op: FilterOp, value: string | number | boolean | ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op, value });\n    return this;\n  }\n\n  /**\n   * Page-size hint (default per gateway tier; max bounded server-side).\n   */\n  limit(n: number): this {\n    this.limitVal = n;\n    return this;\n  }\n\n  /**\n   * Opaque cursor for next-page fetch — returned in prior response's\n   * `meta.cursor.next`.\n   */\n  cursor(opaque: string): this {\n    this.cursorVal = opaque;\n    return this;\n  }\n\n  /**\n   * Total-count behaviour. `none` (default) skips the\n   * count query (cheapest); `exact` runs `SELECT COUNT(*)` (most\n   * expensive at scale); `estimated` reads from pg_stats (fast +\n   * approximate).\n   */\n  count(mode: \"none\" | \"exact\" | \"estimated\"): this {\n    this.countMode = mode;\n    return this;\n  }\n\n  /**\n   * Serialise filters + pagination + count to query parameters.\n   * Format: per-filter `<column>=<op>.<value>`; multi-value (in/notIn)\n   * uses comma-joined parenthesised value `<col>=in.(a,b,c)`.\n   */\n  protected toQuery(): Record<string, string | number | undefined> {\n    const q: Record<string, string | number | undefined> = {};\n    for (const f of this.filters) {\n      const val = Array.isArray(f.value)\n        ? `(${(f.value as ReadonlyArray<string | number>).join(\",\")})`\n        : String(f.value);\n      // Multiple filters on the same column are not currently supported via\n      // the simple key=value query map. future cycles cover\n      // `.or()` / multi-filter — when those land the builder will switch\n      // to a serialisation that supports collisions.\n      q[f.column] = `${f.op}.${val}`;\n    }\n    if (this.limitVal !== undefined) q[\"limit\"] = this.limitVal;\n    if (this.cursorVal !== undefined) q[\"cursor\"] = this.cursorVal;\n    if (this.countMode !== undefined) q[\"count\"] = this.countMode;\n    return q;\n  }\n}\n\n/**\n * Terminal-verb builder returned by `from(collection)`. Each verb method\n * returns a sub-builder that resolves to the HTTP envelope when awaited.\n */\nclass FromBuilder {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {}\n\n  /**\n   * Initiate a SELECT query. Returns a chainable filter/page builder\n   * that resolves to the data envelope on await.\n   */\n  select<T = unknown>(): SelectBuilder<T> {\n    return new SelectBuilder<T>(this.config, this.collection);\n  }\n\n  /**\n   * Insert one record. Returns the inserted record (with platform-\n   * generated `id` + `metadata`).\n   */\n  async insert<T = unknown>(record: Partial<T>): Promise<Envelope<T>> {\n    return request<T>(this.config, {\n      method: \"POST\",\n      path: collectionPath(this.config, this.collection),\n      body: record,\n    });\n  }\n\n  /**\n   * Initiate an UPDATE. Returns a builder; the chain MUST include a\n   * filter clause (typically `.eq('id', 'rec_...')`) and resolves to\n   * the updated record envelope.\n   */\n  update<T = unknown>(patch: Partial<T>): UpdateBuilder<T> {\n    return new UpdateBuilder<T>(this.config, this.collection, patch);\n  }\n\n  /**\n   * Initiate a DELETE. Returns a builder; the chain MUST include a\n   * filter clause and resolves to the deleted record envelope.\n   */\n  delete<T = unknown>(): DeleteBuilder<T> {\n    return new DeleteBuilder<T>(this.config, this.collection);\n  }\n}\n\nclass SelectBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<ReadonlyArray<T>>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<ReadonlyArray<T>>> {\n    return request<ReadonlyArray<T>>(this.config, {\n      method: \"GET\",\n      path: collectionPath(this.config, this.collection),\n      query: this.toQuery(),\n    });\n  }\n\n  then<TResult1 = Envelope<ReadonlyArray<T>>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<ReadonlyArray<T>>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\nclass UpdateBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n    private readonly patch: Partial<T>,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<T>> {\n    const idFilter = this.filters.find((f) => f.column === \"id\" && f.op === \"eq\");\n    if (idFilter === undefined) {\n      throw new KError({\n        code: \"K9O_INVALID_FIELD_VALUE\",\n        message: \"update() requires an `.eq('id', '...')` filter; changing many rows in one call is not supported\",\n        context: { collection: this.collection },\n        recommendation: \"Chain `.eq('id', 'rec_…')` before awaiting the update; to change several rows, call update once per id.\",\n      });\n    }\n    return request<T>(this.config, {\n      method: \"PATCH\",\n      path: `${collectionPath(this.config, this.collection)}/${encodeURIComponent(String(idFilter.value))}`,\n      body: this.patch,\n    });\n  }\n\n  then<TResult1 = Envelope<T>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<T>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\nclass DeleteBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<T>> {\n    const idFilter = this.filters.find((f) => f.column === \"id\" && f.op === \"eq\");\n    if (idFilter === undefined) {\n      throw new KError({\n        code: \"K9O_INVALID_FIELD_VALUE\",\n        message: \"delete() requires an `.eq('id', '...')` filter; deleting many rows in one call is not supported\",\n        context: { collection: this.collection },\n        recommendation: \"Chain `.eq('id', 'rec_…')` before awaiting the delete; to delete several rows, call delete once per id.\",\n      });\n    }\n    return request<T>(this.config, {\n      method: \"DELETE\",\n      path: `${collectionPath(this.config, this.collection)}/${encodeURIComponent(String(idFilter.value))}`,\n    });\n  }\n\n  then<TResult1 = Envelope<T>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<T>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\n/**\n * Build the collection-records URL path. Requires `config.projectSlug`\n * to be bound; member-plane resources route via the `/@<projectSlug>/...`\n * prefix per the URL grammar.\n */\nfunction collectionPath(config: HttpClientConfig, collection: string): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"data-plane operations require projectSlug to be bound on the client\",\n      context: { collection },\n      recommendation: \"Pass `projectSlug` in createClient options or use a project-scoped sub-client.\",\n    });\n  }\n  validateSlug(config.projectSlug, \"project\");\n  // Validate collection name shape — same slug grammar.\n  if (!/^[a-z][a-z0-9_-]{0,62}$/.test(collection)) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: `collection name \"${collection}\" does not match required format`,\n      context: { collection },\n      recommendation: \"Use lowercase letters / digits / underscores / hyphens; start with a letter; 1-63 chars.\",\n    });\n  }\n  return projectPath(config.projectSlug, `data/${collection}`);\n}\n\n/**\n * Factory — entry point for the data-plane DSL. Returned via\n * `client.from(collection)` on the K9oClient instance.\n */\nexport function makeFromFactory(config: HttpClientConfig) {\n  return function from(collection: string): FromBuilder {\n    return new FromBuilder(config, collection);\n  };\n}\n","/**\n * Project lifecycle SDK methods — `client.projects.*`.\n *\n * Wire mapping per gateway routes (`services/gateway/src/routes/projects-crud.ts` +\n * `discovery.ts`):\n *   - `client.projects.list()`           → GET    /projects\n *   - `client.projects.create({...})`    → POST   /projects\n *   - `client.projects.get(slug)`        → GET    /@<projectSlug>/project\n *   - `client.projects.update(slug,...)` → PATCH  /@<projectSlug>/project\n *\n * The `list` + `create` operations operate org-plane and require\n * `orgSlug` to be bound on the client (or the bearer token to carry\n * an org context). The `get` + `update` operations\n * operate member-plane and use the project slug.\n *\n * Per: all methods throw KError on non-2xx.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath, projectPath, validateSlug } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Project shape. Fields are typed per the canonical shape;\n * the gateway may return additional fields that this type doesn't\n * narrow — those are accessible via `as unknown as` widening.\n */\nexport type Project = {\n  /** `proj_<base62>`. */\n  id: string;\n  slug: string;\n  name: string;\n  custodyMode: \"managed\" | \"byok\" | \"hyok\";\n  createdAt: string;\n  updatedAt: string | null;\n  orgId: string;\n};\n\n/**\n * Project-creation input.\n */\nexport type CreateProjectInput = {\n  slug: string;\n  name: string;\n  custodyMode?: \"managed\" | \"byok\" | \"hyok\" | undefined;\n};\n\n/**\n * Project-update patch.\n */\nexport type UpdateProjectInput = {\n  name?: string;\n};\n\n/**\n * Factory — produces the `client.projects.*` namespace bound to the\n * supplied config.\n */\nexport function makeProjectsNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * List projects accessible to the caller. Requires authenticated\n     * session; results are scoped by RBAC.\n     */\n    async list(): Promise<Envelope<ReadonlyArray<Project>>> {\n      return request<ReadonlyArray<Project>>(config, {\n        method: \"GET\",\n        path: orgPath(\"projects\"),\n      });\n    },\n\n    /**\n     * Create a new project under the caller's active org.\n     */\n    async create(input: CreateProjectInput): Promise<Envelope<Project>> {\n      validateSlug(input.slug, \"project\");\n      return request<Project>(config, {\n        method: \"POST\",\n        path: orgPath(\"projects\"),\n        body: input,\n      });\n    },\n\n    /**\n     * Get a project by slug. Returns the project record + meta.\n     */\n    async get(slug: string): Promise<Envelope<Project>> {\n      validateSlug(slug, \"project\");\n      return request<Project>(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"project\"),\n      });\n    },\n\n    /**\n     * Update a project's mutable fields.\n     */\n    async update(slug: string, patch: UpdateProjectInput): Promise<Envelope<Project>> {\n      validateSlug(slug, \"project\");\n      return request<Project>(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, \"project\"),\n        body: patch,\n      });\n    },\n  };\n}\n","/**\n * `client.storage` buckets and objects: per-project logical buckets and the objects in them, against\n * `/@<projectSlug>/storage/buckets…`. `client.storage.locations.*` (the customer's own object stores) lives in\n * `storage-locations.ts` and is unchanged.\n *\n * Bucket names are logical: the platform resolves them to a physical store, so a developer never sees a\n * physical bucket or key. Signed URLs require an explicit `expiresIn` (no default, max 7 days).\n *\n * What is NOT here yet, by design: a signed PUT (a method- and content-type-bound upload URL). The gateway has\n * no route for it; uploads go through the multipart `upload` below.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** A bucket. */\nexport type StorageBucket = {\n  name: string;\n  /** `true` removes the authentication requirement on GET; per-object access policies still apply. */\n  public: boolean;\n  /** Bytes; `null` = no limit. */\n  fileSizeLimit: number | null;\n  /** MIME allow-list; empty = any. */\n  allowedMimeTypes: string[];\n  versioning: boolean;\n  /** Lifecycle auto-expiry in days; `null` = never. */\n  deleteAfterDays: number | null;\n  createdAt: string;\n  updatedAt: string;\n  /** Platform-owned buckets (for example audit assets) cannot be written through the public routes. */\n  system: boolean;\n  /** The storage location the bucket is linked to, or `null` for platform-managed storage. */\n  byosBindingId: string | null;\n};\n\n/** Options for `createBucket`. The bucket name is the first argument (3 to 63 chars, lowercase, digits, hyphens). */\nexport type CreateBucketOptions = {\n  public?: boolean;\n  fileSizeLimit?: number;\n  allowedMimeTypes?: string[] | null;\n  versioning?: boolean;\n  deleteAfterDays?: number;\n  /** Link the bucket to one of the project's storage locations (see `client.storage.locations`). */\n  byosBindingId?: string;\n};\n\n/** Fields you may change on a bucket. `null` clears a limit; `allowedMimeTypes: null` allows any type. */\nexport type UpdateBucketOptions = {\n  public?: boolean;\n  fileSizeLimit?: number | null;\n  allowedMimeTypes?: string[] | null;\n  versioning?: boolean;\n  deleteAfterDays?: number | null;\n  /** `null` unlinks the bucket from its storage location. */\n  byosBindingId?: string | null;\n};\n\n/** An object listing entry. `path` is relative to the bucket. */\nexport type StorageObject = {\n  path: string;\n  size: number;\n  lastModified: string | null;\n};\n\nexport type UploadOptions = {\n  /** Defaults to the data's own type when it is a `Blob`. */\n  contentType?: string;\n  /** `false` (default) refuses to overwrite an existing path (`409 K9O_ALREADY_EXISTS`). */\n  upsert?: boolean;\n  /** Caller-defined string metadata: at most 10 keys and 2 KB in total (enforced by the gateway). */\n  metadata?: Record<string, string>;\n};\n\nexport type SignedUrlOptions = {\n  /** Seconds, required: 1 to 604800 (7 days). There is deliberately no default. */\n  expiresIn: number;\n  /** `true` makes the download an attachment (`Content-Disposition: attachment`). */\n  download?: boolean;\n};\n\nexport type SignedUrl = { signedUrl: string; expiresIn: number };\nexport type RemovedObject = { bucket: string; path: string; deleted: boolean };\nexport type DeletedBucket = { name: string; deleted: true; objectsDeleted: number };\n\nconst MAX_EXPIRES_IN = 604_800;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (config.projectSlug === undefined || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"client.storage buckets and objects require a bound projectSlug (per-project resource)\",\n      context: {},\n      recommendation: \"Pass projectSlug when constructing the client.\",\n    });\n  }\n  return config.projectSlug;\n}\n\nconst bucketsPath = (config: HttpClientConfig, suffix = \"\"): string =>\n  projectPath(requireProjectSlug(config), `storage/buckets${suffix}`);\n\nconst bucketPath = (config: HttpClientConfig, name: string, suffix = \"\"): string => {\n  if (name.length === 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"bucket name must not be empty\",\n      context: { field: \"bucket\", reason: \"empty\" },\n      recommendation: null,\n    });\n  }\n  // `.` and `..` survive percent-encoding and are collapsed as dot segments by the URL layer BEFORE the request leaves,\n  // so a bucket named `..` would address a different route. No bucket can have that name (3 to 63 chars), so refuse it\n  // here rather than send a rewritten URL.\n  if (name === \".\" || name === \"..\") {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"bucket name must not be a dot segment\",\n      context: { field: \"bucket\", reason: \"dot_segment\" },\n      recommendation: null,\n    });\n  }\n  return bucketsPath(config, `/${encodeURIComponent(name)}${suffix}`);\n};\n\nfunction requireObjectPath(path: string): void {\n  if (path.length === 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"object path must not be empty\",\n      context: { field: \"path\", reason: \"empty\" },\n      recommendation: null,\n    });\n  }\n}\n\nfunction requireExpiresIn(expiresIn: unknown): asserts expiresIn is number {\n  if (typeof expiresIn !== \"number\" || !Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_EXPIRES_IN) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: `expiresIn is required and must be an integer from 1 to ${MAX_EXPIRES_IN} seconds`,\n      context: { field: \"expiresIn\", reason: \"out_of_range\" },\n      recommendation: \"Pass an explicit expiresIn; signed URLs have no default lifetime.\",\n    });\n  }\n}\n\nfunction toBlob(data: Blob | Uint8Array | ArrayBuffer | string, contentType?: string): Blob {\n  const init = contentType !== undefined ? { type: contentType } : {};\n  if (data instanceof Blob) return contentType !== undefined && data.type !== contentType ? new Blob([data], init) : data;\n  if (typeof data === \"string\") return new Blob([data], init);\n  return new Blob([data as unknown as ArrayBuffer], init);\n}\n\n/** A handle on one bucket: `client.storage.from(\"avatars\")`. */\nexport function makeBucketHandle(config: HttpClientConfig, bucket: string) {\n  return {\n    /**\n     * Upload an object. `POST /@<projectSlug>/storage/buckets/<bucket>/objects` (multipart). The bytes pass through\n     * the gateway; the bucket's size and MIME limits are enforced there.\n     */\n    async upload(path: string, data: Blob | Uint8Array | ArrayBuffer | string, options: UploadOptions = {}): Promise<Envelope<StorageObject>> {\n      requireObjectPath(path);\n      const form = new FormData();\n      form.append(\"file\", toBlob(data, options.contentType), path.split(\"/\").pop() || \"file\");\n      form.append(\"path\", path);\n      if (options.contentType !== undefined) form.append(\"contentType\", options.contentType);\n      form.append(\"upsert\", options.upsert === true ? \"true\" : \"false\");\n      if (options.metadata !== undefined) form.append(\"metadata\", JSON.stringify(options.metadata));\n      return request<StorageObject>(config, { method: \"POST\", path: bucketPath(config, bucket, \"/objects\"), body: form });\n    },\n\n    /**\n     * A pre-authenticated GET URL for one object. `POST …/objects/sign`. `expiresIn` is required.\n     * (A signed PUT is not offered: the gateway has no route for it yet.)\n     */\n    async createSignedUrl(path: string, options: SignedUrlOptions): Promise<Envelope<SignedUrl>> {\n      requireObjectPath(path);\n      requireExpiresIn(options?.expiresIn);\n      return request<SignedUrl>(config, {\n        method: \"POST\",\n        path: bucketPath(config, bucket, \"/objects/sign\"),\n        body: { path, expiresIn: options.expiresIn, ...(options.download !== undefined ? { download: options.download } : {}) },\n      });\n    },\n\n    /** List objects, optionally under a prefix. `GET …/objects?prefix=`. */\n    async list(options: { prefix?: string } = {}): Promise<Envelope<ReadonlyArray<StorageObject>>> {\n      return request<ReadonlyArray<StorageObject>>(config, {\n        method: \"GET\",\n        path: bucketPath(config, bucket, \"/objects\"),\n        ...(options.prefix !== undefined ? { query: { prefix: options.prefix } } : {}),\n      });\n    },\n\n    /** Delete one object. `DELETE …/objects?path=`. */\n    async remove(path: string): Promise<Envelope<RemovedObject>> {\n      requireObjectPath(path);\n      return request<RemovedObject>(config, { method: \"DELETE\", path: bucketPath(config, bucket, \"/objects\"), query: { path } });\n    },\n  };\n}\n\n/** Bucket operations; merged into `client.storage` next to `locations`. */\nexport function makeBucketOperations(config: HttpClientConfig) {\n  return {\n    /** List the project's buckets. `GET /@<projectSlug>/storage/buckets`. */\n    async listBuckets(): Promise<Envelope<ReadonlyArray<StorageBucket>>> {\n      return request<ReadonlyArray<StorageBucket>>(config, { method: \"GET\", path: bucketsPath(config) });\n    },\n\n    /** Read one bucket. `GET …/buckets/<name>`. */\n    async getBucket(name: string): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"GET\", path: bucketPath(config, name) });\n    },\n\n    /**\n     * Create a bucket. `POST …/buckets`. A name outside 3 to 63 lowercase letters, digits and hyphens is refused\n     * (`INVALID_BUCKET_NAME`).\n     */\n    async createBucket(name: string, options: CreateBucketOptions = {}): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"POST\", path: bucketsPath(config), body: { name, ...options } });\n    },\n\n    /** Change a bucket. `PATCH …/buckets/<name>`. */\n    async updateBucket(name: string, options: UpdateBucketOptions): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"PATCH\", path: bucketPath(config, name), body: options });\n    },\n\n    /**\n     * Delete a bucket. `DELETE …/buckets/<name>`. A non-empty bucket is refused unless `empty: true`, which purges\n     * its objects first.\n     */\n    async deleteBucket(name: string, options: { empty?: boolean } = {}): Promise<Envelope<DeletedBucket>> {\n      return request<DeletedBucket>(config, {\n        method: \"DELETE\",\n        path: bucketPath(config, name),\n        ...(options.empty === true ? { query: { empty: \"true\" } } : {}),\n      });\n    },\n\n    /** A handle on one bucket for object operations: `from(\"avatars\").upload(...)`. */\n    from(bucket: string) {\n      return makeBucketHandle(config, bucket);\n    },\n  };\n}\n","/**\n * The provider's own name for a bucket's location (`providerRegion`), as opposed to the platform region (a short code\n * such as `de01`). It goes into hostnames (`s3.<r>.amazonaws.com`, `sts.<r>.amazonaws.com`, `s3.<r>.backblazeb2.com`),\n * so a value like `x.attacker.net#` would aim a SigV4-signed request at a host the caller chose. The gateway checks the\n * same closed grammar on write and again where each endpoint is built; checking it here first means a bad value is\n * refused before any request is sent and before a credential envelope is sealed.\n *\n * Grammars (the Step 0 ruling for the BYOS split):\n *   - `s3` (AWS):      `^[a-z]{2}(-gov)?-[a-z]+-\\d$`        e.g. `us-east-1`, `us-gov-west-1`\n *   - `b2`:            `^[a-z]{2}-[a-z]+-\\d{3}$`            e.g. `eu-central-003`\n *   - `r2`:            `auto` only\n *   - `gcs`, `azure_blob`: lower-case letters, digits and `-`, 1 to 32 characters, first and last alphanumeric (the gateway's bound)\n *   - `s3_compatible`, `minio`: the same closed charset as GCS and Azure. The ruling gives the AWS grammar only for an\n *     S3-compatible store that uses an AWS endpoint; every other region name is accepted only if it cannot reshape a host.\n */\n\nimport { KError } from \"./kerror.ts\";\n\nexport type ProviderRegionProvider = \"s3\" | \"s3_compatible\" | \"gcs\" | \"azure_blob\" | \"minio\" | \"r2\" | \"b2\";\n\nconst CHARSET = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;\nconst GRAMMAR: Record<ProviderRegionProvider, (v: string) => boolean> = {\n  s3: (v) => /^[a-z]{2}(-gov)?-[a-z]+-\\d$/.test(v),\n  b2: (v) => /^[a-z]{2}-[a-z]+-\\d{3}$/.test(v),\n  r2: (v) => v === \"auto\",\n  gcs: (v) => CHARSET.test(v),\n  azure_blob: (v) => CHARSET.test(v),\n  s3_compatible: (v) => CHARSET.test(v),\n  minio: (v) => CHARSET.test(v),\n};\n\n/** True if `value` is a well-formed provider region for `provider`; with no provider, the closed charset only. */\nexport function isProviderRegion(value: unknown, provider?: ProviderRegionProvider): boolean {\n  if (typeof value !== \"string\" || value.length === 0) return false;\n  return provider === undefined ? CHARSET.test(value) : GRAMMAR[provider](value);\n}\n\n/**\n * Throw `K9O_INVALID_FIELD_VALUE` (`reason: \"provider_region_invalid\"`, the gateway's own reason) unless `value` is a\n * well-formed provider region. The value is never echoed.\n */\nexport function assertProviderRegion(value: unknown, provider?: ProviderRegionProvider): void {\n  if (isProviderRegion(value, provider)) return;\n  throw new KError({\n    code: \"K9O_INVALID_FIELD_VALUE\",\n    message:\n      provider === undefined\n        ? \"providerRegion must be lower-case letters, digits and '-' (at most 32 characters)\"\n        : `providerRegion is not a valid ${provider} region`,\n    context: { field: \"providerRegion\", reason: \"provider_region_invalid\", ...(provider !== undefined ? { provider } : {}) },\n    recommendation:\n      provider === \"r2\" ? \"Use `auto` for R2.\" : \"Pass the provider's own region name (for example `us-east-1`), not the platform region (`de01`).\",\n  });\n}\n","/**\n * `client.storage.locations.*` — storage locations: the customer's own object stores (Bring-Your-Own-Store),\n * registered once per project and then linked to buckets and Datasets. Per-project CRUD against\n * `/@<projectSlug>/storage/locations`; it replaces the withdrawn purpose-based `client.byos.*` /\n * `/@<projectSlug>/byos` (hard cutover: the old routes answer 404).\n *\n * Deliberately independent of `byos.ts` (the credential pre-create/reference helpers) and of\n * `client.kibo.vault.secrets` — a location's `credentialRef` is just a string here. The caller pre-creates the\n * credential separately (`k9o byos-cred create` / `client.kibo.vault.secrets.create`) and passes the resulting\n * `kibo://byos-creds/<secId>` reference in; this namespace never creates, reads or returns a credential.\n *\n * A location carries no \"purpose\": which bucket or Dataset uses it is decided at link time, not here.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport { makeBucketOperations } from \"./storage-buckets.ts\";\nimport { assertProviderRegion } from \"./provider-region.ts\";\n\n/** Storage provider. */\nexport type StorageLocationProvider = \"s3\" | \"s3_compatible\" | \"gcs\" | \"azure_blob\" | \"minio\" | \"r2\" | \"b2\";\n/** Key-custody mode. */\nexport type StorageLocationCustodyMode = \"PLATFORM_MANAGED\" | \"BYOK\" | \"HYOK\";\n\n/**\n * Non-secret, provider-specific configuration. Keys the platform reads: `accountId` and `parentAccessKeyId`\n * (`r2`), `bucketId` (`b2`). The gateway stores them as given and the credential mint fails closed when a\n * required one is missing, so set them when you create the location.\n */\nexport type StorageLocationProviderParams = Record<string, string>;\n\n/** A storage location. */\nexport type StorageLocation = {\n  id: string;\n  projectId: string;\n  provider: StorageLocationProvider;\n  bucketName: string;\n  /** The platform region (a 4-character short code such as `de01`), checked against the project's residency set. */\n  region: string;\n  /** The provider's own name for the bucket's location (`us-east-1`, `auto` for R2, the GCS or Azure location). Never residency-checked. */\n  providerRegion: string;\n  endpointOverride: string | null;\n  /** The `kibo://byos-creds/<secId>` reference. The credential itself is never returned. */\n  credentialRef: string;\n  custodyMode: StorageLocationCustodyMode;\n  providerParams: StorageLocationProviderParams;\n  createdAt: string;\n  /** `null` while the location is live. */\n  retiredAt: string | null;\n};\n\n/** Input to register a location from a pre-created credential reference. */\nexport type CreateStorageLocationInput = {\n  provider: StorageLocationProvider;\n  bucketName: string;\n  /** The platform region (short code), checked against the project's residency set. */\n  region: string;\n  /** The provider's own name for the bucket's location. Required; `auto` for R2. */\n  providerRegion: string;\n  endpointOverride?: string;\n  credentialRef: string;\n  custodyMode?: StorageLocationCustodyMode;\n  providerParams?: StorageLocationProviderParams;\n};\n\n/**\n * Fields you may change on a live location. `provider` cannot change. Moving a location that is in use (its\n * bucket, region, providerRegion, endpoint, `providerParams` or `custodyMode`) is refused with `409 location_in_use`; rotating\n * the credential is allowed. A `custodyMode` change counts as a move because it re-states the custody claim for\n * data already stored there. `providerParams`, when given, REPLACES the whole map (send every key you want to keep).\n */\nexport type UpdateStorageLocationInput = {\n  bucketName?: string;\n  region?: string;\n  providerRegion?: string;\n  /** `null` clears a previously set override. */\n  endpointOverride?: string | null;\n  credentialRef?: string;\n  custodyMode?: StorageLocationCustodyMode;\n  providerParams?: StorageLocationProviderParams;\n};\n\n/** Result of retiring a location. */\nexport type RetiredStorageLocation = { id: string; status: \"retired\" };\n\n/**\n * Result of `test`. Today this is a dry run that echoes the location's coordinates; the live probe is not\n * built yet (`dependencyOn` names what it waits for).\n */\nexport type StorageLocationTestResult = {\n  dryRun: boolean;\n  locationId: string;\n  provider: StorageLocationProvider;\n  bucketName: string;\n  region: string;\n  providerRegion: string;\n  endpointOverride: string | null;\n  dependencyOn: string;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (config.projectSlug === undefined || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"client.storage.locations requires a bound projectSlug (per-project resource)\",\n      context: {},\n      recommendation: \"Pass projectSlug when constructing the client.\",\n    });\n  }\n  return config.projectSlug;\n}\n\nconst locationsPath = (config: HttpClientConfig, suffix = \"\"): string =>\n  projectPath(requireProjectSlug(config), `storage/locations${suffix}`);\n\nexport function makeStorageNamespace(config: HttpClientConfig) {\n  return {\n    // Buckets and objects (storage-buckets.ts): createBucket, listBuckets, from(bucket).upload, ...\n    ...makeBucketOperations(config),\n    locations: {\n      /** List the live storage locations of the bound project. `GET /@<projectSlug>/storage/locations`. */\n      async list(): Promise<Envelope<ReadonlyArray<StorageLocation>>> {\n        return request<ReadonlyArray<StorageLocation>>(config, { method: \"GET\", path: locationsPath(config) });\n      },\n\n      /**\n       * Register a location. `POST /@<projectSlug>/storage/locations`. The region must be inside the project's\n       * residency set (`400`, reason `region_outside_residency`).\n       */\n      async create(input: CreateStorageLocationInput): Promise<Envelope<StorageLocation>> {\n        assertProviderRegion(input.providerRegion, input.provider);\n        return request<StorageLocation>(config, { method: \"POST\", path: locationsPath(config), body: input });\n      },\n\n      /** Read one location. `GET /@<projectSlug>/storage/locations/<locationId>`. */\n      async get(locationId: string): Promise<Envelope<StorageLocation>> {\n        return request<StorageLocation>(config, {\n          method: \"GET\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n        });\n      },\n\n      /** Update a live location. `PATCH /@<projectSlug>/storage/locations/<locationId>`. */\n      async update(locationId: string, patch: UpdateStorageLocationInput): Promise<Envelope<StorageLocation>> {\n        // The provider of an existing location cannot change and is not in the patch, so only the closed charset is\n        // checked here; the gateway applies the provider's own grammar.\n        if (patch.providerRegion !== undefined) assertProviderRegion(patch.providerRegion);\n        return request<StorageLocation>(config, {\n          method: \"PATCH\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n          body: patch,\n        });\n      },\n\n      /**\n       * Retire a location. `DELETE /@<projectSlug>/storage/locations/<locationId>`. Refused with\n       * `409 location_in_use` while a bucket or any Dataset (retired ones included) still uses it.\n       */\n      async retire(locationId: string): Promise<Envelope<RetiredStorageLocation>> {\n        return request<RetiredStorageLocation>(config, {\n          method: \"DELETE\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n        });\n      },\n\n      /** Dry-run check of a location. `POST /@<projectSlug>/storage/locations/<locationId>/test`. */\n      async test(locationId: string): Promise<Envelope<StorageLocationTestResult>> {\n        return request<StorageLocationTestResult>(config, {\n          method: \"POST\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}/test`),\n        });\n      },\n    },\n  };\n}\n","/**\n * `client.metadata.*` — cross-surface metadata query (`k9o.metadata.*`).\n *\n * Client-side surface for `POST /@:projectSlug/metadata/query`. The wire shape is fixed here ahead of the\n * server route: until the gateway ships that route, calling `.execute()` returns a 404 rather than a result.\n * Once it is available, only `telemetry:*` surfaces return data at first; collection and storage metadata\n * follow as their server-side schemas land.\n *\n * `textSearch`/`vectorSearch` are explicitly a later increment (Inc 5) — not implemented\n * here; adding stub methods for an unspecified future mode would be speculative, not spec-grounded.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** The three cross-surface slices. */\nexport type MetadataSlice = \"collection\" | \"storage\" | \"telemetry\";\n\n/** operator vocabulary (= JSON-policy set), mirrored verbatim from the gateway's\n *  `metadata-query-parse.ts` so a typo can't silently pass client-side and fail only server-side. */\nexport const METADATA_OPERATORS = [\n  \"eq\", \"neq\", \"gt\", \"gte\", \"lt\", \"lte\",\n  \"contains\", \"startsWith\", \"endsWith\", \"in\", \"notIn\",\n  \"and\", \"or\", \"not\",\n] as const;\nexport type MetadataOperator = (typeof METADATA_OPERATORS)[number];\n\n/** A surface label `<slice>:<scope>`, e.g. `collection:posts`, `storage:images`,\n *  `telemetry:auth.session.created`. */\nexport type MetadataSurface = `${MetadataSlice}:${string}`;\n\nexport type MetadataWhereClause = {\n  readonly field: string;\n  readonly op: MetadataOperator;\n  readonly value: unknown;\n};\n\n/**\n * One result row: \"each record carries its surface + scope + the queried metadata\n * fields plus a back-reference id\" — `recordId` (collection), `objectPath` (storage), or `eventId`\n * (telemetry), depending on which surface the row came from. Exact field names are provisional\n * pending Inc 2 landing a concrete response schema; kept loose (`metadata: Record<string, unknown>`)\n * rather than guessing a shape that isn't coined in code anywhere yet.\n */\nexport type MetadataQueryRecord = {\n  surface: MetadataSurface;\n  scope: string;\n  recordId?: string;\n  objectPath?: string;\n  eventId?: string;\n  metadata: Record<string, unknown>;\n};\n\nexport type MetadataQueryResult = {\n  records: readonly MetadataQueryRecord[];\n  nextCursor: string | null;\n};\n\n/** The `k9o.metadata.from(...).where(...).limit(...).execute()` builder. Immutable —\n *  every chained call returns a new builder, so a partially-built query can be safely reused/branched. */\nexport type MetadataQueryBuilder = {\n  where(field: string, op: MetadataOperator, value: unknown): MetadataQueryBuilder;\n  limit(n: number): MetadataQueryBuilder;\n  cursor(c: string | null): MetadataQueryBuilder;\n  execute(): Promise<Envelope<MetadataQueryResult>>;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (config.projectSlug === undefined || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"client.metadata requires a bound projectSlug (project data-plane resource,)\",\n      context: {},\n      recommendation: \"Pass projectSlug when constructing the client.\",\n    });\n  }\n  return config.projectSlug;\n}\n\nfunction makeBuilder(\n  config: HttpClientConfig,\n  surfaces: readonly MetadataSurface[],\n  where: readonly MetadataWhereClause[],\n  limit: number | undefined,\n  cursorValue: string | null,\n): MetadataQueryBuilder {\n  return {\n    where(field, op, value) {\n      return makeBuilder(config, surfaces, [...where, { field, op, value }], limit, cursorValue);\n    },\n    limit(n) {\n      return makeBuilder(config, surfaces, where, n, cursorValue);\n    },\n    cursor(c) {\n      return makeBuilder(config, surfaces, where, limit, c);\n    },\n    async execute() {\n      return request<MetadataQueryResult>(config, {\n        method: \"POST\",\n        path: projectPath(requireProjectSlug(config), \"metadata/query\"),\n        body: {\n          surfaces,\n          where,\n          ...(limit !== undefined ? { limit } : {}),\n          cursor: cursorValue,\n        },\n      });\n    },\n  };\n}\n\nexport function makeMetadataNamespace(config: HttpClientConfig) {\n  return {\n    /** Start a cross-surface metadata query against one or more surfaces. */\n    from(surface: MetadataSurface | readonly MetadataSurface[]): MetadataQueryBuilder {\n      const surfaces = Array.isArray(surface) ? surface : [surface as MetadataSurface];\n      if (surfaces.length === 0) {\n        throw new KError({\n          code: \"K9O_UNKNOWN_SURFACE\",\n          message: \"client.metadata.from(...) requires at least one surface label.\",\n          context: {},\n          recommendation: \"Pass a surface like 'collection:posts', 'storage:images', or 'telemetry:auth.session.created'.\",\n        });\n      }\n      return makeBuilder(config, surfaces, [], undefined, null);\n    },\n  };\n}\n","/**\n * Migration lifecycle SDK — `client.migrations.*`.\n *\n * Backed by the gateway migrations routes.\n * All routes are member-plane (`/@<projectSlug>/migrations/...`).\n *\n * Wire mapping:\n *   - `apply({ migrations })`     → POST   /@<slug>/migrations/apply\n *   - `list()`                    → GET    /@<slug>/migrations\n *   - `get(version)`              → GET    /@<slug>/migrations/<version>\n *   - `queue({ migrations })`     → POST   /@<slug>/migrations/queue\n *   - `listPending()`             → GET    /@<slug>/migrations/pending\n *   - `applyPending(pendingId)`   → POST   /@<slug>/migrations/pending/<pendingId>/apply\n *   - `rejectPending(pendingId)`  → POST   /@<slug>/migrations/pending/<pendingId>/reject\n *   - `deletePending(pendingId)`  → DELETE /@<slug>/migrations/pending/<pendingId>\n *\n * Migration shape — STRUCTURED\n * DECLARATIVE DDL, never raw SQL. Every schema change is a typed, key-tagged\n * operation, so schema drift is impossible at the SDK layer (the\n * invariant). Raw SQL is the separate runtime `client.query()` surface,\n * which cannot create/alter schema. The gateway checksums each migration and\n * stores it in `_sys.migrations`; already-applied versions are skipped on\n * re-run and mismatched checksums are rejected, preserving the drift invariant.\n *\n * Per-operation field shapes are grounded in the gateway DDL parser\n * (`services/gateway/src/db/migration-runner.ts`), NOT invented.\n *\n * Verified against the gateway DDL parser:\n *   - `up`/`down` arrays — parser now iterates them (shipped `2.58.0-beta.1`).\n *   - ColumnSpec protection attrs — live since `2.56.0`; `encrypted` is the\n *     `true | { store, searchable }` union with `searchable` NESTED (not a\n *     sibling); `blind_indexed` is the C-mode sibling. Aligned above.\n *   - Op set FROZEN at 6 (no alter_column/rename_table/constraint at v2).\n *     `rename_column` is a pending 7th — to be added once its field\n *     names are finalised and the re-encryption pass ships.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** Foreign-key reference on a column — compiles to a REFERENCES clause. */\nexport type ColumnReferences = {\n  collection: string;\n  on: string;\n  on_delete?: \"CASCADE\" | \"RESTRICT\" | \"SET NULL\" | \"NO ACTION\";\n  on_update?: \"CASCADE\" | \"RESTRICT\" | \"SET NULL\" | \"NO ACTION\";\n};\n\n/**\n * A column definition. `type` is the column-type vocabulary\n * (parser-owned; kept as `string` rather than a fabricated enum). The\n * protection attributes declare at-rest field encryption (gateway\n * shape verified vs the parser, live since `2.56.0`).\n */\nexport type ColumnSpec = {\n  name: string;\n  type: string;\n  primary_key?: boolean;\n  not_null?: boolean;\n  unique?: boolean;\n  default?: string;\n  references?: ColumnReferences;\n  /**\n   * At-rest field encryption. `true` = inline-stored encrypted column;\n   * the object form opts into a `store` (\"inline\" | \"vault\") and the D-mode\n   * searchable-encryption index (`searchable`). NOTE: `searchable` is NESTED\n   * here — it is NOT a sibling attribute.\n   */\n  encrypted?: true | { store: \"inline\" | \"vault\"; searchable?: boolean };\n  /** C-mode: deterministic blind index for equality lookup over an encrypted column. */\n  blind_indexed?: boolean;\n};\n\n/** An index definition. `name` defaults to `<table>_<cols>_idx`. */\nexport type IndexSpec = {\n  name?: string;\n  columns: ReadonlyArray<string>;\n  unique?: boolean;\n};\n\n/**\n * A single declarative DDL operation — KEY-TAGGED (exactly one key set), the\n * shape the gateway applies. The v2 set is these 7 — no `alter_column`,\n * `rename_table`, or constraint ops at v2. `alter_table` is the BATCHED column\n * mutation (one op carries optional `add_columns[]` + `drop_columns[]`), live in\n * the gateway runner (`migration-runner.ts:156`).\n * `rename_column` remains a pending future op (its parser field names are not yet\n * finalised); NOTE / a `rename_column` on an ENCRYPTED column\n * is fail-closed-rejected (`K9O_ENCRYPTED_COLUMN_DECLARATION_INVALID`) pending the\n * re-encryption pass — to document when that op lands.\n */\nexport type Operation =\n  | { create_table: { name: string; columns: ReadonlyArray<ColumnSpec>; indexes?: ReadonlyArray<IndexSpec> } }\n  | { drop_table: string }\n  | { add_column: { table: string; column: ColumnSpec } }\n  | { drop_column: { table: string; column: string } }\n  | { alter_table: { name: string; add_columns?: ReadonlyArray<ColumnSpec>; drop_columns?: ReadonlyArray<string> } }\n  | { create_index: { table: string; index: IndexSpec } }\n  | { drop_index: { name: string } };\n\n/** A declarative authorization/relationship rule (compiles to RLS USING + WITH\n *  CHECK). The rule grammar is the policy-expression DSL. */\nexport type ActionRule = { rule?: unknown };\n\n/** A declared relationship for embedding/joins (references). */\nexport type RelationshipSpec = {\n  collection: string;\n  on: string;\n  as: string;\n  type?: \"inner\" | \"left\";\n};\n\n/** Per-collection policy block (RLS + relationships),. */\nexport type CollectionPolicy = {\n  references?: ReadonlyArray<RelationshipSpec>;\n  actions?: {\n    select?: ActionRule;\n    insert?: ActionRule;\n    update?: ActionRule;\n    delete?: ActionRule;\n  };\n};\n\n/** Per-bucket storage policy block,. */\nexport type StorageBucketPolicy = {\n  public?: boolean;\n  actions?: {\n    read?: ActionRule;\n    upload?: ActionRule;\n    delete?: ActionRule;\n    list?: ActionRule;\n  };\n};\n\n/** The optional `policy` section authored alongside a migration. */\nexport type MigrationPolicy = {\n  collections?: Record<string, CollectionPolicy>;\n  storage?: { buckets?: Record<string, StorageBucketPolicy> };\n};\n\n/**\n * A migration — a versioned, checksummed unit of structured DDL. `up` applies\n * the change; `down` reverses it. Both are operation arrays.\n */\nexport type Migration = {\n  version: number;\n  slug: string;\n  up: ReadonlyArray<Operation>;\n  down: ReadonlyArray<Operation>;\n  policy?: MigrationPolicy;\n};\n\n/**\n * Applied-migration record returned by `list` + `get`.\n */\nexport type AppliedMigration = {\n  version: number;\n  slug: string;\n  checksum: string;\n  appliedAt: string;\n};\n\n/**\n * Pending migration record returned by `listPending`.\n */\nexport type PendingMigration = {\n  pendingId: string;\n  version: number;\n  slug: string;\n  checksum: string;\n  submittedAt: string;\n  submittedBy: string;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"migrations operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeMigrationsNamespace(config: HttpClientConfig) {\n  return {\n    /** Apply migrations immediately (PROJECT_ADMIN minimum). */\n    async apply(input: { migrations: ReadonlyArray<Migration> }): Promise<Envelope<{ applied: ReadonlyArray<AppliedMigration> }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"migrations/apply\"),\n        body: input,\n      });\n    },\n\n    /** List applied migrations on the project. */\n    async list(): Promise<Envelope<ReadonlyArray<AppliedMigration>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"migrations\"),\n      });\n    },\n\n    /** Get a single applied migration by version. */\n    async get(version: number): Promise<Envelope<AppliedMigration>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `migrations/${encodeURIComponent(String(version))}`),\n      });\n    },\n\n    /** Queue migrations for maker-checker approval. */\n    async queue(input: { migrations: ReadonlyArray<Migration> }): Promise<Envelope<{ pending: ReadonlyArray<PendingMigration> }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"migrations/queue\"),\n        body: input,\n      });\n    },\n\n    /** List pending (queued, not yet approved) migrations. */\n    async listPending(): Promise<Envelope<ReadonlyArray<PendingMigration>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"migrations/pending\"),\n      });\n    },\n\n    /**\n     * Apply a queued migration by id (same-actor fast path — floors at\n     * PROJECT_ADMIN; a `pending_approval` row, i.e. a protected-collection\n     * migration awaiting a distinct-admin's review, is refused here and\n     * needs its own approval flow, not this call).\n     */\n    async applyPending(pendingId: string): Promise<Envelope<AppliedMigration>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}/apply`),\n      });\n    },\n\n    /** Reject a pending migration (transitions to rejected; does not apply). */\n    async rejectPending(pendingId: string, input?: { reason?: string }): Promise<Envelope<{ rejected: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}/reject`),\n        body: input,\n      });\n    },\n\n    /** Delete a pending migration from the queue. */\n    async deletePending(pendingId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}`),\n      });\n    },\n  };\n}\n","/**\n * Function lifecycle SDK — `client.functions.*`.\n *\n * Backed by the gateway functions and invoke routes.\n *\n * Wire mapping:\n *   - `deploy({ name, runtime, code, ... })`  → POST   /@<slug>/functions\n *   - `list()`                                → GET    /@<slug>/functions\n *   - `get(name)`                             → GET    /@<slug>/functions/<name>\n *   - `delete(name)`                          → DELETE /@<slug>/functions/<name>\n *   - `invoke(name, payload)`                 → POST   /@<slug>/functions/<name>/invoke\n *\n * Per: deploy requires PROJECT_ADMIN; invoke authority is per\n * function manifest. Per: deploy returns 202 with status\n * `deploying`; the function is ready when status flips to `active`.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Function record returned by gateway endpoints.\n */\nexport type FunctionRecord = {\n  /** `fn_<base62>`. */\n  id: string;\n  name: string;\n  runtime: \"wasm\" | \"bun\" | \"node\";\n  status: \"deploying\" | \"active\" | \"retired\" | \"failed\";\n  tier: \"low\" | \"medium\" | \"high\";\n  createdAt: string;\n  updatedAt: string | null;\n};\n\n/**\n * Deploy input. The `code` field is the runtime bundle (base64-encoded\n * WASM or JS source).\n */\nexport type DeployFunctionInput = {\n  name: string;\n  runtime: \"wasm\" | \"bun\" | \"node\";\n  code: string;\n  tier?: \"low\" | \"medium\" | \"high\";\n  config?: Record<string, unknown>;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"functions operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeFunctionsNamespace(config: HttpClientConfig) {\n  return {\n    /** Deploy or redeploy a function. Returns the function record with status. */\n    async deploy(input: DeployFunctionInput): Promise<Envelope<FunctionRecord>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"functions\"),\n        body: input,\n      });\n    },\n\n    /** List deployed functions (cursor pagination). */\n    async list(opts?: { limit?: number; cursor?: string; status?: FunctionRecord[\"status\"] }): Promise<Envelope<ReadonlyArray<FunctionRecord>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"functions\"),\n        query: opts,\n      });\n    },\n\n    /** Get a function by name. */\n    async get(name: string): Promise<Envelope<FunctionRecord>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}`),\n      });\n    },\n\n    /** Retire a function. Returns confirmation; the function name enters a 24h cooldown. */\n    async delete(name: string): Promise<Envelope<{ retired: boolean; cooldownUntil: string }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}`),\n      });\n    },\n\n    /**\n     * Invoke a function. The `payload` is passed to the function runtime\n     * verbatim; the gateway returns whatever the function returns wrapped\n     * in the standard envelope.\n     *\n     * Per: invoke authority is per-function (declared in the\n     * function manifest). Per: streaming responses use the\n     * subscription/async-iterator pattern; this method covers the\n     * request-response variant only.\n     */\n    async invoke<TResult = unknown, TPayload = unknown>(name: string, payload: TPayload): Promise<Envelope<TResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}/invoke`),\n        body: payload,\n      });\n    },\n  };\n}\n","/**\n * Policy bundle lifecycle SDK — `client.policies.*`.\n *\n * Backed by the gateway policies routes.\n *\n * Wire mapping:\n *   - `current()`                         → GET    /@<slug>/policy           (active policy)\n *   - `list()`                            → GET    /@<slug>/policies         (all bundles)\n *   - `create({...})`                     → POST   /@<slug>/policies         (draft bundle)\n *   - `validate({...})`                   → POST   /@<slug>/policies/validate (lint without persist)\n *   - `get(bundleId)`                     → GET    /@<slug>/policies/<id>\n *   - `update(bundleId, patch)`           → PATCH  /@<slug>/policies/<id>\n *   - `delete(bundleId)`                  → DELETE /@<slug>/policies/<id>\n *   - `publish(bundleId)`                 → POST   /@<slug>/policies/<id>/publish\n *\n * Per: only Pathmaker-class roles author policy; only\n * Custodian-class roles publish. `validate` is read-only and any role\n * with policy-read can lint a candidate bundle.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\nexport type PolicyBundle = {\n  /** `pol_<base62>`. */\n  id: string;\n  name: string;\n  version: number;\n  status: \"draft\" | \"published\" | \"deactivated\";\n  rules: Record<string, unknown>;\n  createdAt: string;\n  publishedAt: string | null;\n  createdBy: string;\n};\n\nexport type CreatePolicyInput = {\n  name: string;\n  rules: Record<string, unknown>;\n};\n\nexport type UpdatePolicyInput = {\n  name?: string;\n  rules?: Record<string, unknown>;\n};\n\nexport type ValidatePolicyResult = {\n  valid: boolean;\n  errors: ReadonlyArray<{ rule: string; message: string }>;\n  warnings: ReadonlyArray<{ rule: string; message: string }>;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"policies operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makePoliciesNamespace(config: HttpClientConfig) {\n  return {\n    /** Return the currently-active policy for the project. */\n    async current(): Promise<Envelope<PolicyBundle | null>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"policy\"),\n      });\n    },\n\n    /** List all policy bundles (draft + published + deactivated). */\n    async list(opts?: { status?: PolicyBundle[\"status\"] | undefined; limit?: number | undefined; cursor?: string | undefined }): Promise<Envelope<ReadonlyArray<PolicyBundle>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"policies\"),\n        query: opts,\n      });\n    },\n\n    /** Create a draft policy bundle. */\n    async create(input: CreatePolicyInput): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"policies\"),\n        body: input,\n      });\n    },\n\n    /** Lint a candidate rule set without persisting. */\n    async validate(input: { rules: Record<string, unknown> }): Promise<Envelope<ValidatePolicyResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"policies/validate\"),\n        body: input,\n      });\n    },\n\n    /** Get a single bundle by id. */\n    async get(bundleId: string): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n      });\n    },\n\n    /** Patch a draft bundle. Cannot patch published bundles (publish→republish flow). */\n    async update(bundleId: string, patch: UpdatePolicyInput): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n        body: patch,\n      });\n    },\n\n    /** Delete a draft bundle. Cannot delete published bundles. */\n    async delete(bundleId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n      });\n    },\n\n    /** Publish a draft bundle — transitions to `published` + becomes active for the project. */\n    async publish(bundleId: string): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}/publish`),\n      });\n    },\n  };\n}\n","/**\n * Audit log query SDK — `client.audit.*`.\n *\n * Backed by the gateway audit-log routes.\n *\n * Wire mapping:\n *   - `query({ since, until, type, actorId, targetKind, targetId, limit, cursor })`\n *     → GET /@<slug>/audit-log?...\n *\n * The endpoint accepts cursor-paginated reverse-chronological queries.\n * `type` is the audit-event namespace (e.g. `data.write.access.insert`,\n * `gate.signin.success`) per the event-name taxonomy +\n * `feedback_error_code_namespace_boundary_and_prefix.md` cement.\n *\n * Returns audit events with full context payload — actorId / targetKind /\n * targetId / payload / occurredAt / requestId / traceId.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Audit event record `_sys.audit_log` shape.\n */\nexport type AuditEvent = {\n  id: string;\n  /** Dotted namespace (e.g. `data.write.access.insert`). */\n  type: string;\n  actorId: string | null;\n  targetKind: string | null;\n  targetId: string | null;\n  payload: Record<string, unknown>;\n  occurredAt: string;\n  requestId: string | null;\n  traceId: string | null;\n};\n\nexport type AuditQueryOpts = {\n  /** ISO 8601 lower bound (inclusive). */\n  since?: string | undefined;\n  /** ISO 8601 upper bound (exclusive). */\n  until?: string | undefined;\n  /** Filter by event type (exact match; future cycles may add prefix-match). */\n  type?: string | undefined;\n  /** Filter by actor. */\n  actorId?: string | undefined;\n  /** Filter by target resource kind. */\n  targetKind?: string | undefined;\n  /** Filter by target resource id. */\n  targetId?: string | undefined;\n  /** Page size (per-tier max bounded server-side). */\n  limit?: number | undefined;\n  /** Cursor from prior response. */\n  cursor?: string | undefined;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"audit operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeAuditNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * Query the audit log. Returns reverse-chronological events matching\n     * all supplied filters (AND composition).\n     *\n     * Per RBAC: requires `AUDIT_READER` role minimum; Custodian-\n     * class roles inherit. Project-level audit is project-scoped (this\n     * endpoint); platform-level audit is admin-only (separate surface).\n     */\n    async query(opts?: AuditQueryOpts): Promise<Envelope<ReadonlyArray<AuditEvent>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"audit-log\"),\n        query: opts,\n      });\n    },\n\n    /**\n     * Convenience: live-tail recent events. Currently single-shot read\n     * with `since` defaulted to \"1 minute ago\"; subscription-mode tail\n     * (SSE) lands when the streaming layer ships pattern.\n     */\n    async tail(opts?: { sinceMinutes?: number; limit?: number }): Promise<Envelope<ReadonlyArray<AuditEvent>>> {\n      const slug = requireProjectSlug(config);\n      const minutes = opts?.sinceMinutes ?? 1;\n      const since = new Date(Date.now() - minutes * 60_000).toISOString();\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"audit-log\"),\n        query: { since, limit: opts?.limit ?? 100 },\n      });\n    },\n  };\n}\n","/**\n * Org lifecycle SDK — `client.orgs.*`.\n *\n * Backed by the gateway orgs routes.\n *\n * Wire mapping (all org-plane / platform-plane):\n *   - `list()`                    → GET    /orgs\n *   - `get(orgSlug)`              → GET    /orgs/<orgSlug>\n *   - `restore(orgId)`            → POST   /orgs/<orgId>/restore\n *   - `current()`                 → GET    /org\n *\n * The `current()` endpoint returns the org bound to the caller's session\n * context (via `x-k9o-org-slug` header or token claim). `get` addresses an\n * explicit org by its **slug** (slug-first management grammar) for\n * cross-org admin scenarios; most callers reach for `current()`.\n * `restore` is the one exception — it stays keyed by `orgId`, because a\n * soft-deleted org's slug is tombstoned and may have been reassigned.\n *\n *: org listing is scoped by the caller's accessible orgs\n * (most callers see exactly one — their own). Org creation is not available\n * through the SDK yet; `client.orgs.create()` will be added once sign-up\n * is exposed as an API).\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath, validateSlug } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\nexport type Org = {\n  /** `org_<base62>`. */\n  id: string;\n  slug: string;\n  name: string;\n  status: \"active\" | \"suspended\" | \"soft-deleted\";\n  createdAt: string;\n  updatedAt: string | null;\n};\n\nexport function makeOrgsNamespace(config: HttpClientConfig) {\n  return {\n    /** List orgs accessible to the caller. */\n    async list(): Promise<Envelope<ReadonlyArray<Org>>> {\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(\"orgs\"),\n      });\n    },\n\n    /** Get a single org by slug. */\n    async get(orgSlug: string): Promise<Envelope<Org>> {\n      validateSlug(orgSlug, \"org\");\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(`orgs/${encodeURIComponent(orgSlug)}`),\n      });\n    },\n\n    /** Restore a soft-deleted org. */\n    async restore(orgId: string): Promise<Envelope<Org>> {\n      return request(config, {\n        method: \"POST\",\n        path: orgPath(`orgs/${encodeURIComponent(orgId)}/restore`),\n      });\n    },\n\n    /** Get the org bound to the caller's current session context. */\n    async current(): Promise<Envelope<Org>> {\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(\"org\"),\n      });\n    },\n  };\n}\n","/**\n * Org-plane SDK namespace — `client.org.*`.\n *\n * Covers org members, groups, SMTP, audit and gate administration.\n *\n * Distinct from `client.orgs` (collection-style; list/get/restore/current\n * across accessible orgs) — `client.org` is the singular bound-org\n * namespace with member / group / smtp / audit / gate sub-namespaces.\n *\n * Org-plane URL grammar: requests route against the\n * `<orgSlug>.api.k9o.io/` org subdomain WITHOUT the `@<projectSlug>/`\n * prefix used by project-plane requests. The gateway resolves the org\n * context from the subdomain.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport type { LLMModelId } from \"./compute/llms.ts\";\n\n// ----------------------------------------------------------------------\n// Types\n// ----------------------------------------------------------------------\n\nexport type OrgMember = {\n  /** `u_<base62>`. */\n  userId: string;\n  email: string;\n  /** Org-level role enum. */\n  role: \"ORG_OWNER\" | \"ORG_ADMIN\" | \"ORG_BILLING_ADMIN\" | \"ORG_MEMBER\";\n  joinedAt: string;\n  status: \"active\" | \"invited\" | \"suspended\";\n};\n\nexport type OrgGroup = {\n  /** `grp_<base62>`. */\n  id: string;\n  name: string;\n  memberCount: number;\n  createdAt: string;\n};\n\nexport type OrgRoleGrant = {\n  /** `grt_<base62>`. */\n  id: string;\n  userId: string;\n  role: \"ORG_ADMIN\" | \"ORG_BILLING_ADMIN\";\n  grantedBy: string;\n  grantedAt: string;\n  revokedAt: string | null;\n  revokedBy: string | null;\n  viaDelegationId: string | null;\n};\n\n/**\n * Org-level audit event 6-event family.\n *\n * Event types (closed set at v2.1.132):\n *   - `data.write.org.member_invited`\n *   - `data.write.org.member_removed`\n *   - `data.write.org.role_granted`\n *   - `data.write.org.role_revoked`\n *   - `data.write.org.idp_config_changed`\n *   - `data.write.org.settings_updated`\n *\n * `targetKind` is `org` for all; `targetId` is the orgId.\n */\nexport type OrgAuditEvent = {\n  id: string;\n  type: string;\n  actorId: string | null;\n  targetKind: \"org\";\n  targetId: string;\n  payload: Record<string, unknown>;\n  occurredAt: string;\n  requestId: string | null;\n  traceId: string | null;\n};\n\n/**\n * Org SMTP configuration. Sensitive fields (passwordRef)\n * are sequestered in Kibo enclave; the SDK stores only the reference.\n */\nexport type SmtpConfig = {\n  host: string;\n  port: number;\n  username: string;\n  /** Kibo enclave credential reference; opaque token. */\n  passwordRef: string;\n  fromEmail: string;\n  fromName: string;\n  encryption: \"none\" | \"starttls\" | \"tls\";\n  replyToEmail?: string | undefined;\n};\n\nexport type SmtpTestEmailInput = {\n  to: string;\n  /** Optional override of the from address for the test send (defaults to fromEmail). */\n  fromOverride?: string | undefined;\n};\n\nexport type SmtpTestEmailResult = {\n  ok: boolean;\n  /** Diagnostic message returned by the SMTP server (success or error detail). */\n  diagnostic: string;\n  /** ISO 8601 timestamp of the test attempt. */\n  attemptedAt: string;\n};\n\nexport type OrgIdpProvider = {\n  /** `idp_<base62>`. */\n  id: string;\n  name: string;\n  /** Protocol/vendor (e.g. \"okta-saml\", \"azure-ad-oidc\", \"google-workspace\"). */\n  kind: string;\n  enabled: boolean;\n  createdAt: string;\n};\n\nexport type CreateOrgIdpInput = {\n  name: string;\n  kind: string;\n  config: Record<string, unknown>;\n};\n\n// ----------------------------------------------------------------------\n// Sub-namespace factories\n// ----------------------------------------------------------------------\n\nfunction makeMembersNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /members (org-plane LIST). */\n    async list(opts?: { limit?: number | undefined; cursor?: string | undefined; status?: OrgMember[\"status\"] | undefined }): Promise<Envelope<ReadonlyArray<OrgMember>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"members\"), query: opts });\n    },\n\n    /** POST /members — invite a new org member by email. */\n    async invite(input: { email: string; role: OrgMember[\"role\"] }): Promise<Envelope<OrgMember>> {\n      return request(config, { method: \"POST\", path: orgPath(\"members\"), body: input });\n    },\n\n    /** GET /members/<userId> — single-read (existing endpoint). */\n    async get(userId: string): Promise<Envelope<OrgMember>> {\n      return request(config, { method: \"GET\", path: orgPath(`members/${encodeURIComponent(userId)}`) });\n    },\n\n    /** DELETE /members/<userId> — remove a member from the org. */\n    async remove(userId: string): Promise<Envelope<{ removed: boolean }>> {\n      return request(config, { method: \"DELETE\", path: orgPath(`members/${encodeURIComponent(userId)}`) });\n    },\n  };\n}\n\nfunction makeGroupsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /groups (org-plane LIST). */\n    async list(opts?: { limit?: number; cursor?: string }): Promise<Envelope<ReadonlyArray<OrgGroup>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"groups\"), query: opts });\n    },\n\n    /** POST /groups — create a new group. */\n    async create(input: { name: string }): Promise<Envelope<OrgGroup>> {\n      return request(config, { method: \"POST\", path: orgPath(\"groups\"), body: input });\n    },\n\n    /** GET /groups/<groupId> — single-read (pre-cement existing endpoint). */\n    async get(groupId: string): Promise<Envelope<OrgGroup>> {\n      return request(config, { method: \"GET\", path: orgPath(`groups/${encodeURIComponent(groupId)}`) });\n    },\n\n    /** DELETE /groups/<groupId> — remove a group. */\n    async delete(groupId: string): Promise<Envelope<{ deleted: boolean }>> {\n      return request(config, { method: \"DELETE\", path: orgPath(`groups/${encodeURIComponent(groupId)}`) });\n    },\n  };\n}\n\nfunction makeOrgAuditLogNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * GET /audit-log (org-plane).\n     * Distinct from project-plane `client.audit.query()` which routes to\n     * `@<projectSlug>/audit-log`. Org-plane events cover the 6-event family\n     * (member_invited/removed/role_granted/revoked/\n     * idp_config_changed/settings_updated).\n     */\n    async query(opts?: {\n      since?: string | undefined; until?: string | undefined; type?: string | undefined; actorId?: string | undefined;\n      targetKind?: string | undefined; targetId?: string | undefined; limit?: number | undefined; cursor?: string | undefined;\n    }): Promise<Envelope<ReadonlyArray<OrgAuditEvent>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"audit-log\"), query: opts });\n    },\n\n    /** Convenience: recent events (defaults to 5 minute window). */\n    async tail(opts?: { sinceMinutes?: number; limit?: number }): Promise<Envelope<ReadonlyArray<OrgAuditEvent>>> {\n      const minutes = opts?.sinceMinutes ?? 5;\n      const since = new Date(Date.now() - minutes * 60_000).toISOString();\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(\"audit-log\"),\n        query: { since, limit: opts?.limit ?? 100 },\n      });\n    },\n  };\n}\n\nfunction makeOrgGateNamespace(config: HttpClientConfig) {\n  return {\n    roles: {\n      /** GET /org-role-grants — list active grants ask 4. */\n      async list(opts?: { userId?: string | undefined; role?: OrgRoleGrant[\"role\"] | undefined; includeRevoked?: boolean | undefined }): Promise<Envelope<ReadonlyArray<OrgRoleGrant>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"org-role-grants\"), query: opts });\n      },\n\n      /** POST /org-role-grants — grant an ORG_ADMIN or ORG_BILLING_ADMIN role. */\n      async grant(input: { userId: string; role: OrgRoleGrant[\"role\"] }): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"POST\", path: orgPath(\"org-role-grants\"), body: input });\n      },\n\n      /** GET /org-role-grants/<grantId> — single-read. */\n      async get(grantId: string): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"GET\", path: orgPath(`org-role-grants/${encodeURIComponent(grantId)}`) });\n      },\n\n      /** DELETE /org-role-grants/<grantId> — revoke a grant (soft delete; sets revokedAt). */\n      async revoke(grantId: string): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`org-role-grants/${encodeURIComponent(grantId)}`) });\n      },\n    },\n\n    idpProviders: {\n      /** GET /idp-providers — list configured org operator IdP providers ask 7. */\n      async list(): Promise<Envelope<ReadonlyArray<OrgIdpProvider>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"idp-providers\") });\n      },\n\n      /** POST /idp-providers — create a new IdP integration. */\n      async create(input: CreateOrgIdpInput): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"POST\", path: orgPath(\"idp-providers\"), body: input });\n      },\n\n      /** GET /idp-providers/<idpId>. */\n      async get(idpId: string): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"GET\", path: orgPath(`idp-providers/${encodeURIComponent(idpId)}`) });\n      },\n\n      /** PATCH /idp-providers/<idpId> — update config or enable/disable. */\n      async configure(idpId: string, patch: { name?: string; enabled?: boolean; config?: Record<string, unknown> }): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"PATCH\", path: orgPath(`idp-providers/${encodeURIComponent(idpId)}`), body: patch });\n      },\n\n      /** DELETE /idp-providers/<idpId>. */\n      async delete(idpId: string): Promise<Envelope<{ deleted: boolean }>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`idp-providers/${encodeURIComponent(idpId)}`) });\n      },\n    },\n  };\n}\n\nfunction makeSmtpNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * GET /org/smtp — read current SMTP config.\n     * Returns null when no org-level SMTP is configured (falls back to\n     * platform SMTP 3-tier cascade).\n     */\n    async get(): Promise<Envelope<SmtpConfig | null>> {\n      return request(config, { method: \"GET\", path: orgPath(\"org/smtp\") });\n    },\n\n    /**\n     * PATCH /orgs/<orgSlug> with `smtpConfig` body — set or update SMTP.\n     * PATCH on the org resource accepts smtpConfig.\n     * Passwords route through Kibo enclave — SDK accepts plaintext at\n     * the SDK boundary; gateway stores the reference.\n     */\n    async set(config_: Omit<SmtpConfig, \"passwordRef\"> & { password: string }): Promise<Envelope<SmtpConfig>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"org\"), body: { smtpConfig: config_ } });\n    },\n\n    /**\n     * POST /org/smtp/test-email — send a diagnostic email to verify config.\n     * 5/hour rate limit; RFC 5322 validation;\n     * 3-tier resolution (platform→org→project) of effective SMTP.\n     */\n    async test(input: SmtpTestEmailInput): Promise<Envelope<SmtpTestEmailResult>> {\n      return request(config, { method: \"POST\", path: orgPath(\"org/smtp/test-email\"), body: input });\n    },\n\n    /** PATCH /orgs/<orgSlug> with `smtpConfig: null` — clear org-level SMTP. */\n    async unset(): Promise<Envelope<{ cleared: boolean }>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"org\"), body: { smtpConfig: null } });\n    },\n  };\n}\n\nfunction makeDefaultLlmNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * GET /org/default-llm — read the org-default LLM model id\n     *. Returns `null` when no explicit default is set (gateway\n     * falls back to `mistral-7b`). ORG_ADMIN read; tier-gated.\n     */\n    async get(): Promise<Envelope<LLMModelId | null>> {\n      return request(config, { method: \"GET\", path: orgPath(\"org/default-llm\") });\n    },\n\n    /**\n     * PATCH /org/default-llm — set the org-default LLM.\n     * ORG_ADMIN only. The model must be available to the org's tier per\n     * or the gateway returns K9O_TIER_FEATURE_GATED.\n     */\n    async set(input: { modelId: LLMModelId }): Promise<Envelope<LLMModelId>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"org/default-llm\"), body: input });\n    },\n  };\n}\n\n// ----------------------------------------------------------------------\n// Top-level namespace\n// ----------------------------------------------------------------------\n\nexport function makeOrgNamespace(config: HttpClientConfig) {\n  return {\n    /** Member lifecycle — list / invite / get / remove. */\n    members: makeMembersNamespace(config),\n    /** Group lifecycle — list / create / get / delete. */\n    groups: makeGroupsNamespace(config),\n    /** Org-plane audit log — query / tail. Distinct from project-plane `client.audit`. */\n    auditLog: makeOrgAuditLogNamespace(config),\n    /** Gate (IAK) org-level surfaces — role-grants + IdP-providers. */\n    gate: makeOrgGateNamespace(config),\n    /** Org-level SMTP config — get / set / test / unset. */\n    smtp: makeSmtpNamespace(config),\n    /** Org-default LLM — get / set (ORG_ADMIN). */\n    defaultLLM: makeDefaultLlmNamespace(config),\n\n    /**\n     * GET /org — read the current org (slug + name + status + settings).\n     * Mirrors `client.orgs.current()` for symmetry; `client.org.get()` is\n     * the singular-namespace convention for use within an org-bound client.\n     */\n    async get(): Promise<Envelope<{ id: string; slug: string; name: string; status: string; createdAt: string }>> {\n      return request(config, { method: \"GET\", path: orgPath(\"org\") });\n    },\n  };\n}\n","/**\n * Operator-self SDK namespace — `client.me.*`.\n *\n * Distinct from tenant-\n * scoped surfaces: `/me/*` is the operator-self lane that does NOT\n * require org or project context.\n *\n * Wire mapping (gateway uses platform-plane / cross-org `/me/...` routes):\n *   - `client.me.profile.get/update` → GET/PATCH /me\n *   - `client.me.sessions.list/revoke` → GET/DELETE /me/sessions\n *   - `client.me.apiTokens.list/create/delete` → GET/POST/DELETE /me/api-tokens (not available yet)\n *   - `client.me.notifications.list/markRead` → GET/PATCH /me/notifications (not available yet)\n *   - `client.me.auditLog.query` → GET /me/audit-log (not available yet)\n *   - `client.me.dataExport.request` → POST /me/data-export (not available yet)\n *\n * Profile, sessions and MFA setup are served by the existing gateway routes\n * `me.ts` + `mfa.ts`.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\nexport type MyProfile = {\n  /** `u_<base62>`. */\n  id: string;\n  email: string;\n  displayName: string | null;\n  /** ISO 8601. */\n  createdAt: string;\n  /** Last activity timestamp. */\n  lastActiveAt: string | null;\n};\n\nexport type MySession = {\n  /** `sess_<base62>`. */\n  id: string;\n  /** Initial sign-in time. */\n  createdAt: string;\n  /** Most recent activity time. */\n  lastSeenAt: string;\n  userAgent: string | null;\n  ipAddress: string | null;\n  /** Whether this session is the one issuing the current request. */\n  current: boolean;\n};\n\nexport type MyApiToken = {\n  /** `tok_<base62>`. */\n  id: string;\n  name: string;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601 or null for non-expiring tokens. */\n  expiresAt: string | null;\n  /** Last 4 chars for display. */\n  suffix: string;\n  scope: string;\n};\n\nexport type MyNotification = {\n  id: string;\n  type: string;\n  payload: Record<string, unknown>;\n  createdAt: string;\n  readAt: string | null;\n};\n\nexport function makeMeNamespace(config: HttpClientConfig) {\n  return {\n    profile: {\n      /** GET /me — operator profile (cross-org). */\n      async get(): Promise<Envelope<MyProfile>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me\") });\n      },\n\n      /** PATCH /me — update mutable profile fields (displayName). */\n      async update(patch: { displayName?: string | null }): Promise<Envelope<MyProfile>> {\n        return request(config, { method: \"PATCH\", path: orgPath(\"me\"), body: patch });\n      },\n    },\n\n    sessions: {\n      /** GET /me/sessions — list active sessions for the operator. */\n      async list(): Promise<Envelope<ReadonlyArray<MySession>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/sessions\") });\n      },\n\n      /** DELETE /me/sessions/<sessionId> — revoke a specific session. */\n      async revoke(sessionId: string): Promise<Envelope<{ revoked: boolean }>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`me/sessions/${encodeURIComponent(sessionId)}`) });\n      },\n\n      /** DELETE /me/sessions (no path) — revoke all sessions except the current one. */\n      async revokeAll(): Promise<Envelope<{ revoked: number }>> {\n        return request(config, { method: \"DELETE\", path: orgPath(\"me/sessions\") });\n      },\n    },\n\n    /**\n     * API tokens for personal scripting. The gateway endpoints are not available yet,\n     * so these methods return K9O_NOT_FOUND until they ship.\n     */\n    apiTokens: {\n      async list(): Promise<Envelope<ReadonlyArray<MyApiToken>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/api-tokens\") });\n      },\n\n      async create(input: { name: string; expiresInDays?: number | undefined; scope?: string | undefined }): Promise<Envelope<MyApiToken & { token: string }>> {\n        return request(config, { method: \"POST\", path: orgPath(\"me/api-tokens\"), body: input });\n      },\n\n      async delete(tokenId: string): Promise<Envelope<{ deleted: boolean }>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`me/api-tokens/${encodeURIComponent(tokenId)}`) });\n      },\n    },\n\n    /**\n     * Notifications — operator-targeted (account-level events). Forward-\n     * cycle substrate; methods route correctly when gateway ships.\n     */\n    notifications: {\n      async list(opts?: { unreadOnly?: boolean | undefined; limit?: number | undefined; cursor?: string | undefined }): Promise<Envelope<ReadonlyArray<MyNotification>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/notifications\"), query: opts });\n      },\n\n      async markRead(notificationId: string): Promise<Envelope<MyNotification>> {\n        return request(config, { method: \"PATCH\", path: orgPath(`me/notifications/${encodeURIComponent(notificationId)}`), body: { read: true } });\n      },\n\n      async markAllRead(): Promise<Envelope<{ marked: number }>> {\n        return request(config, { method: \"PATCH\", path: orgPath(\"me/notifications\"), body: { read: true } });\n      },\n    },\n\n    /**\n     * Operator-self audit log — actions performed BY this operator across\n     * orgs. Distinct from `client.audit` (project-plane) and\n     * `client.org.auditLog` (org-plane).\n     */\n    auditLog: {\n      async query(opts?: { since?: string | undefined; until?: string | undefined; type?: string | undefined; limit?: number | undefined; cursor?: string | undefined }): Promise<Envelope<ReadonlyArray<{ id: string; type: string; occurredAt: string; payload: Record<string, unknown> }>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/audit-log\"), query: opts });\n      },\n    },\n\n    /**\n     * Personal data export per GDPR-style requests. Returns a job id\n     * the operator polls for completion.\n     */\n    dataExport: {\n      async request(input?: { format?: \"json\" | \"csv\" }): Promise<Envelope<{ jobId: string; status: \"queued\" | \"in-progress\" | \"ready\" }>> {\n        return request(config, { method: \"POST\", path: orgPath(\"me/data-export\"), body: input ?? {} });\n      },\n\n      async status(jobId: string): Promise<Envelope<{ jobId: string; status: \"queued\" | \"in-progress\" | \"ready\" | \"failed\"; downloadUrl: string | null }>> {\n        return request(config, { method: \"GET\", path: orgPath(`me/data-export/${encodeURIComponent(jobId)}`) });\n      },\n    },\n  };\n}\n","/**\n * Studio Workflows SDK — `client.studio.workflows.*`.\n *\n * Workflows substrate. Mirrors\n * `_sys.workflows` + `_sys.workflow_runs` row shapes.\n *\n * Wire mapping (project-plane;):\n *   - list()                       → GET    /@<slug>/workflows\n *   - create(workflow)             → POST   /@<slug>/workflows\n *   - read(id)                     → GET    /@<slug>/workflows/<wfl-id>\n *   - update(id, updates)          → PATCH  /@<slug>/workflows/<wfl-id>\n *   - delete(id)                   → DELETE /@<slug>/workflows/<wfl-id>\n *   - trigger(id, triggerContext)  → POST   /@<slug>/workflows/<wfl-id>/runs\n *   - runs.list(id)                → GET    /@<slug>/workflows/<wfl-id>/runs\n *   - runs.read(id, runId)         → GET    /@<slug>/workflows/<wfl-id>/runs/<wfr-id>\n *   - runs.cancel(id, runId)       → POST   /@<slug>/workflows/<wfl-id>/runs/<wfr-id>/cancel\n *\n * Per RBAC: create/update/delete/trigger/cancel require\n * PROJECT_AUTHOR; list/read/runs read against all cohort roles subject\n * to RLS. Per, surfaces 6 K9O_WORKFLOW_* error codes (see\n * `WORKFLOW_ERROR_CODES`); callers narrow on `error.code`.\n */\n\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\n\n// ----------------------------------------------------------------------\n// Enums (closed at v2 launch +; extensible v2.x)\n// ----------------------------------------------------------------------\n\n/** 5-trigger catalogue. */\nexport type WorkflowTriggerType =\n  | \"view_row_event\"\n  | \"form_submission\"\n  | \"scheduled\"\n  | \"manual\"\n  | \"webhook\";\n\n/** 9-action catalogue. */\nexport type WorkflowActionType =\n  | \"write_collection\"\n  | \"read_collection\"\n  | \"invoke_function\"\n  | \"invoke_extension\"\n  | \"llm_inference\"\n  | \"send_notification\"\n  | \"http_request\"\n  | \"approval_step\"\n  | \"branch\";\n\nexport type WorkflowStatus = \"active\" | \"archived\" | \"draft\";\n\nexport type WorkflowRunStatus =\n  | \"pending\"\n  | \"running\"\n  | \"succeeded\"\n  | \"failed\"\n  | \"cancelled\";\n\n/** A single step in the `actions` chain. */\nexport type WorkflowAction = {\n  index: number;\n  action_type: WorkflowActionType;\n  config: Record<string, unknown>;\n  retry?: { maxAttempts: number; backoffStrategy?: string };\n  condition?: Record<string, unknown>;\n  /** Sibling steps with parallel:true execute concurrently. */\n  parallel?: boolean;\n};\n\n// ----------------------------------------------------------------------\n// Resource shapes (mirror _sys.workflows + _sys.workflow_runs rows)\n// ----------------------------------------------------------------------\n\n/** Workflow record `_sys.workflows` row. */\nexport type Workflow = {\n  /** `wfl_<base62>`. */\n  id: string;\n  projectId: string;\n  name: string;\n  description: string;\n  status: WorkflowStatus;\n  triggerType: WorkflowTriggerType;\n  /** Shape varies per triggerType. */\n  triggerConfig: Record<string, unknown>;\n  /** Chain definition. */\n  actions: ReadonlyArray<WorkflowAction>;\n  /** Approver-step participant resolution. */\n  rbacBinding: Record<string, unknown>;\n  authoredBy: string;\n  authoredAt: string;\n  updatedBy: string;\n  updatedAt: string;\n};\n\n/** Per-step status entry in a run `per_step_status`. */\nexport type WorkflowRunStep = {\n  stepIndex: number;\n  actionType: WorkflowActionType;\n  status: \"running\" | \"succeeded\" | \"failed\" | \"awaiting_approval\";\n  startedAt: string;\n  completedAt?: string | null;\n  error?: Record<string, unknown> | null;\n  outputSummary?: unknown;\n  costSubtotal?: number;\n};\n\n/** Workflow run record `_sys.workflow_runs` row. */\nexport type WorkflowRun = {\n  /** `wfr_<base62>`. */\n  id: string;\n  workflowId: string;\n  projectId: string;\n  status: WorkflowRunStatus;\n  triggerContext: Record<string, unknown>;\n  perStepStatus: ReadonlyArray<WorkflowRunStep>;\n  costAccountingTotal: number;\n  errorContext?: Record<string, unknown> | null;\n  startedAt: string;\n  completedAt: string | null;\n  firedBy: string;\n};\n\n/** Create input — omits server-assigned fields. */\nexport type CreateWorkflowInput = {\n  name: string;\n  description?: string;\n  status?: WorkflowStatus;\n  triggerType: WorkflowTriggerType;\n  triggerConfig: Record<string, unknown>;\n  actions: ReadonlyArray<WorkflowAction>;\n  rbacBinding?: Record<string, unknown>;\n};\n\nexport type UpdateWorkflowInput = Partial<\n  Pick<\n    CreateWorkflowInput,\n    \"name\" | \"description\" | \"status\" | \"triggerType\" | \"triggerConfig\" | \"actions\" | \"rbacBinding\"\n  >\n>;\n\nexport type WorkflowListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: WorkflowStatus;\n  triggerType?: WorkflowTriggerType;\n};\n\nexport type WorkflowRunListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: WorkflowRunStatus;\n};\n\n/**\n * 6 K9O_WORKFLOW_* error codes. KError code-space is\n * open; these constants document the well-known codes for narrowing\n * (`if (e.code === WORKFLOW_ERROR_CODES.RUN_NOT_CANCELLABLE)`).\n */\nexport const WORKFLOW_ERROR_CODES = {\n  NOT_FOUND: \"K9O_WORKFLOW_NOT_FOUND\",\n  TRIGGER_INVALID: \"K9O_WORKFLOW_TRIGGER_INVALID\",\n  ACTION_INVALID: \"K9O_WORKFLOW_ACTION_INVALID\",\n  RUN_NOT_FOUND: \"K9O_WORKFLOW_RUN_NOT_FOUND\",\n  RUN_NOT_CANCELLABLE: \"K9O_WORKFLOW_RUN_NOT_CANCELLABLE\",\n  WEBHOOK_SIGNATURE_INVALID: \"K9O_WORKFLOW_WEBHOOK_SIGNATURE_INVALID\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"studio.workflows operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nfunction makeRunsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/workflows/<wfl-id>/runs — cursor-paginated runs list. */\n    async list(workflowId: string, filters?: WorkflowRunListFilters): Promise<Envelope<ReadonlyArray<WorkflowRun>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs`),\n        query: filters,\n      });\n    },\n\n    /** GET /@<slug>/workflows/<wfl-id>/runs/<wfr-id> — run detail (per-step + cost). */\n    async read(workflowId: string, runId: string): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}`),\n      });\n    },\n\n    /** POST /@<slug>/workflows/<wfl-id>/runs/<wfr-id>/cancel — cancel pending or running run. */\n    async cancel(workflowId: string, runId: string): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/cancel`),\n      });\n    },\n  };\n}\n\nexport function makeWorkflowsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/workflows — list workflows (cursor pagination). */\n    async list(filters?: WorkflowListFilters): Promise<Envelope<ReadonlyArray<Workflow>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"workflows\"), query: filters });\n    },\n\n    /** POST /@<slug>/workflows — create a workflow. Requires PROJECT_AUTHOR. */\n    async create(workflow: CreateWorkflowInput): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"POST\", path: projectPath(slug, \"workflows\"), body: workflow });\n    },\n\n    /** GET /@<slug>/workflows/<wfl-id> — read a workflow. */\n    async read(workflowId: string): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n      });\n    },\n\n    /** PATCH /@<slug>/workflows/<wfl-id> — update a workflow. Requires PROJECT_AUTHOR. */\n    async update(workflowId: string, updates: UpdateWorkflowInput): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n        body: updates,\n      });\n    },\n\n    /** DELETE /@<slug>/workflows/<wfl-id> — delete a workflow. Requires PROJECT_AUTHOR. */\n    async delete(workflowId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n      });\n    },\n\n    /**\n     * POST /@<slug>/workflows/<wfl-id>/runs — manual-trigger a run.\n     * Valid only for `triggerType: 'manual'` workflows.\n     * Requires PROJECT_AUTHOR. Returns the materialised WorkflowRun.\n     */\n    async trigger(workflowId: string, triggerContext: Record<string, unknown> = {}): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs`),\n        body: triggerContext,\n      });\n    },\n\n    /** Run sub-namespace — list / read / cancel runs of a workflow. */\n    runs: makeRunsNamespace(config),\n  };\n}\n","/**\n * Studio Dashboards SDK — `client.studio.dashboards.*`.\n *\n * Dashboards persisted authoring substrate.\n * Mirrors `_sys.dashboards` row shape.\n *\n * Wire mapping (project-plane;):\n *   - list()                  → GET    /@<slug>/dashboards\n *   - create(dashboard)       → POST   /@<slug>/dashboards\n *   - read(id)                → GET    /@<slug>/dashboards/<dsh-id>\n *   - update(id, updates)     → PATCH  /@<slug>/dashboards/<dsh-id>\n *   - delete(id)              → DELETE /@<slug>/dashboards/<dsh-id>\n *   - pin(id)                 → POST   /@<slug>/dashboards/<dsh-id>/pin\n *   - unpin(id)               → POST   /@<slug>/dashboards/<dsh-id>/unpin\n *\n * Per RBAC: create/update/delete/pin/unpin require\n * PROJECT_AUTHOR; list/read read against all cohort roles subject\n * to RLS. Per, surfaces 2 K9O_DASHBOARD_* codes.\n */\n\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\n\n// ----------------------------------------------------------------------\n// Enums (closed at v2 launch +)\n// ----------------------------------------------------------------------\n\n/** 9-widget catalogue. */\nexport type WidgetType =\n  | \"kpi_card\"\n  | \"bar_chart\"\n  | \"line_chart\"\n  | \"pie_chart\"\n  | \"data_table\"\n  | \"filter_dropdown\"\n  | \"filter_date_range\"\n  | \"text_panel\"\n  | \"workflow_status\";\n\n/** Widget data source modes. */\nexport type WidgetDataSourceMode = \"view\" | \"query\" | \"workflow\" | \"rollup\" | \"form\";\n\nexport type DashboardStatus = \"active\" | \"archived\" | \"draft\";\n\n/** A widget config entry in the `widgets` array. */\nexport type Widget = {\n  id: string;\n  widgetType: WidgetType;\n  title?: string;\n  dataSource: {\n    mode: WidgetDataSourceMode;\n    /** Resolved per mode: viewId / queryId / workflowId / rollupSlug / formId. */\n    config: Record<string, unknown>;\n  };\n  /** Widget-local config (display options, thresholds, etc.). */\n  config?: Record<string, unknown>;\n};\n\n// ----------------------------------------------------------------------\n// Resource shapes (mirror _sys.dashboards row)\n// ----------------------------------------------------------------------\n\n/** Dashboard record `_sys.dashboards` row. */\nexport type Dashboard = {\n  /** `dsh_<base62>`. */\n  id: string;\n  projectId: string;\n  name: string;\n  description: string;\n  status: DashboardStatus;\n  /** Widget positions + sizes per output-03 layout schema. */\n  layoutGrid: Record<string, unknown>;\n  widgets: ReadonlyArray<Widget>;\n  /** Dashboard-level filter widgets cascade to per-widget data sources. */\n  filterConfig: Record<string, unknown>;\n  /** Pathmaker org-pin per output-03; surfaces in Workspace sidebar. */\n  pinnedToWorkspace: boolean;\n  rbacBinding: Record<string, unknown>;\n  authoredBy: string;\n  authoredAt: string;\n  updatedBy: string;\n  updatedAt: string;\n};\n\nexport type CreateDashboardInput = {\n  name: string;\n  description?: string;\n  status?: DashboardStatus;\n  layoutGrid?: Record<string, unknown>;\n  widgets?: ReadonlyArray<Widget>;\n  filterConfig?: Record<string, unknown>;\n  rbacBinding?: Record<string, unknown>;\n};\n\nexport type UpdateDashboardInput = Partial<CreateDashboardInput>;\n\nexport type DashboardListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: DashboardStatus;\n  pinnedToWorkspace?: boolean;\n};\n\n/** 2 K9O_DASHBOARD_* error codes. */\nexport const DASHBOARD_ERROR_CODES = {\n  NOT_FOUND: \"K9O_DASHBOARD_NOT_FOUND\",\n  WIDGET_INVALID: \"K9O_DASHBOARD_WIDGET_INVALID\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"studio.dashboards operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeDashboardsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/dashboards — list dashboards (cursor pagination). */\n    async list(filters?: DashboardListFilters): Promise<Envelope<ReadonlyArray<Dashboard>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"dashboards\"), query: filters });\n    },\n\n    /** POST /@<slug>/dashboards — create a dashboard. Requires PROJECT_AUTHOR. */\n    async create(dashboard: CreateDashboardInput): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"POST\", path: projectPath(slug, \"dashboards\"), body: dashboard });\n    },\n\n    /** GET /@<slug>/dashboards/<dsh-id> — read a dashboard. */\n    async read(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n      });\n    },\n\n    /** PATCH /@<slug>/dashboards/<dsh-id> — update a dashboard. Requires PROJECT_AUTHOR. */\n    async update(dashboardId: string, updates: UpdateDashboardInput): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n        body: updates,\n      });\n    },\n\n    /** DELETE /@<slug>/dashboards/<dsh-id> — delete a dashboard. Requires PROJECT_AUTHOR. */\n    async delete(dashboardId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n      });\n    },\n\n    /** POST /@<slug>/dashboards/<dsh-id>/pin — pin to Workspace sidebar. Requires PROJECT_AUTHOR. */\n    async pin(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}/pin`),\n      });\n    },\n\n    /** POST /@<slug>/dashboards/<dsh-id>/unpin — unpin. Requires PROJECT_AUTHOR. */\n    async unpin(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}/unpin`),\n      });\n    },\n  };\n}\n","/**\n * Studio namespace — `client.studio.*`.\n *\n * Groups the Pathmaker-authored Studio surfaces: dashboards and workflows.\n */\n\nimport type { HttpClientConfig } from \"../http.ts\";\nimport { makeWorkflowsNamespace } from \"./workflows.ts\";\nimport { makeDashboardsNamespace } from \"./dashboards.ts\";\n\nexport function makeStudioNamespace(config: HttpClientConfig) {\n  return {\n    /** Workflow lifecycle + runs — `client.studio.workflows.*`. */\n    workflows: makeWorkflowsNamespace(config),\n    /** Dashboard lifecycle + widget data — `client.studio.dashboards.*`. */\n    dashboards: makeDashboardsNamespace(config),\n  };\n}\n","/**\n * Minimal SSE (Server-Sent Events) stream parser — internal.\n *\n * Used by:\n *   - `client.compute.llms.invokeStream()` (`/invoke-stream`)\n *   - `client.realtime.subscribe()` SSE transport fallback\n *\n * Parses an SSE byte stream (a `ReadableStream<Uint8Array>` from a fetch\n * `Response.body`) into an async iterable of parsed `data:` payloads.\n * Each event's `data:` field is JSON-parsed; events whose data is the\n * sentinel `[DONE]` terminate the stream (OpenAI-compatible convention,\n * matched by the gateway's streaming surfaces).\n *\n * Per the SDK-abstracted-primitive discipline\n * (`feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`),\n * transport mechanics stay internal; consumers see a clean async iterable.\n */\n\n/**\n * Parse an SSE stream into an async iterable of JSON-decoded `data:`\n * payloads. Multi-line `data:` fields are concatenated with `\\n` per the\n * SSE spec; the assembled payload is `JSON.parse`d. Non-JSON payloads\n * yield the raw string.\n */\nexport async function* parseSseStream<T>(\n  body: ReadableStream<Uint8Array>,\n): AsyncGenerator<T, void, void> {\n  const reader = body.getReader();\n  const decoder = new TextDecoder();\n  let buffer = \"\";\n\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      buffer += decoder.decode(value, { stream: true });\n\n      // Events are separated by a blank line (\\n\\n). Process complete events.\n      let sepIndex: number;\n      while ((sepIndex = indexOfEventBoundary(buffer)) !== -1) {\n        const rawEvent = buffer.slice(0, sepIndex);\n        buffer = buffer.slice(sepIndex).replace(/^(\\r?\\n)+/, \"\");\n        const payload = extractData(rawEvent);\n        if (payload === null) continue;\n        if (payload === \"[DONE]\") return;\n        yield decodePayload<T>(payload);\n      }\n    }\n\n    // Flush any trailing event without a terminating blank line.\n    const tail = buffer.trim();\n    if (tail.length > 0) {\n      const payload = extractData(tail);\n      if (payload !== null && payload !== \"[DONE]\") {\n        yield decodePayload<T>(payload);\n      }\n    }\n  } finally {\n    reader.releaseLock();\n  }\n}\n\nfunction indexOfEventBoundary(buffer: string): number {\n  const lf = buffer.indexOf(\"\\n\\n\");\n  const crlf = buffer.indexOf(\"\\r\\n\\r\\n\");\n  if (lf === -1) return crlf;\n  if (crlf === -1) return lf;\n  return Math.min(lf, crlf);\n}\n\n/** Extract + concatenate `data:` lines from a single raw SSE event block. */\nfunction extractData(rawEvent: string): string | null {\n  const lines = rawEvent.split(/\\r?\\n/);\n  const dataLines: string[] = [];\n  for (const line of lines) {\n    if (line.startsWith(\":\")) continue; // comment / heartbeat\n    if (line.startsWith(\"data:\")) {\n      dataLines.push(line.slice(5).replace(/^ /, \"\"));\n    }\n  }\n  if (dataLines.length === 0) return null;\n  return dataLines.join(\"\\n\");\n}\n\nfunction decodePayload<T>(payload: string): T {\n  try {\n    return JSON.parse(payload) as T;\n  } catch {\n    return payload as unknown as T;\n  }\n}\n","/**\n * Compute LLMs SDK — `client.compute.llms.*`.\n *\n * Compute LLMs registry. Curated 9-model library\n * + 4-endpoint family + per-model tier-gating.\n *\n * Wire mapping (project-plane;):\n *   - list()                    → GET  /@<slug>/compute/llms\n *   - read(modelId)             → GET  /@<slug>/compute/llms/<model-id>\n *   - invoke(modelId, ...)      → POST /@<slug>/compute/llms/<model-id>/invoke\n *   - invokeStream(modelId,...) → POST /@<slug>/compute/llms/<model-id>/invoke-stream (SSE)\n *\n * Per RBAC: list/read against all cohort roles; invoke +\n * invokeStream require PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).\n * Per, surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503) +\n * reuses K9O_MODEL_NOT_DECLARED / K9O_TIER_FEATURE_GATED /\n * K9O_AGENT_INFERENCE_TIMEOUT.\n */\n\nimport { request, requestStream, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\nimport { parseSseStream } from \"../internal/sse.ts\";\n\n/** Curated 9-model closed enum at v2 launch (extensible v2.x). */\nexport type LLMModelId =\n  | \"mistral-7b\"\n  | \"mistral-8x7b\"\n  | \"llama-3-8b\"\n  | \"llama-3-70b\"\n  | \"claude-3-5-sonnet\"\n  | \"gpt-4o\"\n  | \"gpt-4o-mini\"\n  | \"text-embedding-3-small\"\n  | \"text-embedding-3-large\";\n\nexport type LLMProviderClass = \"self-hosted\" | \"external\";\nexport type LLMModality = \"text-completion\" | \"text-completion+tool-use\" | \"embeddings\";\n\n/** Model metadata + (cost transparency). */\nexport type LLMModel = {\n  id: LLMModelId;\n  providerClass: LLMProviderClass;\n  modality: LLMModality;\n  /** Minimum tier gate (e.g. \"base-camp\", \"ascent\", \"ridge\"). */\n  tierGate: string;\n  contextWindow: number;\n  capabilities: ReadonlyArray<string>;\n  /** Per-model token cost for cost-transparency. */\n  costPerMillionInputTokens: number;\n  costPerMillionOutputTokens: number;\n};\n\n/** Inference parameters (passed through to provider). */\nexport type LLMInvokeParams = {\n  maxTokens?: number;\n  temperature?: number;\n  topP?: number;\n  stop?: ReadonlyArray<string>;\n  [key: string]: unknown;\n};\n\n/** Synchronous inference response `/invoke`. */\nexport type LLMResponse = {\n  completion: string;\n  tokensUsed: number;\n  latencyMs: number;\n};\n\n/** Streaming chunk `/invoke-stream` (SSE per-token). */\nexport type LLMStreamChunk = {\n  /** Incremental completion delta. */\n  delta: string;\n  /** True on the terminal chunk. */\n  done?: boolean;\n  /** Populated on terminal chunk. */\n  tokensUsed?: number;\n};\n\nexport type LLMInvokeInput = {\n  prompt: string;\n  params?: LLMInvokeParams;\n};\n\n/** Error code coined in (others reused). */\nexport const LLM_ERROR_CODES = {\n  PROVIDER_UNAVAILABLE: \"K9O_LLM_PROVIDER_UNAVAILABLE\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"compute.llms operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeLlmsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/compute/llms — list models available to the project tier. */\n    async list(opts?: { modality?: LLMModality; providerClass?: LLMProviderClass }): Promise<Envelope<ReadonlyArray<LLMModel>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"compute/llms\"), query: opts });\n    },\n\n    /** GET /@<slug>/compute/llms/<model-id> — read single model metadata + cost. */\n    async read(modelId: LLMModelId | string): Promise<Envelope<LLMModel>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}`),\n      });\n    },\n\n    /**\n     * POST /@<slug>/compute/llms/<model-id>/invoke — synchronous inference.\n     * Requires PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).\n     */\n    async invoke(modelId: LLMModelId | string, input: LLMInvokeInput): Promise<Envelope<LLMResponse>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}/invoke`),\n        body: { prompt: input.prompt, params: input.params },\n      });\n    },\n\n    /**\n     * POST /@<slug>/compute/llms/<model-id>/invoke-stream — streaming\n     * inference (SSE; per-token delta for low-latency UX).\n     * Returns an async iterable of `LLMStreamChunk` — caller writes\n     * `for await (const chunk of client.compute.llms.invokeStream(...))`.\n     * The SDK handles SSE framing internally per\n     * `feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`.\n     */\n    async *invokeStream(modelId: LLMModelId | string, input: LLMInvokeInput): AsyncGenerator<LLMStreamChunk, void, void> {\n      const slug = requireProjectSlug(config);\n      const response = await requestStream(config, {\n        method: \"POST\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}/invoke-stream`),\n        body: { prompt: input.prompt, params: input.params },\n        accept: \"text/event-stream\",\n      });\n      // requestStream guarantees a non-null body on 2xx.\n      yield* parseSseStream<LLMStreamChunk>(response.body as ReadableStream<Uint8Array>);\n    },\n  };\n}\n\nexport function makeComputeNamespace(config: HttpClientConfig) {\n  return {\n    /** LLM registry + inference — `client.compute.llms.*`. */\n    llms: makeLlmsNamespace(config),\n  };\n}\n","/**\n * `client.ai.*` — platform AI primitives (`k9o.ai.embed()` is a platform primitive, not sugar over\n * `context.embed`).\n *\n * Wire mapping (project-plane):\n *   - embed({ model?, input }) → POST /@<slug>/ai/embeddings   body { model?, input: string | string[] }\n *                              → { data: { embeddings: number[][], model, dimensions }, meta }\n *\n * Callers are an extension (authority is the `(ai, embed, \"*\")` manifest grant) or a project member's own\n * backend; the gateway refuses an end user's client. Bounds (enforced by the gateway, not here): at most 64\n * inputs, each non-empty, at most 256 KiB of input per request, at most 4 requests in flight per project.\n * The platform adds nothing to the input: callers add the model's task prefixes themselves. The SDK sends the\n * input exactly as given and never puts it in an error.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** The one declared embedding model today. A different `model` is refused with `K9O_MODEL_NOT_DECLARED`. */\nexport type EmbeddingModelId = \"nomic-embed-text-v1.5\";\n\nexport type EmbedInput = {\n  /** Optional; defaults server-side to the one declared embedding model. */\n  model?: EmbeddingModelId | (string & {});\n  /** One string, or an array of strings; the result has one vector per string, in order. */\n  input: string | ReadonlyArray<string>;\n};\n\nexport type EmbedResult = {\n  /** One vector per input string, in input order. */\n  embeddings: number[][];\n  model: string;\n  dimensions: number;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"ai operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeAiNamespace(config: HttpClientConfig) {\n  return {\n    /** POST /@<slug>/ai/embeddings — embed one or more strings. */\n    async embed(input: EmbedInput): Promise<Envelope<EmbedResult>> {\n      const slug = requireProjectSlug(config);\n      const body: { model?: string; input: string | string[] } = {\n        input: typeof input.input === \"string\" ? input.input : [...input.input],\n      };\n      if (input.model !== undefined) body.model = input.model;\n      return request(config, { method: \"POST\", path: projectPath(slug, \"ai/embeddings\"), body });\n    },\n  };\n}\n","/**\n * Realtime Subscriptions SDK — `client.realtime.*`.\n *\n * Realtime Subscriptions ALL-LIVE primitive.\n *\n * `client.realtime.subscribe(topic, options?)` returns an async iterable\n * yielding `RealtimeEvent`s — the caller writes idiomatic\n * `for await (const event of client.realtime.subscribe(topic)) { ... }`.\n *\n * Per `feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`\n * +: the SDK chooses the transport (WebSocket primary → SSE\n * → poll), transparently. SPLIT (polling) is the SDK-internal fallback\n * when WebSocket / SSE are unavailable — NOT a consumer-side design\n * choice. The consumer sees one uniform async iterable regardless.\n *\n * Wire mapping (project-plane;):\n *   - subscribe → GET  /@<slug>/realtime/subscribe?topic=<t>&filter=<jsonb> (WS/SSE upgrade)\n *   - replay    → POST /@<slug>/realtime/replay  { topic, fromSequence, untilSequence?, limit? }\n *\n * Per, `filter` + RLS compose (filter narrows, RLS gates).\n * Per, surfaces no new codes — reuses K9O_INVALID_FILTER +\n * K9O_SUBSCRIPTION_LIMIT_EXCEEDED + K9O_TIER_FEATURE_GATED.\n */\n\nimport { request, requestStream, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport { parseSseStream } from \"./internal/sse.ts\";\n\n// ----------------------------------------------------------------------\n// Topic catalogue (closed 6-family enum)\n// ----------------------------------------------------------------------\n\n/**\n * The 6 closed subscription topic families. Concrete\n * topic strings carry a dynamic segment (collection name, resource id,\n * event family) — use `realtimeTopic.*` builders to construct them.\n */\nexport type RealtimeTopicFamily =\n  | \"collections\"\n  | \"studio.workflows.runs\"\n  | \"studio.queries.executed\"\n  | \"studio.dashboards.refresh\"\n  | \"forge.functions.invocations\"\n  | \"audit.org\";\n\n/** A concrete topic string, e.g. `studio.dashboards.refresh.dsh_abc`. */\nexport type RealtimeTopic = string;\n\n/**\n * Typed builders for the 6 topic families. Prefer these\n * over hand-built strings for compile-time family safety.\n */\nexport const realtimeTopic = {\n  /** `collections.<collection>.*` — row insert / update / delete events. */\n  collection(collection: string): RealtimeTopic {\n    return `collections.${collection}.*`;\n  },\n  /** `studio.workflows.runs.*` — run started / step_changed / approval_pending / completed. */\n  workflowRuns(): RealtimeTopic {\n    return \"studio.workflows.runs.*\";\n  },\n  /** `studio.queries.executed.<query-id>` — query execute events. */\n  queryExecuted(queryId: string): RealtimeTopic {\n    return `studio.queries.executed.${queryId}`;\n  },\n  /** `studio.dashboards.refresh.<dashboard-id>` — widget data refresh. */\n  dashboardRefresh(dashboardId: string): RealtimeTopic {\n    return `studio.dashboards.refresh.${dashboardId}`;\n  },\n  /** `forge.functions.invocations.<function-id>` — invoked / completed / failed. */\n  functionInvocations(functionId: string): RealtimeTopic {\n    return `forge.functions.invocations.${functionId}`;\n  },\n  /** `audit.org.<event-family>` — org-plane audit events. */\n  auditOrg(eventFamily: string): RealtimeTopic {\n    return `audit.org.${eventFamily}`;\n  },\n} as const;\n\n// ----------------------------------------------------------------------\n// Event + filter shapes\n// ----------------------------------------------------------------------\n\n/** Per-topic filter predicate (vocabulary). */\nexport type RealtimeFilter = Record<string, unknown>;\n\n/** A single realtime event delivered on a subscription. */\nexport type RealtimeEvent<T = unknown> = {\n  topic: RealtimeTopic;\n  /** Event type within the topic family (e.g. `row_inserted`, `workflow.run.completed`). */\n  type: string;\n  /** Monotonic sequence number — use as `fromSequence` for replay catch-up. */\n  sequence: number;\n  payload: T;\n  occurredAt: string;\n};\n\nexport type SubscribeOptions = {\n  filter?: RealtimeFilter;\n  /** Abort the subscription (closes the underlying transport). */\n  signal?: AbortSignal;\n  /**\n   * Force a transport instead of the WebSocket → SSE → poll cascade.\n   * Mainly for tests + constrained runtimes. Omit for production —\n   * the SDK picks the richest available transport.\n   */\n  transport?: RealtimeTransportKind;\n  /** Poll-transport interval in ms (default 2000). Only used when polling. */\n  pollIntervalMs?: number;\n};\n\nexport type RealtimeTransportKind = \"websocket\" | \"sse\" | \"poll\";\n\n/**\n * A live subscription. It is itself an async iterable (`for await`) and\n * exposes `close()` for explicit teardown + `transport` for diagnostics.\n */\nexport type RealtimeSubscription<T = unknown> = AsyncIterable<RealtimeEvent<T>> & {\n  /** Stop the subscription + release the underlying transport. */\n  close(): void;\n  /** The transport actually selected (post-fallback). */\n  readonly transport: RealtimeTransportKind;\n};\n\nexport type ReplayInput = {\n  topic: RealtimeTopic;\n  filter?: RealtimeFilter;\n  fromSequence: number;\n  untilSequence?: number;\n  limit?: number;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"realtime operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\n/** Pick the richest transport available in this runtime. */\nfunction selectTransport(forced?: RealtimeTransportKind): RealtimeTransportKind {\n  if (forced) return forced;\n  if (typeof (globalThis as { WebSocket?: unknown }).WebSocket === \"function\") return \"websocket\";\n  // SSE rides on fetch streaming, which the http layer already requires.\n  return \"sse\";\n}\n\n/** Convert an http(s) baseUrl to a ws(s) URL for the WebSocket transport. */\nfunction toWebSocketUrl(baseUrl: string, path: string, query: Record<string, string>): string {\n  const trimmed = baseUrl.endsWith(\"/\") ? baseUrl.slice(0, -1) : baseUrl;\n  const wsBase = trimmed.replace(/^http/, \"ws\");\n  const qs = new URLSearchParams(query).toString();\n  return `${wsBase}${path}${qs ? `?${qs}` : \"\"}`;\n}\n\n/** WebSocket transport — primary. Bridges socket → async queue. */\nasync function* websocketTransport<T>(\n  config: HttpClientConfig,\n  topic: RealtimeTopic,\n  options: SubscribeOptions,\n  closed: { value: boolean },\n): AsyncGenerator<RealtimeEvent<T>, void, void> {\n  const slug = requireProjectSlug(config);\n  const query: Record<string, string> = { topic };\n  if (options.filter) query.filter = JSON.stringify(options.filter);\n  if (config.apiKey) query.access_token = config.apiKey; // WS can't set Authorization header\n  const url = toWebSocketUrl(config.baseUrl, projectPath(slug, \"realtime/subscribe\"), query);\n  const WS = (globalThis as { WebSocket: new (url: string) => WebSocket }).WebSocket;\n  const socket = new WS(url);\n\n  const queue: RealtimeEvent<T>[] = [];\n  let resolveNext: (() => void) | null = null;\n  let socketClosed = false;\n  let socketError: Error | null = null;\n\n  const wake = () => {\n    if (resolveNext) {\n      resolveNext();\n      resolveNext = null;\n    }\n  };\n  socket.onmessage = (ev: MessageEvent) => {\n    try {\n      queue.push(JSON.parse(typeof ev.data === \"string\" ? ev.data : String(ev.data)) as RealtimeEvent<T>);\n    } catch {\n      /* ignore malformed frame */\n    }\n    wake();\n  };\n  socket.onerror = () => {\n    socketError = new Error(\"realtime websocket transport error\");\n    wake();\n  };\n  socket.onclose = () => {\n    socketClosed = true;\n    wake();\n  };\n  options.signal?.addEventListener(\"abort\", () => socket.close());\n\n  try {\n    while (!closed.value) {\n      if (queue.length > 0) {\n        yield queue.shift() as RealtimeEvent<T>;\n        continue;\n      }\n      if (socketClosed) {\n        if (socketError) throw socketError;\n        return;\n      }\n      await new Promise<void>((resolve) => {\n        resolveNext = resolve;\n      });\n    }\n  } finally {\n    try {\n      socket.close();\n    } catch {\n      /* already closed */\n    }\n  }\n}\n\n/** SSE transport — fallback. Rides on fetch streaming. */\nasync function* sseTransport<T>(\n  config: HttpClientConfig,\n  topic: RealtimeTopic,\n  options: SubscribeOptions,\n  closed: { value: boolean },\n): AsyncGenerator<RealtimeEvent<T>, void, void> {\n  const slug = requireProjectSlug(config);\n  const query: Record<string, string | number | boolean | undefined> = { topic };\n  if (options.filter) query.filter = JSON.stringify(options.filter);\n  const response = await requestStream(config, {\n    method: \"GET\",\n    path: projectPath(slug, \"realtime/subscribe\"),\n    query,\n    accept: \"text/event-stream\",\n  });\n  for await (const event of parseSseStream<RealtimeEvent<T>>(response.body as ReadableStream<Uint8Array>)) {\n    if (closed.value || options.signal?.aborted) return;\n    yield event;\n  }\n}\n\n/** Poll transport — last-resort fallback (SPLIT, SDK-internal). */\nasync function* pollTransport<T>(\n  config: HttpClientConfig,\n  topic: RealtimeTopic,\n  options: SubscribeOptions,\n  closed: { value: boolean },\n): AsyncGenerator<RealtimeEvent<T>, void, void> {\n  const slug = requireProjectSlug(config);\n  const interval = options.pollIntervalMs ?? 2000;\n  let cursor = 0;\n  while (!closed.value && !options.signal?.aborted) {\n    const { data } = await request<ReadonlyArray<RealtimeEvent<T>>>(config, {\n      method: \"POST\",\n      path: projectPath(slug, \"realtime/replay\"),\n      body: { topic, filter: options.filter, fromSequence: cursor },\n    });\n    for (const event of data ?? []) {\n      if (closed.value || options.signal?.aborted) return;\n      cursor = Math.max(cursor, event.sequence + 1);\n      yield event;\n    }\n    if (closed.value || options.signal?.aborted) return;\n    await new Promise<void>((resolve) => setTimeout(resolve, interval));\n  }\n}\n\nexport function makeRealtimeNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * Subscribe to a topic. Returns a `RealtimeSubscription` — an async\n     * iterable of `RealtimeEvent`s. The SDK selects the richest available\n     * transport (WebSocket → SSE → poll); the caller's\n     * `for await` loop is transport-agnostic.\n     *\n     * ```ts\n     * const sub = client.realtime.subscribe(\n     *   realtimeTopic.dashboardRefresh(\"dsh_abc\"),\n     * );\n     * for await (const event of sub) {\n     *   if (event.type === \"dashboard.widget.data_refreshed\") rerender(event.payload);\n     * }\n     * ```\n     */\n    subscribe<T = unknown>(topic: RealtimeTopic, options: SubscribeOptions = {}): RealtimeSubscription<T> {\n      requireProjectSlug(config);\n      const transport = selectTransport(options.transport);\n      const closed = { value: false };\n\n      const iterate = (): AsyncGenerator<RealtimeEvent<T>, void, void> => {\n        switch (transport) {\n          case \"websocket\":\n            return websocketTransport<T>(config, topic, options, closed);\n          case \"poll\":\n            return pollTransport<T>(config, topic, options, closed);\n          case \"sse\":\n          default:\n            return sseTransport<T>(config, topic, options, closed);\n        }\n      };\n\n      let active: AsyncGenerator<RealtimeEvent<T>, void, void> | null = null;\n      return {\n        transport,\n        [Symbol.asyncIterator]() {\n          active = iterate();\n          return active;\n        },\n        close() {\n          closed.value = true;\n          void active?.return(undefined);\n        },\n      };\n    },\n\n    /**\n     * One-shot historical replay — catch up on missed\n     * events from `fromSequence`. Capped at 10k events server-side;\n     * paginate via the returned events' `sequence`. Use the highest\n     * `sequence` you've seen as the next `fromSequence`.\n     */\n    async replay<T = unknown>(input: ReplayInput): Promise<Envelope<ReadonlyArray<RealtimeEvent<T>>>> {\n      const slug = requireProjectSlug(config);\n      if (!Number.isInteger(input.fromSequence) || input.fromSequence < 0) {\n        throw new KError({\n          code: \"K9O_INVALID_FILTER\",\n          message: \"replay fromSequence must be a non-negative integer\",\n          context: { fromSequence: input.fromSequence },\n          recommendation: \"Pass the highest sequence number you have already observed (or 0 to replay from the start).\",\n        });\n      }\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"realtime/replay\"),\n        body: {\n          topic: input.topic,\n          filter: input.filter,\n          fromSequence: input.fromSequence,\n          untilSequence: input.untilSequence,\n          limit: input.limit,\n        },\n      });\n    },\n  };\n}\n","/**\n * Pillar composition: `@k9o/core` ↔ `@k9o/gate`.\n *\n * `@k9o/core` composes `@k9o/gate` as the `client.gate` namespace on\n * the K9oClient, sharing the same `baseUrl` + `projectSlug` config.\n *\n * `@k9o/gate` remains independently importable for Auth0-parity\n * standalone deployments (Trojan Horse motion); the bridge here is the\n * composition path when the caller imports `@k9o/core` and wants the\n * full platform surface.\n *\n * Mode defaults to `native` for the composition path — Native is the\n * mode that pairs with the broader Kilimanjaro billing model per\n * `@k9o/gate/mode.ts`. Standalone customers should import\n * `@k9o/gate` directly and call `createGateClient({ mode: 'standalone', ... })`.\n *\n * KError vs GateError alignment is still open.\n * Until then both error types remain shape-compatible (`code` /\n * `message` / `context` / `recommendation` fields are identical),\n * and caller code that narrows on `error.code` works against either.\n */\n\nimport { createGateClient, type GateClient } from \"@k9o/gate\";\nimport type { HttpClientConfig } from \"./http.ts\";\nimport { KError } from \"./kerror.ts\";\n\n/**\n * Build the composed `client.gate` namespace bound to the K9oClient's\n * baseUrl + projectSlug. Requires `projectSlug` to be set on the\n * client config — gate operations are inherently project-scoped per\n * URL grammar.\n *\n * Returns `null` when projectSlug is not bound — the K9oClient may be\n * constructed for org-plane operations only (e.g. `client.orgs.list()`\n * or `client.projects.create()`), in which case gate operations are\n * not available until a per-project client is constructed.\n */\nexport function makeGateBridge(config: HttpClientConfig): GateClient | null {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    return null;\n  }\n  // Spread optional fields only when defined — GateConfig's partnerToken\n  // + fetch are non-optional-undefined under exactOptionalPropertyTypes.\n  return createGateClient({\n    mode: \"native\",\n    baseUrl: config.baseUrl,\n    projectSlug: config.projectSlug,\n    ...(config.apiKey !== undefined ? { partnerToken: config.apiKey } : {}),\n    ...(config.fetch !== undefined ? { fetch: config.fetch } : {}),\n  });\n}\n\n/**\n * Throw a helpful error when `client.gate` is accessed but projectSlug\n * is not bound. Wraps the null-return from `makeGateBridge` so callers\n * get a typed `K9O_MISSING_PROJECT_CONTEXT` rather than a null deref.\n */\nexport function gateNotAvailable(): never {\n  throw new KError({\n    code: \"K9O_MISSING_PROJECT_CONTEXT\",\n    message: \"client.gate requires projectSlug bound on the createClient options\",\n    context: {},\n    recommendation: \"Pass `projectSlug` in createClient options. For multi-project apps, construct one client per project context.\",\n  });\n}\n","/**\n * Pillar composition: `@k9o/core` ↔ `@k9o/extensions`.\n *\n * Re-exports the `k9o.extension(slug)` factory from `@k9o/extensions`.\n *\n * `@k9o/extensions` exports a `k9o` namespace with `extension(slug)`\n * factory returning typed bindings for Trailblazer/Anchor/Keystone\n * class extensions (baked in at SDK publish time). Circuit-class\n * (Long Tail) extensions use the install-time `k9o codegen` tool\n * path (a) OR raw HTTP / vendor-SDK fallback per path (b).\n *\n * The bridge re-exports the factory directly — it is config-free\n * (extension stubs do not require HTTP routing yet). Once per-method dispatch\n * ships, the bridge will thread baseUrl + auth into the extension runtime;\n * until then the re-export is a thin pass-through.\n */\n\nimport { k9o as extensionsNamespace, type ExtensionSlug, type Extension } from \"@k9o/extensions\";\n\nexport { extensionsNamespace, type ExtensionSlug, type Extension };\n\n/**\n * Build the composed `client.extensions` namespace. Currently a thin\n * re-export of the `@k9o/extensions` `k9o.extension(slug)` factory.\n * Config-free for now; it will use the client HTTP config once runtime\n * dispatch ships.\n */\nexport function makeExtensionsBridge() {\n  return {\n    /** Resolve a typed extension instance by slug. See `@k9o/extensions` for the factory contract. */\n    extension: extensionsNamespace.extension,\n  };\n}\n","/**\n * `@k9o/core` — Kilimanjaro platform SDK entry point.\n *\n * Customer-facing surface. The `createClient(options)`\n * factory returns a `K9oClient` instance with namespaces:\n *\n *   - `client.from(collection)`  — data-plane DSL\n *   - `client.projects`          — project lifecycle\n *   - `client.gate`, `client.extensions`, `client.migrations`, `client.functions`, `client.policies`,\n *     `client.audit`, `client.orgs` and the other namespaces on the client type\n *\n * `@k9o/core` composes `@k9o/gate` and `@k9o/extensions` and adds client construction and the data-plane surface.\n * The SDK shape stays stable whether pillars are imported directly or\n * through `@k9o/core` — only the package boundary moves.\n *\n * Every async method throws `KError` on non-2xx\n * gateway responses, transport failures, or SDK-side validation errors.\n * Caller code narrows on `error.code` per the closed taxonomy.\n *\n * Canonical usage:\n *\n * ```typescript\n * import { createClient, KError } from \"@k9o/core\";\n *\n * // `orgSlug` selects your organization's host (https://acme.api.k9o.io); do not also pass `baseUrl`.\n * const client = createClient({\n *   apiKey: process.env.K9O_API_KEY,\n *   orgSlug: \"acme\",\n *   projectSlug: \"member-portal\",\n * });\n *\n * try {\n *   const { data, meta } = await client.from(\"posts\").select().limit(10);\n *   console.log(data, meta.cursor.next);\n * } catch (e) {\n *   if (e instanceof KError && e.code === \"K9O_TIER_CAP_HIT\") {\n *     console.warn(e.message, e.recommendation);\n *   }\n *   throw e;\n * }\n * ```\n */\n\nimport { resolveBaseUrl } from \"./url-grammar.ts\";\nimport type { HttpClientConfig } from \"./http.ts\";\nimport { makeFromFactory } from \"./data/from.ts\";\nimport { makeProjectsNamespace } from \"./projects.ts\";\nimport { makeStorageNamespace } from \"./storage-locations.ts\";\nexport type {\n  StorageBucket, CreateBucketOptions, UpdateBucketOptions, StorageObject, UploadOptions, SignedUrlOptions,\n  SignedUrl, RemovedObject, DeletedBucket,\n} from \"./storage-buckets.ts\";\nimport { makeMetadataNamespace } from \"./metadata.ts\";\nimport { makeMigrationsNamespace } from \"./migrations.ts\";\nimport { makeFunctionsNamespace } from \"./functions.ts\";\nimport { makePoliciesNamespace } from \"./policies.ts\";\nimport { makeAuditNamespace } from \"./audit.ts\";\nimport { makeOrgsNamespace } from \"./orgs.ts\";\nimport { makeOrgNamespace } from \"./org.ts\";\nimport { makeMeNamespace } from \"./me.ts\";\nimport { makeStudioNamespace } from \"./studio/index.ts\";\nimport { makeComputeNamespace } from \"./compute/llms.ts\";\nimport { makeAiNamespace } from \"./ai.ts\";\nimport { makeRealtimeNamespace } from \"./realtime.ts\";\nimport { makeGateBridge, gateNotAvailable } from \"./gate-bridge.ts\";\nimport { makeExtensionsBridge } from \"./extensions-bridge.ts\";\nimport type { GateClient } from \"@k9o/gate\";\nimport { createKiboClient, type KiboClient } from \"@k9o/kibo\";\nimport type { CreateClientOptions } from \"./types.ts\";\n\nexport { KError, kerrorFromWire, type KErrorWire } from \"./kerror.ts\";\nexport {\n  type Envelope,\n  type MetaCursor,\n  type MetaSubscription,\n  type MetaIdempotency,\n  type MetaWarning,\n  type MetaCost,\n  type MetaTiming,\n  type MetaContext,\n  type PaginatedEnvelope,\n} from \"./envelope.ts\";\nexport {\n  validateBaseUrl,\n  resolveBaseUrl,\n  validateSlug,\n  projectPath,\n  orgPath,\n  platformPath,\n} from \"./url-grammar.ts\";\nexport type {\n  CreateClientOptions,\n  RetryConfig,\n  FilterOp,\n} from \"./types.ts\";\nexport type { Project, CreateProjectInput, UpdateProjectInput } from \"./projects.ts\";\nexport {\n  BYOS_CRED_REF_PREFIX,\n  BYOS_CRED_FORMAT_VERSION,\n  BYOS_CRED_VAULT_NAME_PREFIX,\n  BYOS_PROVIDER_SCHEME,\n  encodeByosCredential,\n  byosCredentialRef,\n  byosCredVaultName,\n  type ByosCredProvider,\n  type ByosCredInput,\n} from \"./byos.ts\";\nexport type {\n  StorageLocation, StorageLocationProvider, StorageLocationCustodyMode, StorageLocationProviderParams,\n  CreateStorageLocationInput, UpdateStorageLocationInput, RetiredStorageLocation, StorageLocationTestResult,\n} from \"./storage-locations.ts\";\nexport {\n  METADATA_OPERATORS,\n  type MetadataSlice, type MetadataOperator, type MetadataSurface,\n  type MetadataWhereClause, type MetadataQueryRecord, type MetadataQueryResult,\n  type MetadataQueryBuilder,\n} from \"./metadata.ts\";\nexport type {\n  Migration, AppliedMigration, PendingMigration,\n  Operation, ColumnSpec, IndexSpec, ColumnReferences,\n  MigrationPolicy, CollectionPolicy, StorageBucketPolicy, RelationshipSpec, ActionRule,\n} from \"./migrations.ts\";\nexport type { FunctionRecord, DeployFunctionInput } from \"./functions.ts\";\nexport type { PolicyBundle, CreatePolicyInput, UpdatePolicyInput, ValidatePolicyResult } from \"./policies.ts\";\nexport type { AuditEvent, AuditQueryOpts } from \"./audit.ts\";\nexport type { Org } from \"./orgs.ts\";\nexport type {\n  OrgMember,\n  OrgGroup,\n  OrgRoleGrant,\n  OrgAuditEvent,\n  SmtpConfig,\n  SmtpTestEmailInput,\n  SmtpTestEmailResult,\n  OrgIdpProvider,\n  CreateOrgIdpInput,\n} from \"./org.ts\";\nexport type {\n  MyProfile,\n  MySession,\n  MyApiToken,\n  MyNotification,\n} from \"./me.ts\";\nexport type { ExtensionSlug, Extension } from \"./extensions-bridge.ts\";\nexport type { GateClient } from \"@k9o/gate\";\nexport type {\n  KiboClient, KmsProvider, StoreZkDekInput, ZkDekHandle, ZkDekRecord,\n  SecretVisibility, CreateSecretInput, SecretSummary,\n  ListSecretsInput, ListSecretsResult, AttestationTier, RevealChallenge, RevealSecretResult,\n  UpdateSecretInput, UpdateSecretResult, RotateSecretResult, MoveSecretResult,\n} from \"@k9o/kibo\";\n\n// Studio surfaces (workflows + dashboards)\nexport {\n  WORKFLOW_ERROR_CODES,\n  type Workflow,\n  type WorkflowRun,\n  type WorkflowRunStep,\n  type WorkflowAction,\n  type WorkflowStatus,\n  type WorkflowRunStatus,\n  type WorkflowTriggerType,\n  type WorkflowActionType,\n  type CreateWorkflowInput,\n  type UpdateWorkflowInput,\n  type WorkflowListFilters,\n  type WorkflowRunListFilters,\n} from \"./studio/workflows.ts\";\nexport {\n  DASHBOARD_ERROR_CODES,\n  type Dashboard,\n  type Widget,\n  type WidgetType,\n  type WidgetDataSourceMode,\n  type DashboardStatus,\n  type CreateDashboardInput,\n  type UpdateDashboardInput,\n  type DashboardListFilters,\n} from \"./studio/dashboards.ts\";\n\n// Compute LLMs\nexport {\n  LLM_ERROR_CODES,\n  type LLMModelId,\n  type LLMModel,\n  type LLMModality,\n  type LLMProviderClass,\n  type LLMInvokeParams,\n  type LLMInvokeInput,\n  type LLMResponse,\n  type LLMStreamChunk,\n} from \"./compute/llms.ts\";\n\nexport type { EmbedInput, EmbedResult, EmbeddingModelId } from \"./ai.ts\";\n\nexport { assertProviderRegion, isProviderRegion, type ProviderRegionProvider } from \"./provider-region.ts\";\n\n// Realtime subscriptions\nexport {\n  realtimeTopic,\n  type RealtimeTopic,\n  type RealtimeTopicFamily,\n  type RealtimeFilter,\n  type RealtimeEvent,\n  type RealtimeSubscription,\n  type RealtimeTransportKind,\n  type SubscribeOptions,\n  type ReplayInput,\n} from \"./realtime.ts\";\n\n/**\n * The client returned by `createClient`. Namespaces hang off the\n * instance — composed from per-resource factories that share the\n * bound HTTP config.\n */\nexport type K9oClient = {\n  /** Data-plane DSL — `client.from(collection).select()` etc. */\n  from: ReturnType<typeof makeFromFactory>;\n  /** Project lifecycle — `client.projects.list()` etc. */\n  projects: ReturnType<typeof makeProjectsNamespace>;\n  /** Storage locations — `client.storage.locations.create({..., credentialRef})` etc. Independent of\n   *  `client.kibo.vault.secrets` (credential pre-create): this namespace only registers a caller-supplied\n   *  `credentialRef` string, never creates or resolves one. */\n  storage: ReturnType<typeof makeStorageNamespace>;\n  /** Cross-surface metadata query — `client.metadata.from(...).where(...).execute()`. Client-side\n   *  only until the gateway's Inc-2 route lands; see `metadata.ts` for status. */\n  metadata: ReturnType<typeof makeMetadataNamespace>;\n  /** Migration lifecycle — `client.migrations.apply()` etc. */\n  migrations: ReturnType<typeof makeMigrationsNamespace>;\n  /** Function deploy + invoke — `client.functions.deploy()` etc. */\n  functions: ReturnType<typeof makeFunctionsNamespace>;\n  /** Policy bundle lifecycle — `client.policies.publish()` etc. */\n  policies: ReturnType<typeof makePoliciesNamespace>;\n  /** Audit log queries — `client.audit.query()` etc. */\n  audit: ReturnType<typeof makeAuditNamespace>;\n  /** Org lifecycle — `client.orgs.list()` etc. (collection-style across accessible orgs) */\n  orgs: ReturnType<typeof makeOrgsNamespace>;\n  /** Org-bound namespace — `client.org.members`, `client.org.groups`, `client.org.smtp`, `client.org.auditLog`, `client.org.gate`. */\n  org: ReturnType<typeof makeOrgNamespace>;\n  /** Operator-self namespace — `client.me.profile`, `client.me.sessions`, etc. Cross-org; no tenant context required. */\n  me: ReturnType<typeof makeMeNamespace>;\n  /** Studio surfaces — `client.studio.workflows.*` + `client.studio.dashboards.*`. */\n  studio: ReturnType<typeof makeStudioNamespace>;\n  /** Compute surfaces — `client.compute.llms.*`. */\n  compute: ReturnType<typeof makeComputeNamespace>;\n  /** Platform AI primitives — `client.ai.embed({ model?, input })`. */\n  ai: ReturnType<typeof makeAiNamespace>;\n  /** Realtime subscriptions — `client.realtime.subscribe()` / `.replay()`. */\n  realtime: ReturnType<typeof makeRealtimeNamespace>;\n  /** Gate (Identity-Aware Kernel) — composed from `@k9o/gate`. Available when projectSlug is bound on the client. */\n  readonly gate: GateClient;\n  /** Kibo (Zero-Knowledge vault) — composed from `@k9o/kibo`. `client.kibo.vault.zkDeks.*` (F.5); project-scoped methods self-guard the project context. */\n  readonly kibo: KiboClient;\n  /** Extensions consumption — composed from `@k9o/extensions`. `client.extensions.extension(slug)` returns typed extension bindings. */\n  extensions: ReturnType<typeof makeExtensionsBridge>;\n  /** Bound config — exposed for advanced use (custom HTTP per-call). */\n  readonly config: Readonly<HttpClientConfig>;\n};\n\n/**\n * Construct a `K9oClient` bound to the supplied gateway baseUrl + auth\n * + project context. Validates the baseUrl at construct time\n * — path-bearing baseUrls throw `K9O_INVALID_BASE_URL` synchronously.\n */\nexport function createClient(options: CreateClientOptions): K9oClient {\n  const baseUrl = resolveBaseUrl(options.baseUrl, options.orgSlug);\n  const config: HttpClientConfig = {\n    baseUrl,\n    apiKey: options.apiKey,\n    projectSlug: options.projectSlug,\n    orgSlug: options.orgSlug,\n    fetch: options.fetch,\n    defaultHeaders: options.defaultHeaders,\n    retryConfig: options.retryConfig,\n  };\n  const gateBridge = makeGateBridge(config);\n  return {\n    from: makeFromFactory(config),\n    projects: makeProjectsNamespace(config),\n    storage: makeStorageNamespace(config),\n    metadata: makeMetadataNamespace(config),\n    migrations: makeMigrationsNamespace(config),\n    functions: makeFunctionsNamespace(config),\n    policies: makePoliciesNamespace(config),\n    audit: makeAuditNamespace(config),\n    orgs: makeOrgsNamespace(config),\n    org: makeOrgNamespace(config),\n    me: makeMeNamespace(config),\n    studio: makeStudioNamespace(config),\n    compute: makeComputeNamespace(config),\n    ai: makeAiNamespace(config),\n    realtime: makeRealtimeNamespace(config),\n    // gate is a proxy — null when projectSlug isn't bound; surfacing a\n    // helpful K9O_MISSING_PROJECT_CONTEXT instead of a null deref when\n    // the caller reaches for any gate method without project context.\n    get gate() {\n      if (gateBridge === null) return gateNotAvailable();\n      return gateBridge;\n    },\n    extensions: makeExtensionsBridge(),\n    kibo: createKiboClient(config),\n    config: Object.freeze({ ...config }),\n  };\n}\n","/**\n * BYOS (Bring-Your-Own-Store) credential-reference wire format — the client-side counterpart of the\n * gateway's B2 seal-plane gate (mirrors `services/gateway/src/analytics/\n * byos-credential-ref.ts` + `byos-credential-resolver.ts`) plus the 5-provider envelope shapes from the\n * provisioning spec — each provider's long-lived cred is\n * revealed CORE-side via an already-wired scheme that reads one exact field shape.\n *\n * The customer PRE-CREATES their cloud credential as a vault secret under their OWN auth, then binds\n * only a `kibo://byos-creds/<secId>` reference — the gateway never handles the raw long-lived cloud\n * credential at bind time (`byos-cred create`, `packages/cli/src/commands/byos-cred.ts`).\n */\n\nimport { KError } from \"./kerror.ts\";\nimport { assertProviderRegion } from \"./provider-region.ts\";\n\n/** The reference scheme the gateway's `assertByosCredentialRef` accepts at bind time. */\nexport const BYOS_CRED_REF_PREFIX = \"kibo://byos-creds/\";\n\n/**\n * The reserved vault SECRET-NAME namespace `byos-cred create` always stores under (distinct from\n * {@link BYOS_CRED_REF_PREFIX}, the `kibo://` reference scheme formed from the resulting secret id).\n * `SecretRecord` has no class/purpose column — `name` is the only vault-stored,\n * non-caller-asserted field the reveal endpoint's class gate can check authoritatively to tell \"this\n * is a BYOS credential\" and refuse revealing an install-scoped secret through the BYOS reveal path\n * (closing a receipt-bypass). `byos-cred create` enforces this prefix unconditionally —\n * it is not a convention callers opt into.\n */\nexport const BYOS_CRED_VAULT_NAME_PREFIX = \"byos-creds/\";\n\n/** The allowed charset for the caller-given part of a BYOS vault secret name (after stripping\n *  {@link BYOS_CRED_VAULT_NAME_PREFIX} if present) — hygiene, not a security boundary (the seal is\n *  customer-plane-scoped and the reveal resolves by vault-generated secId, never by name), but an\n *  unvalidated name could otherwise land a secret at an odd vault path. */\nconst VAULT_NAME_SEGMENT = /^[a-z0-9._-]+(?:\\/[a-z0-9._-]+)*$/;\n\n/** Prefix a caller-given secret name with {@link BYOS_CRED_VAULT_NAME_PREFIX} if it isn't already\n *  under it. Idempotent so re-running with an already-prefixed name doesn't double-nest.\n *  Two independent checks, not one: a literal `..` substring is rejected\n *  outright (traversal), separately from {@link VAULT_NAME_SEGMENT} restricting the charset to\n *  `[a-z0-9._/-]` (hygiene) — the charset still permits a lone `.`, which is not itself a traversal\n *  token and is not what blocks `..`. */\nexport function byosCredVaultName(name: string): string {\n  const suffix = name.startsWith(BYOS_CRED_VAULT_NAME_PREFIX) ? name.slice(BYOS_CRED_VAULT_NAME_PREFIX.length) : name;\n  if (suffix.length === 0 || suffix.includes(\"..\") || !VAULT_NAME_SEGMENT.test(suffix)) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"a BYOS credential name must be non-empty, lowercase alphanumeric/._- per path segment, and must not contain '..'\",\n      context: { field: \"name\" },\n      recommendation: \"Use a name like 's3-prod' or 'team/s3-prod' — no '..', no uppercase, no other punctuation.\",\n    });\n  }\n  return `${BYOS_CRED_VAULT_NAME_PREFIX}${suffix}`;\n}\n\n/** The sealed BYOS credential format version (pin `v`, fail-closed on\n *  an unrecognised version so a future cred shape never silently mis-parses as v1). */\nexport const BYOS_CRED_FORMAT_VERSION = 1;\n\n/** The CORE-mintable providers — each maps to exactly one wired reveal scheme.\n *  `azure_blob` has no envelope shape yet (not in the provisioning spec). */\nexport type ByosCredProvider = \"s3\" | \"s3_compatible\" | \"minio\" | \"gcs\" | \"b2\" | \"r2\";\n\n/** provider → WIRED reveal scheme — informational; not itself sent on the wire (the\n *  scheme name IS part of each envelope below). */\nexport const BYOS_PROVIDER_SCHEME: Record<ByosCredProvider, string> = {\n  s3: \"aws_sigv4\",\n  s3_compatible: \"aws_sigv4\",\n  minio: \"aws_sigv4\",\n  gcs: \"gcp_workload_identity\",\n  b2: \"http_basic\",\n  r2: \"bearer\",\n};\n\ntype SigV4Input = {\n  provider: \"s3\" | \"s3_compatible\" | \"minio\";\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** The provider's STS-signing region the CORE mint signs its STS request against (`us-east-1`), NOT a platform region. */\n  providerRegion: string;\n  /** Present only to be rejected — a sealed cred must be long-lived. */\n  sessionToken?: string | undefined;\n};\n\ntype GcsInput = {\n  provider: \"gcs\";\n  /** The service account's PKCS8 private key, PEM-encoded. */\n  privateKeyPem: string;\n  /** The service account's email — the mint's `clientId`. */\n  clientId: string;\n};\n\ntype B2Input = {\n  provider: \"b2\";\n  /** The B2 master key's `keyId` — sealed as `username` (RFC 7617; must not contain `:`). */\n  keyId: string;\n  /** The B2 master key's `appKey` — sealed as `password`. */\n  appKey: string;\n};\n\ntype R2Input = {\n  provider: \"r2\";\n  /** The Cloudflare API token — sealed as `token`. */\n  apiToken: string;\n};\n\n/** Discriminated input to {@link encodeByosCredential} — one shape per CORE-mintable provider. */\nexport type ByosCredInput = SigV4Input | GcsInput | B2Input | R2Input;\n\nfunction rejectTempCred(sessionToken: string | undefined): void {\n  if (typeof sessionToken === \"string\" && sessionToken.length > 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message:\n        \"cannot seal a temporary BYOS credential (a sessionToken expires and would invalidate the credentialRef once sealed); supply a long-lived access key\",\n      context: { field: \"sessionToken\" },\n      recommendation: \"Create a bucket-scoped, long-lived IAM access key for this credential instead of a temporary/STS one.\",\n    });\n  }\n}\n\n/**\n * Encode a customer cloud credential to the exact versioned JSON string the vault secret's `value`\n * must carry, per provider:\n *\n *   - s3 / s3_compatible / minio: `{v:1, scheme:\"aws_sigv4\", service:\"sts\", providerRegion, accessKeyId, secretAccessKey}`\n *     🔴 `service` MUST be `\"sts\"` — the long-lived cred signs ONLY the STS mint; the CORE\n *     mint fail-closes on `service !== \"sts\"`. Not caller-configurable.\n *   - gcs: `{v:1, scheme:\"gcp_workload_identity\", privateKeyPem, clientId}`\n *   - b2: `{v:1, scheme:\"http_basic\", username, password}` — 🔴 the B2 master's `keyId` seals as\n *     `username`, `appKey` as `password` (RFC 7617 field names, not B2's native ones); throws if\n *     `keyId` contains `:` (RFC 7617 forbids it in `username`).\n *   - r2: `{v:1, scheme:\"bearer\", token}`\n *\n * 🔴 Rejects a temporary/session credential on the `aws_sigv4` path —\n * a `sessionToken` expires and would silently invalidate the `credentialRef` once sealed, so this\n * refuses to encode one rather than deferring to the gateway's own reveal-time rejection. The other\n * three schemes have no analogous temporary-credential field in this envelope shape.\n */\nexport function encodeByosCredential(input: ByosCredInput): string {\n  switch (input.provider) {\n    case \"s3\":\n    case \"s3_compatible\":\n    case \"minio\": {\n      rejectTempCred(input.sessionToken);\n      // Sealed into the envelope and later put into hostnames by the mint: refuse a malformed one before it is sealed.\n      assertProviderRegion(input.providerRegion, input.provider);\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"aws_sigv4\",\n        service: \"sts\",\n        providerRegion: input.providerRegion,\n        accessKeyId: input.accessKeyId,\n        secretAccessKey: input.secretAccessKey,\n      });\n    }\n    case \"gcs\":\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"gcp_workload_identity\",\n        privateKeyPem: input.privateKeyPem,\n        clientId: input.clientId,\n      });\n    case \"b2\": {\n      if (input.keyId.includes(\":\")) {\n        throw new KError({\n          code: \"K9O_INVALID_FIELD_VALUE\",\n          message: \"a B2 master keyId sealed as the http_basic username must not contain ':' (RFC 7617)\",\n          context: { field: \"keyId\" },\n          recommendation: null,\n        });\n      }\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"http_basic\",\n        username: input.keyId,\n        password: input.appKey,\n      });\n    }\n    case \"r2\":\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"bearer\",\n        token: input.apiToken,\n      });\n  }\n}\n\n/** Form the `kibo://byos-creds/<secId>` reference from a vault secret id — the inverse of the\n *  gateway's `byosCredentialSecId`. */\nexport function byosCredentialRef(secId: string): string {\n  return `${BYOS_CRED_REF_PREFIX}${secId}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgDA,IAAM,eAAN,MAAmB;AAAA,EACP,UAAoB,CAAC;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAG,QAAgB,OAAwC;AACzD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAwC;AAC1D,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA8B;AAC/C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAA8B;AAChD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA8B;AAC/C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAA8B;AAChD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,QAA8C;AAC/D,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,OAAO,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,QAA8C;AAClE,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,SAAS,OAAO,OAAO,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,KAAK,QAAgB,SAAuB;AAC1C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,QAAQ,OAAO,QAAQ,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,SAAuB;AAC3C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,SAAS,OAAO,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAwC;AACzD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAgB,IAAc,OAAyE;AAC5G,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,CAAC;AACvC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,GAAiB;AACrB,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,QAAsB;AAC3B,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAA4C;AAChD,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOU,UAAuD;AAC/D,UAAM,IAAiD,CAAC;AACxD,eAAW,KAAK,KAAK,SAAS;AAC5B,YAAM,MAAM,MAAM,QAAQ,EAAE,KAAK,IAC7B,IAAK,EAAE,MAAyC,KAAK,GAAG,CAAC,MACzD,OAAO,EAAE,KAAK;AAKlB,QAAE,EAAE,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG;AAAA,IAC9B;AACA,QAAI,KAAK,aAAa,OAAW,GAAE,OAAO,IAAI,KAAK;AACnD,QAAI,KAAK,cAAc,OAAW,GAAE,QAAQ,IAAI,KAAK;AACrD,QAAI,KAAK,cAAc,OAAW,GAAE,OAAO,IAAI,KAAK;AACpD,WAAO;AAAA,EACT;AACF;AAMA,IAAM,cAAN,MAAkB;AAAA,EAChB,YACmB,QACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,SAAwC;AACtC,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,UAAU;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAoB,QAA0C;AAClE,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,eAAe,KAAK,QAAQ,KAAK,UAAU;AAAA,MACjD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAoB,OAAqC;AACvD,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,YAAY,KAAK;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAwC;AACtC,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,UAAU;AAAA,EAC1D;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAgE;AAAA,EAC7F,YACmB,QACA,YACjB;AACA,UAAM;AAHW;AACA;AAAA,EAGnB;AAAA,EAJmB;AAAA,EACA;AAAA,EAKX,OAA4C;AAClD,WAAO,QAA0B,KAAK,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,MAAM,eAAe,KAAK,QAAQ,KAAK,UAAU;AAAA,MACjD,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAiD;AAAA,EAC9E,YACmB,QACA,YACA,OACjB;AACA,UAAM;AAJW;AACA;AACA;AAAA,EAGnB;AAAA,EALmB;AAAA,EACA;AAAA,EACA;AAAA,EAKX,OAA6B;AACnC,UAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,IAAI;AAC5E,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,OAAO;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,SAAS,EAAE,YAAY,KAAK,WAAW;AAAA,QACvC,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AACA,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,GAAG,eAAe,KAAK,QAAQ,KAAK,UAAU,CAAC,IAAI,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC;AAAA,MACnG,MAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAiD;AAAA,EAC9E,YACmB,QACA,YACjB;AACA,UAAM;AAHW;AACA;AAAA,EAGnB;AAAA,EAJmB;AAAA,EACA;AAAA,EAKX,OAA6B;AACnC,UAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,IAAI;AAC5E,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,OAAO;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,SAAS,EAAE,YAAY,KAAK,WAAW;AAAA,QACvC,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AACA,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,GAAG,eAAe,KAAK,QAAQ,KAAK,UAAU,CAAC,IAAI,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC;AAAA,IACrG,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAOA,SAAS,eAAe,QAA0B,YAA4B;AAC5E,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,WAAW;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,eAAa,OAAO,aAAa,SAAS;AAE1C,MAAI,CAAC,0BAA0B,KAAK,UAAU,GAAG;AAC/C,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,oBAAoB,UAAU;AAAA,MACvC,SAAS,EAAE,WAAW;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,YAAY,OAAO,aAAa,QAAQ,UAAU,EAAE;AAC7D;AAMO,SAAS,gBAAgB,QAA0B;AACxD,SAAO,SAAS,KAAK,YAAiC;AACpD,WAAO,IAAI,YAAY,QAAQ,UAAU;AAAA,EAC3C;AACF;;;AC/RO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,OAAkD;AACtD,aAAO,QAAgC,QAAQ;AAAA,QAC7C,QAAQ;AAAA,QACR,MAAM,QAAQ,UAAU;AAAA,MAC1B,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,OAAuD;AAClE,mBAAa,MAAM,MAAM,SAAS;AAClC,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,QAAQ,UAAU;AAAA,QACxB,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,IAAI,MAA0C;AAClD,mBAAa,MAAM,SAAS;AAC5B,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,SAAS;AAAA,MACnC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,MAAc,OAAuD;AAChF,mBAAa,MAAM,SAAS;AAC5B,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,SAAS;AAAA,QACjC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACpBA,IAAM,iBAAiB;AAEvB,SAAS,mBAAmB,QAAkC;AAC5D,MAAI,OAAO,gBAAgB,UAAa,OAAO,YAAY,WAAW,GAAG;AACvE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAChB;AAEA,IAAM,cAAc,CAAC,QAA0B,SAAS,OACtD,YAAY,mBAAmB,MAAM,GAAG,kBAAkB,MAAM,EAAE;AAEpE,IAAM,aAAa,CAAC,QAA0B,MAAc,SAAS,OAAe;AAClF,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,UAAU,QAAQ,QAAQ;AAAA,MAC5C,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAIA,MAAI,SAAS,OAAO,SAAS,MAAM;AACjC,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,UAAU,QAAQ,cAAc;AAAA,MAClD,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,YAAY,QAAQ,IAAI,mBAAmB,IAAI,CAAC,GAAG,MAAM,EAAE;AACpE;AAEA,SAAS,kBAAkB,MAAoB;AAC7C,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,QAAQ,QAAQ,QAAQ;AAAA,MAC1C,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,OAAO,cAAc,YAAY,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,KAAK,YAAY,gBAAgB;AAChH,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,0DAA0D,cAAc;AAAA,MACjF,SAAS,EAAE,OAAO,aAAa,QAAQ,eAAe;AAAA,MACtD,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,OAAO,MAAgD,aAA4B;AAC1F,QAAM,OAAO,gBAAgB,SAAY,EAAE,MAAM,YAAY,IAAI,CAAC;AAClE,MAAI,gBAAgB,KAAM,QAAO,gBAAgB,UAAa,KAAK,SAAS,cAAc,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,IAAI;AACnH,MAAI,OAAO,SAAS,SAAU,QAAO,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI;AAC1D,SAAO,IAAI,KAAK,CAAC,IAA8B,GAAG,IAAI;AACxD;AAGO,SAAS,iBAAiB,QAA0B,QAAgB;AACzE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,OAAO,MAAc,MAAgD,UAAyB,CAAC,GAAqC;AACxI,wBAAkB,IAAI;AACtB,YAAM,OAAO,IAAI,SAAS;AAC1B,WAAK,OAAO,QAAQ,OAAO,MAAM,QAAQ,WAAW,GAAG,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,MAAM;AACtF,WAAK,OAAO,QAAQ,IAAI;AACxB,UAAI,QAAQ,gBAAgB,OAAW,MAAK,OAAO,eAAe,QAAQ,WAAW;AACrF,WAAK,OAAO,UAAU,QAAQ,WAAW,OAAO,SAAS,OAAO;AAChE,UAAI,QAAQ,aAAa,OAAW,MAAK,OAAO,YAAY,KAAK,UAAU,QAAQ,QAAQ,CAAC;AAC5F,aAAO,QAAuB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,WAAW,QAAQ,QAAQ,UAAU,GAAG,MAAM,KAAK,CAAC;AAAA,IACpH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,gBAAgB,MAAc,SAAyD;AAC3F,wBAAkB,IAAI;AACtB,uBAAiB,SAAS,SAAS;AACnC,aAAO,QAAmB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,QAAQ,eAAe;AAAA,QAChD,MAAM,EAAE,MAAM,WAAW,QAAQ,WAAW,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC,EAAG;AAAA,MACxH,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,UAA+B,CAAC,GAAoD;AAC7F,aAAO,QAAsC,QAAQ;AAAA,QACnD,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,QAAQ,UAAU;AAAA,QAC3C,GAAI,QAAQ,WAAW,SAAY,EAAE,OAAO,EAAE,QAAQ,QAAQ,OAAO,EAAE,IAAI,CAAC;AAAA,MAC9E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,MAAgD;AAC3D,wBAAkB,IAAI;AACtB,aAAO,QAAuB,QAAQ,EAAE,QAAQ,UAAU,MAAM,WAAW,QAAQ,QAAQ,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC3H;AAAA,EACF;AACF;AAGO,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,MAAM,cAA+D;AACnE,aAAO,QAAsC,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,EAAE,CAAC;AAAA,IACnG;AAAA;AAAA,IAGA,MAAM,UAAU,MAAgD;AAC9D,aAAO,QAAuB,QAAQ,EAAE,QAAQ,OAAO,MAAM,WAAW,QAAQ,IAAI,EAAE,CAAC;AAAA,IACzF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,aAAa,MAAc,UAA+B,CAAC,GAAqC;AACpG,aAAO,QAAuB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;AAAA,IACjH;AAAA;AAAA,IAGA,MAAM,aAAa,MAAc,SAAgE;AAC/F,aAAO,QAAuB,QAAQ,EAAE,QAAQ,SAAS,MAAM,WAAW,QAAQ,IAAI,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1G;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,aAAa,MAAc,UAA+B,CAAC,GAAqC;AACpG,aAAO,QAAuB,QAAQ;AAAA,QACpC,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,IAAI;AAAA,QAC7B,GAAI,QAAQ,UAAU,OAAO,EAAE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,KAAK,QAAgB;AACnB,aAAO,iBAAiB,QAAQ,MAAM;AAAA,IACxC;AAAA,EACF;AACF;;;ACnOA,IAAM,UAAU;AAChB,IAAM,UAAkE;AAAA,EACtE,IAAI,CAAC,MAAM,8BAA8B,KAAK,CAAC;AAAA,EAC/C,IAAI,CAAC,MAAM,0BAA0B,KAAK,CAAC;AAAA,EAC3C,IAAI,CAAC,MAAM,MAAM;AAAA,EACjB,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC1B,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EACjC,eAAe,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,CAAC;AAC9B;AAGO,SAAS,iBAAiB,OAAgB,UAA4C;AAC3F,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,SAAO,aAAa,SAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,QAAQ,EAAE,KAAK;AAC/E;AAMO,SAAS,qBAAqB,OAAgB,UAAyC;AAC5F,MAAI,iBAAiB,OAAO,QAAQ,EAAG;AACvC,QAAM,IAAI,OAAO;AAAA,IACf,MAAM;AAAA,IACN,SACE,aAAa,SACT,sFACA,iCAAiC,QAAQ;AAAA,IAC/C,SAAS,EAAE,OAAO,kBAAkB,QAAQ,2BAA2B,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC,EAAG;AAAA,IACvH,gBACE,aAAa,OAAO,uBAAuB;AAAA,EAC/C,CAAC;AACH;;;ACiDA,SAASA,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,gBAAgB,UAAa,OAAO,YAAY,WAAW,GAAG;AACvE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAChB;AAEA,IAAM,gBAAgB,CAAC,QAA0B,SAAS,OACxD,YAAYA,oBAAmB,MAAM,GAAG,oBAAoB,MAAM,EAAE;AAE/D,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,GAAG,qBAAqB,MAAM;AAAA,IAC9B,WAAW;AAAA;AAAA,MAET,MAAM,OAA0D;AAC9D,eAAO,QAAwC,QAAQ,EAAE,QAAQ,OAAO,MAAM,cAAc,MAAM,EAAE,CAAC;AAAA,MACvG;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,OAAO,OAAuE;AAClF,6BAAqB,MAAM,gBAAgB,MAAM,QAAQ;AACzD,eAAO,QAAyB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,GAAG,MAAM,MAAM,CAAC;AAAA,MACtG;AAAA;AAAA,MAGA,MAAM,IAAI,YAAwD;AAChE,eAAO,QAAyB,QAAQ;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,QAClE,CAAC;AAAA,MACH;AAAA;AAAA,MAGA,MAAM,OAAO,YAAoB,OAAuE;AAGtG,YAAI,MAAM,mBAAmB,OAAW,sBAAqB,MAAM,cAAc;AACjF,eAAO,QAAyB,QAAQ;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,UAChE,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,OAAO,YAA+D;AAC1E,eAAO,QAAgC,QAAQ;AAAA,UAC7C,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,QAClE,CAAC;AAAA,MACH;AAAA;AAAA,MAGA,MAAM,KAAK,YAAkE;AAC3E,eAAO,QAAmC,QAAQ;AAAA,UAChD,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,OAAO;AAAA,QACvE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC1JO,IAAM,qBAAqB;AAAA,EAChC;AAAA,EAAM;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAAA,EAAM;AAAA,EAChC;AAAA,EAAY;AAAA,EAAc;AAAA,EAAY;AAAA,EAAM;AAAA,EAC5C;AAAA,EAAO;AAAA,EAAM;AACf;AA2CA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,gBAAgB,UAAa,OAAO,YAAY,WAAW,GAAG;AACvE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,YACP,QACA,UACA,OACA,OACA,aACsB;AACtB,SAAO;AAAA,IACL,MAAM,OAAO,IAAI,OAAO;AACtB,aAAO,YAAY,QAAQ,UAAU,CAAC,GAAG,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,OAAO,WAAW;AAAA,IAC3F;AAAA,IACA,MAAM,GAAG;AACP,aAAO,YAAY,QAAQ,UAAU,OAAO,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,OAAO,GAAG;AACR,aAAO,YAAY,QAAQ,UAAU,OAAO,OAAO,CAAC;AAAA,IACtD;AAAA,IACA,MAAM,UAAU;AACd,aAAO,QAA6B,QAAQ;AAAA,QAC1C,QAAQ;AAAA,QACR,MAAM,YAAYA,oBAAmB,MAAM,GAAG,gBAAgB;AAAA,QAC9D,MAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,UACvC,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA,IAEL,KAAK,SAA6E;AAChF,YAAM,WAAW,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAA0B;AAC/E,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,IAAI,OAAO;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,SAAS,CAAC;AAAA,UACV,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AACA,aAAO,YAAY,QAAQ,UAAU,CAAC,GAAG,QAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AACF;;;AC8CA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,wBAAwB,QAA0B;AAChE,SAAO;AAAA;AAAA,IAEL,MAAM,MAAM,OAAkH;AAC5H,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,kBAAkB;AAAA,QAC1C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAA2D;AAC/D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY;AAAA,MACtC,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,SAAsD;AAC9D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,OAAO,OAAO,CAAC,CAAC,EAAE;AAAA,MAC7E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,MAAM,OAAkH;AAC5H,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,kBAAkB;AAAA,QAC1C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,cAAkE;AACtE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,oBAAoB;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,aAAa,WAAwD;AACzE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,QAAQ;AAAA,MACrF,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,cAAc,WAAmB,OAAuE;AAC5G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,SAAS;AAAA,QACpF,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,cAAc,WAA4D;AAC9E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,EAAE;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACzNA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO;AAAA;AAAA,IAEL,MAAM,OAAO,OAA+D;AAC1E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,MAAiI;AAC1I,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,MAAiD;AACzD,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,MAA8E;AACzF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,MAAM,OAA8C,MAAc,SAA+C;AAC/G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,SAAS;AAAA,QACtE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC7DA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA,IAEL,MAAM,UAAkD;AACtD,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,QAAQ;AAAA,MAClC,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,MAAiK;AAC1K,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,UAAU;AAAA,QAClC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,OAA2D;AACtE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,UAAU;AAAA,QAClC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,SAAS,OAAoF;AACjG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,mBAAmB;AAAA,QAC3C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,UAAmD;AAC3D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACpE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,UAAkB,OAA2D;AACxF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,QAClE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,UAA2D;AACtE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACpE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,QAAQ,UAAmD;AAC/D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,UAAU;AAAA,MAC5E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AChFA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,mBAAmB,QAA0B;AAC3D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASL,MAAM,MAAM,MAAqE;AAC/E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,KAAK,MAAgG;AACzG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,YAAM,UAAU,MAAM,gBAAgB;AACtC,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,GAAM,EAAE,YAAY;AAClE,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO,EAAE,OAAO,OAAO,MAAM,SAAS,IAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC7DO,SAAS,kBAAkB,QAA0B;AAC1D,SAAO;AAAA;AAAA,IAEL,MAAM,OAA8C;AAClD,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,MAAM;AAAA,MACtB,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,SAAyC;AACjD,mBAAa,SAAS,KAAK;AAC3B,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,QAAQ,mBAAmB,OAAO,CAAC,EAAE;AAAA,MACrD,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,QAAQ,OAAuC;AACnD,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,QAAQ,mBAAmB,KAAK,CAAC,UAAU;AAAA,MAC3D,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,UAAkC;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,KAAK;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACwDA,SAAS,qBAAqB,QAA0B;AACtD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAA2J;AACpK,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,SAAS,GAAG,OAAO,KAAK,CAAC;AAAA,IACjF;AAAA;AAAA,IAGA,MAAM,OAAO,OAAiF;AAC5F,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,SAAS,GAAG,MAAM,MAAM,CAAC;AAAA,IAClF;AAAA;AAAA,IAGA,MAAM,IAAI,QAA8C;AACtD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,WAAW,mBAAmB,MAAM,CAAC,EAAE,EAAE,CAAC;AAAA,IAClG;AAAA;AAAA,IAGA,MAAM,OAAO,QAAyD;AACpE,aAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,WAAW,mBAAmB,MAAM,CAAC,EAAE,EAAE,CAAC;AAAA,IACrG;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA0B;AACrD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAAwF;AACjG,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,QAAQ,GAAG,OAAO,KAAK,CAAC;AAAA,IAChF;AAAA;AAAA,IAGA,MAAM,OAAO,OAAsD;AACjE,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,GAAG,MAAM,MAAM,CAAC;AAAA,IACjF;AAAA;AAAA,IAGA,MAAM,IAAI,SAA8C;AACtD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,UAAU,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,IAClG;AAAA;AAAA,IAGA,MAAM,OAAO,SAA0D;AACrE,aAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,IACrG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAA0B;AAC1D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAM,MAGwC;AAClD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,WAAW,GAAG,OAAO,KAAK,CAAC;AAAA,IACnF;AAAA;AAAA,IAGA,MAAM,KAAK,MAAmG;AAC5G,YAAM,UAAU,MAAM,gBAAgB;AACtC,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,GAAM,EAAE,YAAY;AAClE,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,WAAW;AAAA,QACzB,OAAO,EAAE,OAAO,OAAO,MAAM,SAAS,IAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,QAA0B;AACtD,SAAO;AAAA,IACL,OAAO;AAAA;AAAA,MAEL,MAAM,KAAK,MAAuK;AAChL,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,iBAAiB,GAAG,OAAO,KAAK,CAAC;AAAA,MACzF;AAAA;AAAA,MAGA,MAAM,MAAM,OAAwF;AAClG,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,iBAAiB,GAAG,MAAM,MAAM,CAAC;AAAA,MAC1F;AAAA;AAAA,MAGA,MAAM,IAAI,SAAkD;AAC1D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,mBAAmB,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,MAC3G;AAAA;AAAA,MAGA,MAAM,OAAO,SAAkD;AAC7D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,mBAAmB,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,MAC9G;AAAA,IACF;AAAA,IAEA,cAAc;AAAA;AAAA,MAEZ,MAAM,OAAyD;AAC7D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,eAAe,EAAE,CAAC;AAAA,MAC1E;AAAA;AAAA,MAGA,MAAM,OAAO,OAA6D;AACxE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,eAAe,GAAG,MAAM,MAAM,CAAC;AAAA,MACxF;AAAA;AAAA,MAGA,MAAM,IAAI,OAAkD;AAC1D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,iBAAiB,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,MACvG;AAAA;AAAA,MAGA,MAAM,UAAU,OAAe,OAAkH;AAC/I,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,iBAAiB,mBAAmB,KAAK,CAAC,EAAE,GAAG,MAAM,MAAM,CAAC;AAAA,MACtH;AAAA;AAAA,MAGA,MAAM,OAAO,OAAwD;AACnE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,iBAAiB,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAA0B;AACnD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAML,MAAM,MAA4C;AAChD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,UAAU,EAAE,CAAC;AAAA,IACrE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,IAAI,SAAgG;AACxG,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,EAAE,YAAY,QAAQ,EAAE,CAAC;AAAA,IACjG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,KAAK,OAAmE;AAC5E,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,qBAAqB,GAAG,MAAM,MAAM,CAAC;AAAA,IAC9F;AAAA;AAAA,IAGA,MAAM,QAAiD;AACrD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,QAA0B;AACzD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAML,MAAM,MAA4C;AAChD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,iBAAiB,EAAE,CAAC;AAAA,IAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,IAAI,OAA+D;AACvE,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,iBAAiB,GAAG,MAAM,MAAM,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,QAA0B;AACzD,SAAO;AAAA;AAAA,IAEL,SAAS,qBAAqB,MAAM;AAAA;AAAA,IAEpC,QAAQ,oBAAoB,MAAM;AAAA;AAAA,IAElC,UAAU,yBAAyB,MAAM;AAAA;AAAA,IAEzC,MAAM,qBAAqB,MAAM;AAAA;AAAA,IAEjC,MAAM,kBAAkB,MAAM;AAAA;AAAA,IAE9B,YAAY,wBAAwB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO1C,MAAM,MAAwG;AAC5G,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,KAAK,EAAE,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;ACtRO,SAAS,gBAAgB,QAA0B;AACxD,SAAO;AAAA,IACL,SAAS;AAAA;AAAA,MAEP,MAAM,MAAoC;AACxC,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,MAC/D;AAAA;AAAA,MAGA,MAAM,OAAO,OAAsE;AACjF,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,IAAI,GAAG,MAAM,MAAM,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,IAEA,UAAU;AAAA;AAAA,MAER,MAAM,OAAoD;AACxD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,aAAa,EAAE,CAAC;AAAA,MACxE;AAAA;AAAA,MAGA,MAAM,OAAO,WAA4D;AACvE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,eAAe,mBAAmB,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,MAC5G;AAAA;AAAA,MAGA,MAAM,YAAoD;AACxD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,aAAa,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,WAAW;AAAA,MACT,MAAM,OAAqD;AACzD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,eAAe,EAAE,CAAC;AAAA,MAC1E;AAAA,MAEA,MAAM,OAAO,OAA4I;AACvJ,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,eAAe,GAAG,MAAM,MAAM,CAAC;AAAA,MACxF;AAAA,MAEA,MAAM,OAAO,SAA0D;AACrE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,iBAAiB,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,MAC5G;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,eAAe;AAAA,MACb,MAAM,KAAK,MAAwJ;AACjK,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,kBAAkB,GAAG,OAAO,KAAK,CAAC;AAAA,MAC1F;AAAA,MAEA,MAAM,SAAS,gBAA2D;AACxE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,oBAAoB,mBAAmB,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,MAC3I;AAAA,MAEA,MAAM,cAAqD;AACzD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,kBAAkB,GAAG,MAAM,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,MACrG;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,UAAU;AAAA,MACR,MAAM,MAAM,MAA6Q;AACvR,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,cAAc,GAAG,OAAO,KAAK,CAAC;AAAA,MACtF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,YAAY;AAAA,MACV,MAAM,QAAQ,OAAuH;AACnI,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,gBAAgB,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,MAC/F;AAAA,MAEA,MAAM,OAAO,OAAwI;AACnJ,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;;;ACAO,IAAM,uBAAuB;AAAA,EAClC,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,2BAA2B;AAC7B;AAEA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,kBAAkB,QAA0B;AACnD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,YAAoB,SAAiF;AAC9G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,OAAO;AAAA,QAC1E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,YAAoB,OAA+C;AAC5E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,SAAS,mBAAmB,KAAK,CAAC,EAAE;AAAA,MACzG,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAAoB,OAA+C;AAC9E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,SAAS,mBAAmB,KAAK,CAAC,SAAS;AAAA,MAChH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,SAA2E;AACpF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC;AAAA,IAChG;AAAA;AAAA,IAGA,MAAM,OAAO,UAA4D;AACvE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC;AAAA,IACjG;AAAA;AAAA,IAGA,MAAM,KAAK,YAAiD;AAC1D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAAoB,SAA2D;AAC1F,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,QACrE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAA6D;AACxE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QAAQ,YAAoB,iBAA0C,CAAC,GAAmC;AAC9G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,OAAO;AAAA,QAC1E,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,kBAAkB,MAAM;AAAA,EAChC;AACF;;;AClKO,IAAM,wBAAwB;AAAA,EACnC,WAAW;AAAA,EACX,gBAAgB;AAClB;AAEA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,wBAAwB,QAA0B;AAChE,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,SAA6E;AACtF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC;AAAA,IACjG;AAAA;AAAA,IAGA,MAAM,OAAO,WAA+D;AAC1E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;AAAA,IACnG;AAAA;AAAA,IAGA,MAAM,KAAK,aAAmD;AAC5D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,MACzE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,aAAqB,SAA6D;AAC7F,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,QACvE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,aAA8D;AACzE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,MACzE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,aAAmD;AAC3D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,MAAM;AAAA,MAC7E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,MAAM,aAAmD;AAC7D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,QAAQ;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACvKO,SAAS,oBAAoB,QAA0B;AAC5D,SAAO;AAAA;AAAA,IAEL,WAAW,uBAAuB,MAAM;AAAA;AAAA,IAExC,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACF;;;ACOA,gBAAuB,eACrB,MAC+B;AAC/B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AAEb,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,gBAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAGhD,UAAI;AACJ,cAAQ,WAAW,qBAAqB,MAAM,OAAO,IAAI;AACvD,cAAM,WAAW,OAAO,MAAM,GAAG,QAAQ;AACzC,iBAAS,OAAO,MAAM,QAAQ,EAAE,QAAQ,aAAa,EAAE;AACvD,cAAM,UAAU,YAAY,QAAQ;AACpC,YAAI,YAAY,KAAM;AACtB,YAAI,YAAY,SAAU;AAC1B,cAAM,cAAiB,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,KAAK,SAAS,GAAG;AACnB,YAAM,UAAU,YAAY,IAAI;AAChC,UAAI,YAAY,QAAQ,YAAY,UAAU;AAC5C,cAAM,cAAiB,OAAO;AAAA,MAChC;AAAA,IACF;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACF;AAEA,SAAS,qBAAqB,QAAwB;AACpD,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,QAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,MAAI,OAAO,GAAI,QAAO;AACtB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO,KAAK,IAAI,IAAI,IAAI;AAC1B;AAGA,SAAS,YAAY,UAAiC;AACpD,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,GAAG,EAAG;AAC1B,QAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,gBAAU,KAAK,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,SAAO,UAAU,KAAK,IAAI;AAC5B;AAEA,SAAS,cAAiB,SAAoB;AAC5C,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACLO,IAAM,kBAAkB;AAAA,EAC7B,sBAAsB;AACxB;AAEA,SAASC,qBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,kBAAkB,QAA0B;AAC1D,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAAiH;AAC1H,YAAM,OAAOA,qBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC;AAAA,IAChG;AAAA;AAAA,IAGA,MAAM,KAAK,SAA2D;AACpE,YAAM,OAAOA,qBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,OAAO,SAA8B,OAAuD;AAChG,YAAM,OAAOA,qBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,SAAS;AAAA,QAC5E,MAAM,EAAE,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;AAAA,MACrD,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,OAAO,aAAa,SAA8B,OAAmE;AACnH,YAAM,OAAOA,qBAAmB,MAAM;AACtC,YAAM,WAAW,MAAM,cAAc,QAAQ;AAAA,QAC3C,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,gBAAgB;AAAA,QACnF,MAAM,EAAE,QAAQ,MAAM,QAAQ,QAAQ,MAAM,OAAO;AAAA,QACnD,QAAQ;AAAA,MACV,CAAC;AAED,aAAO,eAA+B,SAAS,IAAkC;AAAA,IACnF;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,MAAM,kBAAkB,MAAM;AAAA,EAChC;AACF;;;ACrHA,SAASC,qBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,gBAAgB,QAA0B;AACxD,SAAO;AAAA;AAAA,IAEL,MAAM,MAAM,OAAmD;AAC7D,YAAM,OAAOA,qBAAmB,MAAM;AACtC,YAAM,OAAqD;AAAA,QACzD,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,MACxE;AACA,UAAI,MAAM,UAAU,OAAW,MAAK,QAAQ,MAAM;AAClD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,eAAe,GAAG,KAAK,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;;;ACDO,IAAM,gBAAgB;AAAA;AAAA,EAE3B,WAAW,YAAmC;AAC5C,WAAO,eAAe,UAAU;AAAA,EAClC;AAAA;AAAA,EAEA,eAA8B;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA,EAEA,cAAc,SAAgC;AAC5C,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA;AAAA,EAEA,iBAAiB,aAAoC;AACnD,WAAO,6BAA6B,WAAW;AAAA,EACjD;AAAA;AAAA,EAEA,oBAAoB,YAAmC;AACrD,WAAO,+BAA+B,UAAU;AAAA,EAClD;AAAA;AAAA,EAEA,SAAS,aAAoC;AAC3C,WAAO,aAAa,WAAW;AAAA,EACjC;AACF;AAuDA,SAASC,qBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,OAAO;AAChB;AAGA,SAAS,gBAAgB,QAAuD;AAC9E,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAQ,WAAuC,cAAc,WAAY,QAAO;AAEpF,SAAO;AACT;AAGA,SAAS,eAAe,SAAiB,MAAc,OAAuC;AAC5F,QAAM,UAAU,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AAC/D,QAAM,SAAS,QAAQ,QAAQ,SAAS,IAAI;AAC5C,QAAM,KAAK,IAAI,gBAAgB,KAAK,EAAE,SAAS;AAC/C,SAAO,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE;AAC9C;AAGA,gBAAgB,mBACd,QACA,OACA,SACA,QAC8C;AAC9C,QAAM,OAAOA,qBAAmB,MAAM;AACtC,QAAM,QAAgC,EAAE,MAAM;AAC9C,MAAI,QAAQ,OAAQ,OAAM,SAAS,KAAK,UAAU,QAAQ,MAAM;AAChE,MAAI,OAAO,OAAQ,OAAM,eAAe,OAAO;AAC/C,QAAM,MAAM,eAAe,OAAO,SAAS,YAAY,MAAM,oBAAoB,GAAG,KAAK;AACzF,QAAM,KAAM,WAA6D;AACzE,QAAM,SAAS,IAAI,GAAG,GAAG;AAEzB,QAAM,QAA4B,CAAC;AACnC,MAAI,cAAmC;AACvC,MAAI,eAAe;AACnB,MAAI,cAA4B;AAEhC,QAAM,OAAO,MAAM;AACjB,QAAI,aAAa;AACf,kBAAY;AACZ,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,YAAY,CAAC,OAAqB;AACvC,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,GAAG,SAAS,WAAW,GAAG,OAAO,OAAO,GAAG,IAAI,CAAC,CAAqB;AAAA,IACpG,QAAQ;AAAA,IAER;AACA,SAAK;AAAA,EACP;AACA,SAAO,UAAU,MAAM;AACrB,kBAAc,IAAI,MAAM,oCAAoC;AAC5D,SAAK;AAAA,EACP;AACA,SAAO,UAAU,MAAM;AACrB,mBAAe;AACf,SAAK;AAAA,EACP;AACA,UAAQ,QAAQ,iBAAiB,SAAS,MAAM,OAAO,MAAM,CAAC;AAE9D,MAAI;AACF,WAAO,CAAC,OAAO,OAAO;AACpB,UAAI,MAAM,SAAS,GAAG;AACpB,cAAM,MAAM,MAAM;AAClB;AAAA,MACF;AACA,UAAI,cAAc;AAChB,YAAI,YAAa,OAAM;AACvB;AAAA,MACF;AACA,YAAM,IAAI,QAAc,CAAC,YAAY;AACnC,sBAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAGA,gBAAgB,aACd,QACA,OACA,SACA,QAC8C;AAC9C,QAAM,OAAOA,qBAAmB,MAAM;AACtC,QAAM,QAA+D,EAAE,MAAM;AAC7E,MAAI,QAAQ,OAAQ,OAAM,SAAS,KAAK,UAAU,QAAQ,MAAM;AAChE,QAAM,WAAW,MAAM,cAAc,QAAQ;AAAA,IAC3C,QAAQ;AAAA,IACR,MAAM,YAAY,MAAM,oBAAoB;AAAA,IAC5C;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACD,mBAAiB,SAAS,eAAiC,SAAS,IAAkC,GAAG;AACvG,QAAI,OAAO,SAAS,QAAQ,QAAQ,QAAS;AAC7C,UAAM;AAAA,EACR;AACF;AAGA,gBAAgB,cACd,QACA,OACA,SACA,QAC8C;AAC9C,QAAM,OAAOA,qBAAmB,MAAM;AACtC,QAAM,WAAW,QAAQ,kBAAkB;AAC3C,MAAI,SAAS;AACb,SAAO,CAAC,OAAO,SAAS,CAAC,QAAQ,QAAQ,SAAS;AAChD,UAAM,EAAE,KAAK,IAAI,MAAM,QAAyC,QAAQ;AAAA,MACtE,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,iBAAiB;AAAA,MACzC,MAAM,EAAE,OAAO,QAAQ,QAAQ,QAAQ,cAAc,OAAO;AAAA,IAC9D,CAAC;AACD,eAAW,SAAS,QAAQ,CAAC,GAAG;AAC9B,UAAI,OAAO,SAAS,QAAQ,QAAQ,QAAS;AAC7C,eAAS,KAAK,IAAI,QAAQ,MAAM,WAAW,CAAC;AAC5C,YAAM;AAAA,IACR;AACA,QAAI,OAAO,SAAS,QAAQ,QAAQ,QAAS;AAC7C,UAAM,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,QAAQ,CAAC;AAAA,EACpE;AACF;AAEO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAgBL,UAAuB,OAAsB,UAA4B,CAAC,GAA4B;AACpG,MAAAA,qBAAmB,MAAM;AACzB,YAAM,YAAY,gBAAgB,QAAQ,SAAS;AACnD,YAAM,SAAS,EAAE,OAAO,MAAM;AAE9B,YAAM,UAAU,MAAoD;AAClE,gBAAQ,WAAW;AAAA,UACjB,KAAK;AACH,mBAAO,mBAAsB,QAAQ,OAAO,SAAS,MAAM;AAAA,UAC7D,KAAK;AACH,mBAAO,cAAiB,QAAQ,OAAO,SAAS,MAAM;AAAA,UACxD,KAAK;AAAA,UACL;AACE,mBAAO,aAAgB,QAAQ,OAAO,SAAS,MAAM;AAAA,QACzD;AAAA,MACF;AAEA,UAAI,SAA8D;AAClE,aAAO;AAAA,QACL;AAAA,QACA,CAAC,OAAO,aAAa,IAAI;AACvB,mBAAS,QAAQ;AACjB,iBAAO;AAAA,QACT;AAAA,QACA,QAAQ;AACN,iBAAO,QAAQ;AACf,eAAK,QAAQ,OAAO,MAAS;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,OAAoB,OAAwE;AAChG,YAAM,OAAOA,qBAAmB,MAAM;AACtC,UAAI,CAAC,OAAO,UAAU,MAAM,YAAY,KAAK,MAAM,eAAe,GAAG;AACnE,cAAM,IAAI,OAAO;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,SAAS,EAAE,cAAc,MAAM,aAAa;AAAA,UAC5C,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AACA,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,iBAAiB;AAAA,QACzC,MAAM;AAAA,UACJ,OAAO,MAAM;AAAA,UACb,QAAQ,MAAM;AAAA,UACd,cAAc,MAAM;AAAA,UACpB,eAAe,MAAM;AAAA,UACrB,OAAO,MAAM;AAAA,QACf;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACvUA,SAAS,wBAAyC;AAe3C,SAAS,eAAe,QAA6C;AAC1E,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,WAAO;AAAA,EACT;AAGA,SAAO,iBAAiB;AAAA,IACtB,MAAM;AAAA,IACN,SAAS,OAAO;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,GAAI,OAAO,WAAW,SAAY,EAAE,cAAc,OAAO,OAAO,IAAI,CAAC;AAAA,IACrE,GAAI,OAAO,UAAU,SAAY,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC9D,CAAC;AACH;AAOO,SAAS,mBAA0B;AACxC,QAAM,IAAI,OAAO;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,SAAS,CAAC;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AACH;;;AC/CA,SAAS,OAAO,2BAA+D;AAUxE,SAAS,uBAAuB;AACrC,SAAO;AAAA;AAAA,IAEL,WAAW,oBAAoB;AAAA,EACjC;AACF;;;ACmCA,SAAS,wBAAyC;;;ACnD3C,IAAM,uBAAuB;AAW7B,IAAM,8BAA8B;AAM3C,IAAM,qBAAqB;AAQpB,SAAS,kBAAkB,MAAsB;AACtD,QAAM,SAAS,KAAK,WAAW,2BAA2B,IAAI,KAAK,MAAM,4BAA4B,MAAM,IAAI;AAC/G,MAAI,OAAO,WAAW,KAAK,OAAO,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,GAAG;AACpF,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,OAAO;AAAA,MACzB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,GAAG,2BAA2B,GAAG,MAAM;AAChD;AAIO,IAAM,2BAA2B;AAQjC,IAAM,uBAAyD;AAAA,EACpE,IAAI;AAAA,EACJ,eAAe;AAAA,EACf,OAAO;AAAA,EACP,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,IAAI;AACN;AAqCA,SAAS,eAAe,cAAwC;AAC9D,MAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,GAAG;AAC/D,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SACE;AAAA,MACF,SAAS,EAAE,OAAO,eAAe;AAAA,MACjC,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoBO,SAAS,qBAAqB,OAA8B;AACjE,UAAQ,MAAM,UAAU;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,SAAS;AACZ,qBAAe,MAAM,YAAY;AAEjC,2BAAqB,MAAM,gBAAgB,MAAM,QAAQ;AACzD,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,eAAe,MAAM;AAAA,QACrB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH,KAAK,MAAM;AACT,UAAI,MAAM,MAAM,SAAS,GAAG,GAAG;AAC7B,cAAM,IAAI,OAAO;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,SAAS,EAAE,OAAO,QAAQ;AAAA,UAC1B,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AACA,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,OAAO,MAAM;AAAA,MACf,CAAC;AAAA,EACL;AACF;AAIO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,GAAG,oBAAoB,GAAG,KAAK;AACxC;;;ADyEO,SAAS,aAAa,SAAyC;AACpE,QAAM,UAAU,eAAe,QAAQ,SAAS,QAAQ,OAAO;AAC/D,QAAM,SAA2B;AAAA,IAC/B;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,EACvB;AACA,QAAM,aAAa,eAAe,MAAM;AACxC,SAAO;AAAA,IACL,MAAM,gBAAgB,MAAM;AAAA,IAC5B,UAAU,sBAAsB,MAAM;AAAA,IACtC,SAAS,qBAAqB,MAAM;AAAA,IACpC,UAAU,sBAAsB,MAAM;AAAA,IACtC,YAAY,wBAAwB,MAAM;AAAA,IAC1C,WAAW,uBAAuB,MAAM;AAAA,IACxC,UAAU,sBAAsB,MAAM;AAAA,IACtC,OAAO,mBAAmB,MAAM;AAAA,IAChC,MAAM,kBAAkB,MAAM;AAAA,IAC9B,KAAK,iBAAiB,MAAM;AAAA,IAC5B,IAAI,gBAAgB,MAAM;AAAA,IAC1B,QAAQ,oBAAoB,MAAM;AAAA,IAClC,SAAS,qBAAqB,MAAM;AAAA,IACpC,IAAI,gBAAgB,MAAM;AAAA,IAC1B,UAAU,sBAAsB,MAAM;AAAA;AAAA;AAAA;AAAA,IAItC,IAAI,OAAO;AACT,UAAI,eAAe,KAAM,QAAO,iBAAiB;AACjD,aAAO;AAAA,IACT;AAAA,IACA,YAAY,qBAAqB;AAAA,IACjC,MAAM,iBAAiB,MAAM;AAAA,IAC7B,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC;AAAA,EACrC;AACF;","names":["requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug"]}
+{"version":3,"sources":["../src/data/from.ts","../src/projects.ts","../src/storage-buckets.ts","../src/provider-region.ts","../src/storage-locations.ts","../src/migrations.ts","../src/functions.ts","../src/policies.ts","../src/audit.ts","../src/orgs.ts","../src/org.ts","../src/me.ts","../src/studio/workflows.ts","../src/studio/dashboards.ts","../src/studio/index.ts","../src/internal/sse.ts","../src/compute/llms.ts","../src/ai.ts","../src/realtime.ts","../src/gate-bridge.ts","../src/extensions-bridge.ts","../src/index.ts","../src/byos.ts"],"sourcesContent":["/**\n * Data-plane DSL: `client.from(collection).select()` etc.\n *\n * The DSL is a\n * chainable builder that composes a query against a project's user-\n * collection. The chain terminates in a verb (`select`, `insert`,\n * `update`, `delete`) that issues the HTTP request and returns the\n * envelope.\n *\n * Wire mapping:\n *   - `from('posts').select()`                          → GET    /@<projectSlug>/data/posts\n *   - `from('posts').select().eq('id','rec_X')`         → GET    /@<projectSlug>/data/posts?id=eq.rec_X\n *   - `from('posts').insert({ title: '...' })`          → POST   /@<projectSlug>/data/posts\n *   - `from('posts').update({ title: '...' }).eq(...)`  → PATCH  /@<projectSlug>/data/posts/:id\n *   - `from('posts').delete().eq('id','rec_X')`         → DELETE /@<projectSlug>/data/posts/:id\n *\n * Filters compose as AND; multiple chained `.eq()` /\n * `.gt()` / etc. calls all attach to the query string.\n *\n * Pagination + counting: `.limit(n)`, `.cursor(opaque)`,\n * `.count('none' | 'exact' | 'estimated')`. The returned envelope's\n * `meta.cursor.next` is the cursor for the next page.\n *\n * Per KError delivery: every terminal verb throws KError on\n * non-2xx. Caller catches via `instanceof KError` + narrows on `.code`.\n */\n\nimport { projectPath, validateSlug } from \"../url-grammar.ts\";\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { KError } from \"../kerror.ts\";\nimport type { Envelope } from \"../envelope.ts\";\nimport type { FilterOp } from \"../types.ts\";\n\n/**\n * Internal filter representation. Serialised to query parameters at\n * terminal-verb time.\n */\ntype Filter = {\n  column: string;\n  op: FilterOp;\n  value: string | number | boolean | ReadonlyArray<string | number>;\n};\n\n/**\n * Query builder shared across all verbs. The `select`/`insert`/`update`/\n * `delete` factories below extend this via composition so the chainable\n * shape is consistent.\n */\nclass QueryBuilder {\n  protected filters: Filter[] = [];\n  protected limitVal?: number;\n  protected cursorVal?: string;\n  protected countMode?: \"none\" | \"exact\" | \"estimated\";\n\n  /**\n   * Attach an equality filter. Composes with other filters via AND.\n   */\n  eq(column: string, value: string | number | boolean): this {\n    this.filters.push({ column, op: \"eq\", value });\n    return this;\n  }\n\n  neq(column: string, value: string | number | boolean): this {\n    this.filters.push({ column, op: \"neq\", value });\n    return this;\n  }\n\n  gt(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"gt\", value });\n    return this;\n  }\n\n  gte(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"gte\", value });\n    return this;\n  }\n\n  lt(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"lt\", value });\n    return this;\n  }\n\n  lte(column: string, value: string | number): this {\n    this.filters.push({ column, op: \"lte\", value });\n    return this;\n  }\n\n  in(column: string, values: ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op: \"in\", value: values });\n    return this;\n  }\n\n  notIn(column: string, values: ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op: \"notIn\", value: values });\n    return this;\n  }\n\n  like(column: string, pattern: string): this {\n    this.filters.push({ column, op: \"like\", value: pattern });\n    return this;\n  }\n\n  ilike(column: string, pattern: string): this {\n    this.filters.push({ column, op: \"ilike\", value: pattern });\n    return this;\n  }\n\n  is(column: string, value: \"null\" | \"true\" | \"false\"): this {\n    this.filters.push({ column, op: \"is\", value });\n    return this;\n  }\n\n  /**\n   * Attach a `.filter(column, op, value)` for explicit op selection.\n   */\n  filter(column: string, op: FilterOp, value: string | number | boolean | ReadonlyArray<string | number>): this {\n    this.filters.push({ column, op, value });\n    return this;\n  }\n\n  /**\n   * Page-size hint (default per gateway tier; max bounded server-side).\n   */\n  limit(n: number): this {\n    this.limitVal = n;\n    return this;\n  }\n\n  /**\n   * Opaque cursor for next-page fetch — returned in prior response's\n   * `meta.cursor.next`.\n   */\n  cursor(opaque: string): this {\n    this.cursorVal = opaque;\n    return this;\n  }\n\n  /**\n   * Total-count behaviour. `none` (default) skips the\n   * count query (cheapest); `exact` runs `SELECT COUNT(*)` (most\n   * expensive at scale); `estimated` reads from pg_stats (fast +\n   * approximate).\n   */\n  count(mode: \"none\" | \"exact\" | \"estimated\"): this {\n    this.countMode = mode;\n    return this;\n  }\n\n  /**\n   * Serialise filters + pagination + count to query parameters.\n   * Format: per-filter `<column>=<op>.<value>`; multi-value (in/notIn)\n   * uses comma-joined parenthesised value `<col>=in.(a,b,c)`.\n   */\n  protected toQuery(): Record<string, string | number | undefined> {\n    const q: Record<string, string | number | undefined> = {};\n    for (const f of this.filters) {\n      const val = Array.isArray(f.value)\n        ? `(${(f.value as ReadonlyArray<string | number>).join(\",\")})`\n        : String(f.value);\n      // Multiple filters on the same column are not currently supported via\n      // the simple key=value query map. future cycles cover\n      // `.or()` / multi-filter — when those land the builder will switch\n      // to a serialisation that supports collisions.\n      q[f.column] = `${f.op}.${val}`;\n    }\n    if (this.limitVal !== undefined) q[\"limit\"] = this.limitVal;\n    if (this.cursorVal !== undefined) q[\"cursor\"] = this.cursorVal;\n    if (this.countMode !== undefined) q[\"count\"] = this.countMode;\n    return q;\n  }\n}\n\n/**\n * Terminal-verb builder returned by `from(collection)`. Each verb method\n * returns a sub-builder that resolves to the HTTP envelope when awaited.\n */\nclass FromBuilder {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {}\n\n  /**\n   * Initiate a SELECT query. Returns a chainable filter/page builder\n   * that resolves to the data envelope on await.\n   */\n  select<T = unknown>(): SelectBuilder<T> {\n    return new SelectBuilder<T>(this.config, this.collection);\n  }\n\n  /**\n   * Insert one record. Returns the inserted record (with platform-\n   * generated `id` + `metadata`).\n   */\n  async insert<T = unknown>(record: Partial<T>): Promise<Envelope<T>> {\n    return request<T>(this.config, {\n      method: \"POST\",\n      path: collectionPath(this.config, this.collection),\n      body: record,\n    });\n  }\n\n  /**\n   * Initiate an UPDATE. Returns a builder; the chain MUST include a\n   * filter clause (typically `.eq('id', 'rec_...')`) and resolves to\n   * the updated record envelope.\n   */\n  update<T = unknown>(patch: Partial<T>): UpdateBuilder<T> {\n    return new UpdateBuilder<T>(this.config, this.collection, patch);\n  }\n\n  /**\n   * Initiate a DELETE. Returns a builder; the chain MUST include a\n   * filter clause and resolves to the deleted record envelope.\n   */\n  delete<T = unknown>(): DeleteBuilder<T> {\n    return new DeleteBuilder<T>(this.config, this.collection);\n  }\n}\n\nclass SelectBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<ReadonlyArray<T>>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<ReadonlyArray<T>>> {\n    return request<ReadonlyArray<T>>(this.config, {\n      method: \"GET\",\n      path: collectionPath(this.config, this.collection),\n      query: this.toQuery(),\n    });\n  }\n\n  then<TResult1 = Envelope<ReadonlyArray<T>>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<ReadonlyArray<T>>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\nclass UpdateBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n    private readonly patch: Partial<T>,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<T>> {\n    const idFilter = this.filters.find((f) => f.column === \"id\" && f.op === \"eq\");\n    if (idFilter === undefined) {\n      throw new KError({\n        code: \"K9O_INVALID_FIELD_VALUE\",\n        message: \"update() requires an `.eq('id', '...')` filter; changing many rows in one call is not supported\",\n        context: { collection: this.collection },\n        recommendation: \"Chain `.eq('id', 'rec_…')` before awaiting the update; to change several rows, call update once per id.\",\n      });\n    }\n    return request<T>(this.config, {\n      method: \"PATCH\",\n      path: `${collectionPath(this.config, this.collection)}/${encodeURIComponent(String(idFilter.value))}`,\n      body: this.patch,\n    });\n  }\n\n  then<TResult1 = Envelope<T>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<T>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\nclass DeleteBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>> {\n  constructor(\n    private readonly config: HttpClientConfig,\n    private readonly collection: string,\n  ) {\n    super();\n  }\n\n  private exec(): Promise<Envelope<T>> {\n    const idFilter = this.filters.find((f) => f.column === \"id\" && f.op === \"eq\");\n    if (idFilter === undefined) {\n      throw new KError({\n        code: \"K9O_INVALID_FIELD_VALUE\",\n        message: \"delete() requires an `.eq('id', '...')` filter; deleting many rows in one call is not supported\",\n        context: { collection: this.collection },\n        recommendation: \"Chain `.eq('id', 'rec_…')` before awaiting the delete; to delete several rows, call delete once per id.\",\n      });\n    }\n    return request<T>(this.config, {\n      method: \"DELETE\",\n      path: `${collectionPath(this.config, this.collection)}/${encodeURIComponent(String(idFilter.value))}`,\n    });\n  }\n\n  then<TResult1 = Envelope<T>, TResult2 = never>(\n    onfulfilled?: ((value: Envelope<T>) => TResult1 | PromiseLike<TResult1>) | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): PromiseLike<TResult1 | TResult2> {\n    return this.exec().then(onfulfilled, onrejected);\n  }\n}\n\n/**\n * Build the collection-records URL path. Requires `config.projectSlug`\n * to be bound; member-plane resources route via the `/@<projectSlug>/...`\n * prefix per the URL grammar.\n */\nfunction collectionPath(config: HttpClientConfig, collection: string): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"data-plane operations require projectSlug to be bound on the client\",\n      context: { collection },\n      recommendation: \"Pass `projectSlug` in createClient options or use a project-scoped sub-client.\",\n    });\n  }\n  validateSlug(config.projectSlug, \"project\");\n  // Validate collection name shape — same slug grammar.\n  if (!/^[a-z][a-z0-9_-]{0,62}$/.test(collection)) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: `collection name \"${collection}\" does not match required format`,\n      context: { collection },\n      recommendation: \"Use lowercase letters / digits / underscores / hyphens; start with a letter; 1-63 chars.\",\n    });\n  }\n  return projectPath(config.projectSlug, `data/${collection}`);\n}\n\n/**\n * Factory — entry point for the data-plane DSL. Returned via\n * `client.from(collection)` on the K9oClient instance.\n */\nexport function makeFromFactory(config: HttpClientConfig) {\n  return function from(collection: string): FromBuilder {\n    return new FromBuilder(config, collection);\n  };\n}\n","/**\n * Project lifecycle SDK methods — `client.projects.*`.\n *\n * Wire mapping per gateway routes (`services/gateway/src/routes/projects-crud.ts` +\n * `discovery.ts`):\n *   - `client.projects.list()`           → GET    /projects\n *   - `client.projects.create({...})`    → POST   /projects\n *   - `client.projects.get(slug)`        → GET    /projects/<projectSlug>\n *   - `client.projects.update(slug,...)` → PATCH  /projects/<projectSlug>\n *\n * All four operations are org-plane: the client needs an org context\n * (an `orgSlug` or a bearer token that carries one). Input property\n * names are the gateway's body property names.\n *\n * All methods throw KError on non-2xx.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath, validateSlug } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Project record, as the gateway returns it. Field names are passed through unchanged.\n * Lists and creates also carry `capabilities`; lists add `accessLevel`.\n */\nexport type Project = {\n  /** `proj_<base62>`. */\n  id: string;\n  slug: string;\n  orgId: string;\n  displayName: string;\n  description: string | null;\n  productScope: string;\n  /** Region code of the project's data. */\n  region: string;\n  custodyMode: \"PLATFORM_MANAGED\" | \"SKR\" | \"BYOK\" | \"HYOK\";\n  /** `provisioning` while the project is being set up, then `active`; other values may appear. */\n  status: string;\n  /** The caller's role on the project, or `null` when the caller is not a member. */\n  role: string | null;\n  deletedAt: string | null;\n  createdAt: string;\n  /** Soft-delete retention window in days. */\n  softDeleteRetentionDays: number;\n  /** Regions the project's data may live in; `[region]` for a single-region project. */\n  residencySet: ReadonlyArray<string>;\n  /** `\"strict\"`, or `{ fallbackRegion }` when a catch-all region is set. */\n  residencyPolicy: \"strict\" | { fallbackRegion: string };\n  processingContexts: ReadonlyArray<string>;\n  /** Present on list and create responses: what the caller may write. */\n  capabilities?: { authFlows: { write: boolean }; authProviders: { write: boolean } } | undefined;\n  /** Present on list responses: `member` or `locked`. */\n  accessLevel?: \"member\" | \"locked\" | undefined;\n};\n\n/**\n * Project-creation input.\n */\nexport type CreateProjectInput = {\n  /** Display name (1 to 128 characters). Required. */\n  displayName: string;\n  /** URL slug (lowercase); the gateway derives one from `displayName` when omitted. */\n  slug?: string | undefined;\n  productScope?: \"core\" | \"kibo\" | undefined;\n  /** Region code of the project's data. */\n  region?: string | undefined;\n  defaultProjectRegion?: string | undefined;\n  custodyMode?: \"PLATFORM_MANAGED\" | \"SKR\" | \"BYOK\" | \"HYOK\" | undefined;\n  processingContexts?: ReadonlyArray<string> | undefined;\n  execSeamConfined?: boolean | undefined;\n  showroomVertical?: string | undefined;\n  persona?: string | undefined;\n  showroomLocale?: { code: string; currency: string; moneyScale: number } | undefined;\n  /** Makes a retried create return the first result instead of a second project. */\n  idempotencyKey?: string | undefined;\n};\n\n/**\n * Project-update patch.\n */\nexport type UpdateProjectInput = {\n  slug?: string | undefined;\n  displayName?: string | undefined;\n  description?: string | null | undefined;\n  region?: string | undefined;\n  productScope?: string | undefined;\n  softDeleteRetentionDays?: number | undefined;\n  processingContexts?: ReadonlyArray<string> | undefined;\n};\n\n/**\n * Factory — produces the `client.projects.*` namespace bound to the\n * supplied config.\n */\nexport function makeProjectsNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * List projects accessible to the caller. Requires authenticated\n     * session; results are scoped by RBAC.\n     */\n    async list(): Promise<Envelope<ReadonlyArray<Project>>> {\n      return request<ReadonlyArray<Project>>(config, {\n        method: \"GET\",\n        path: orgPath(\"projects\"),\n      });\n    },\n\n    /**\n     * Create a new project under the caller's active org.\n     */\n    async create(input: CreateProjectInput): Promise<Envelope<Project>> {\n      if (input.slug !== undefined) validateSlug(input.slug, \"project\");\n      return request<Project>(config, {\n        method: \"POST\",\n        path: orgPath(\"projects\"),\n        body: input,\n      });\n    },\n\n    /**\n     * Get a project by slug. Returns the project record + meta.\n     */\n    async get(slug: string): Promise<Envelope<Project>> {\n      validateSlug(slug, \"project\");\n      return request<Project>(config, {\n        method: \"GET\",\n        path: orgPath(`projects/${slug}`),\n      });\n    },\n\n    /**\n     * Update a project's mutable fields.\n     */\n    async update(slug: string, patch: UpdateProjectInput): Promise<Envelope<Project>> {\n      validateSlug(slug, \"project\");\n      return request<Project>(config, {\n        method: \"PATCH\",\n        path: orgPath(`projects/${slug}`),\n        body: patch,\n      });\n    },\n  };\n}\n","/**\n * `client.storage` buckets and objects: per-project logical buckets and the objects in them, against\n * `/@<projectSlug>/storage/buckets…`. `client.storage.locations.*` (the customer's own object stores) lives in\n * `storage-locations.ts` and is unchanged.\n *\n * Bucket names are logical: the platform resolves them to a physical store, so a developer never sees a\n * physical bucket or key. Signed URLs require an explicit `expiresIn` (no default). The gateway accepts 1 to 604800 seconds but never\n * signs for longer than 900 seconds, and the answer's `expiresIn` is the lifetime it actually used.\n *\n * What is NOT here yet, by design: a signed PUT (a method- and content-type-bound upload URL). The gateway has\n * no route for it; uploads go through the multipart `upload` below.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** A bucket. */\nexport type StorageBucket = {\n  name: string;\n  /** Stored and returned, not enforced: setting it does not yet change who can read objects. */\n  public: boolean;\n  /** Bytes; `null` = no limit. */\n  fileSizeLimit: number | null;\n  /** MIME allow-list; empty = any. */\n  allowedMimeTypes: string[];\n  /** Stored and returned, not enforced: the platform does not keep object versions yet. */\n  versioning: boolean;\n  /** Stored and returned, not enforced: nothing deletes objects after this many days yet. `null` = never. */\n  deleteAfterDays: number | null;\n  createdAt: string;\n  updatedAt: string;\n  /** Platform-owned buckets (for example audit assets) cannot be written through the public routes. */\n  system: boolean;\n  /** The storage location the bucket is linked to, or `null` for platform-managed storage. */\n  byosBindingId: string | null;\n};\n\n/** Options for `createBucket`. The bucket name is the first argument (3 to 63 chars, lowercase, digits, hyphens). */\nexport type CreateBucketOptions = {\n  /** Stored, not enforced yet (see `StorageBucket.public`). */\n  public?: boolean;\n  fileSizeLimit?: number;\n  allowedMimeTypes?: string[] | null;\n  /** Stored, not enforced yet. */\n  versioning?: boolean;\n  /** Stored, not enforced yet. */\n  deleteAfterDays?: number;\n  /** Link the bucket to one of the project's storage locations (see `client.storage.locations`). */\n  byosBindingId?: string;\n};\n\n/** Fields you may change on a bucket. `null` clears a limit; `allowedMimeTypes: null` allows any type. */\nexport type UpdateBucketOptions = {\n  /** Stored, not enforced yet. */\n  public?: boolean;\n  fileSizeLimit?: number | null;\n  allowedMimeTypes?: string[] | null;\n  /** Stored, not enforced yet. */\n  versioning?: boolean;\n  /** Stored, not enforced yet. */\n  deleteAfterDays?: number | null;\n  /** `null` unlinks the bucket from its storage location. */\n  byosBindingId?: string | null;\n};\n\n/** An object listing entry. `path` is relative to the bucket. */\nexport type StorageObject = {\n  path: string;\n  size: number;\n  lastModified: string | null;\n};\n\nexport type UploadOptions = {\n  /** Defaults to the data's own type when it is a `Blob`. */\n  contentType?: string;\n  /** `false` (default) refuses to overwrite an existing path (`409 K9O_ALREADY_EXISTS`). */\n  upsert?: boolean;\n  /** Caller-defined string metadata: at most 10 keys and 2 KB in total (enforced by the gateway). */\n  metadata?: Record<string, string>;\n};\n\nexport type SignedUrlOptions = {\n  /**\n   * Seconds, required: 1 to 604800. There is deliberately no default. The gateway clamps the lifetime to 900\n   * seconds (15 minutes); read `expiresIn` in the answer for the lifetime you got.\n   */\n  expiresIn: number;\n  /** `true` makes the download an attachment (`Content-Disposition: attachment`). */\n  download?: boolean;\n};\n\n/** `expiresIn` is the lifetime the gateway used: at most 900 seconds, even when you asked for more. */\nexport type SignedUrl = { signedUrl: string; expiresIn: number };\nexport type RemovedObject = { bucket: string; path: string; deleted: boolean };\nexport type DeletedBucket = { name: string; deleted: true; objectsDeleted: number };\n\nconst MAX_EXPIRES_IN = 604_800;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (config.projectSlug === undefined || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"client.storage buckets and objects require a bound projectSlug (per-project resource)\",\n      context: {},\n      recommendation: \"Pass projectSlug when constructing the client.\",\n    });\n  }\n  return config.projectSlug;\n}\n\nconst bucketsPath = (config: HttpClientConfig, suffix = \"\"): string =>\n  projectPath(requireProjectSlug(config), `storage/buckets${suffix}`);\n\nconst bucketPath = (config: HttpClientConfig, name: string, suffix = \"\"): string => {\n  if (name.length === 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"bucket name must not be empty\",\n      context: { field: \"bucket\", reason: \"empty\" },\n      recommendation: null,\n    });\n  }\n  // `.` and `..` survive percent-encoding and are collapsed as dot segments by the URL layer BEFORE the request leaves,\n  // so a bucket named `..` would address a different route. No bucket can have that name (3 to 63 chars), so refuse it\n  // here rather than send a rewritten URL.\n  if (name === \".\" || name === \"..\") {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"bucket name must not be a dot segment\",\n      context: { field: \"bucket\", reason: \"dot_segment\" },\n      recommendation: null,\n    });\n  }\n  return bucketsPath(config, `/${encodeURIComponent(name)}${suffix}`);\n};\n\nfunction requireObjectPath(path: string): void {\n  if (path.length === 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"object path must not be empty\",\n      context: { field: \"path\", reason: \"empty\" },\n      recommendation: null,\n    });\n  }\n}\n\nfunction requireExpiresIn(expiresIn: unknown): asserts expiresIn is number {\n  if (typeof expiresIn !== \"number\" || !Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_EXPIRES_IN) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: `expiresIn is required and must be an integer from 1 to ${MAX_EXPIRES_IN} seconds`,\n      context: { field: \"expiresIn\", reason: \"out_of_range\" },\n      recommendation: \"Pass an explicit expiresIn; signed URLs have no default lifetime.\",\n    });\n  }\n}\n\nfunction toBlob(data: Blob | Uint8Array | ArrayBuffer | string, contentType?: string): Blob {\n  const init = contentType !== undefined ? { type: contentType } : {};\n  if (data instanceof Blob) return contentType !== undefined && data.type !== contentType ? new Blob([data], init) : data;\n  if (typeof data === \"string\") return new Blob([data], init);\n  return new Blob([data as unknown as ArrayBuffer], init);\n}\n\n/** A handle on one bucket: `client.storage.from(\"avatars\")`. */\nexport function makeBucketHandle(config: HttpClientConfig, bucket: string) {\n  return {\n    /**\n     * Upload an object. `POST /@<projectSlug>/storage/buckets/<bucket>/objects` (multipart). The bytes pass through\n     * the gateway; the bucket's size and MIME limits are enforced there.\n     */\n    async upload(path: string, data: Blob | Uint8Array | ArrayBuffer | string, options: UploadOptions = {}): Promise<Envelope<StorageObject>> {\n      requireObjectPath(path);\n      const form = new FormData();\n      form.append(\"file\", toBlob(data, options.contentType), path.split(\"/\").pop() || \"file\");\n      form.append(\"path\", path);\n      if (options.contentType !== undefined) form.append(\"contentType\", options.contentType);\n      form.append(\"upsert\", options.upsert === true ? \"true\" : \"false\");\n      if (options.metadata !== undefined) form.append(\"metadata\", JSON.stringify(options.metadata));\n      return request<StorageObject>(config, { method: \"POST\", path: bucketPath(config, bucket, \"/objects\"), body: form });\n    },\n\n    /**\n     * A pre-authenticated GET URL for one object. `POST …/objects/sign`. `expiresIn` is required; the URL lives at most 900 seconds.\n     * (A signed PUT is not offered: the gateway has no route for it yet.)\n     */\n    async createSignedUrl(path: string, options: SignedUrlOptions): Promise<Envelope<SignedUrl>> {\n      requireObjectPath(path);\n      requireExpiresIn(options?.expiresIn);\n      return request<SignedUrl>(config, {\n        method: \"POST\",\n        path: bucketPath(config, bucket, \"/objects/sign\"),\n        body: { path, expiresIn: options.expiresIn, ...(options.download !== undefined ? { download: options.download } : {}) },\n      });\n    },\n\n    /** List objects, optionally under a prefix. `GET …/objects?prefix=`. */\n    async list(options: { prefix?: string } = {}): Promise<Envelope<ReadonlyArray<StorageObject>>> {\n      return request<ReadonlyArray<StorageObject>>(config, {\n        method: \"GET\",\n        path: bucketPath(config, bucket, \"/objects\"),\n        ...(options.prefix !== undefined ? { query: { prefix: options.prefix } } : {}),\n      });\n    },\n\n    /** Delete one object. `DELETE …/objects?path=`. */\n    async remove(path: string): Promise<Envelope<RemovedObject>> {\n      requireObjectPath(path);\n      return request<RemovedObject>(config, { method: \"DELETE\", path: bucketPath(config, bucket, \"/objects\"), query: { path } });\n    },\n  };\n}\n\n/** Bucket operations; merged into `client.storage` next to `locations`. */\nexport function makeBucketOperations(config: HttpClientConfig) {\n  return {\n    /** List the project's buckets. `GET /@<projectSlug>/storage/buckets`. */\n    async listBuckets(): Promise<Envelope<ReadonlyArray<StorageBucket>>> {\n      return request<ReadonlyArray<StorageBucket>>(config, { method: \"GET\", path: bucketsPath(config) });\n    },\n\n    /** Read one bucket. `GET …/buckets/<name>`. */\n    async getBucket(name: string): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"GET\", path: bucketPath(config, name) });\n    },\n\n    /**\n     * Create a bucket. `POST …/buckets`. A name outside 3 to 63 lowercase letters, digits and hyphens is refused\n     * (`INVALID_BUCKET_NAME`).\n     */\n    async createBucket(name: string, options: CreateBucketOptions = {}): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"POST\", path: bucketsPath(config), body: { name, ...options } });\n    },\n\n    /** Change a bucket. `PATCH …/buckets/<name>`. */\n    async updateBucket(name: string, options: UpdateBucketOptions): Promise<Envelope<StorageBucket>> {\n      return request<StorageBucket>(config, { method: \"PATCH\", path: bucketPath(config, name), body: options });\n    },\n\n    /**\n     * Delete a bucket. `DELETE …/buckets/<name>`. A non-empty bucket is refused unless `empty: true`, which purges\n     * its objects first.\n     */\n    async deleteBucket(name: string, options: { empty?: boolean } = {}): Promise<Envelope<DeletedBucket>> {\n      return request<DeletedBucket>(config, {\n        method: \"DELETE\",\n        path: bucketPath(config, name),\n        ...(options.empty === true ? { query: { empty: \"true\" } } : {}),\n      });\n    },\n\n    /** A handle on one bucket for object operations: `from(\"avatars\").upload(...)`. */\n    from(bucket: string) {\n      return makeBucketHandle(config, bucket);\n    },\n  };\n}\n","/**\n * The provider's own name for a bucket's location (`providerRegion`), as opposed to the platform region (a short code\n * such as `de01`). It goes into hostnames (`s3.<r>.amazonaws.com`, `sts.<r>.amazonaws.com`, `s3.<r>.backblazeb2.com`),\n * so a value like `x.attacker.net#` would aim a SigV4-signed request at a host the caller chose. The gateway checks the\n * same closed grammar on write and again where each endpoint is built; checking it here first means a bad value is\n * refused before any request is sent and before a credential envelope is sealed.\n *\n * Grammars (the Step 0 ruling for the BYOS split):\n *   - `s3` (AWS):      `^[a-z]{2}(-gov)?-[a-z]+-\\d$`        e.g. `us-east-1`, `us-gov-west-1`\n *   - `b2`:            `^[a-z]{2}-[a-z]+-\\d{3}$`            e.g. `eu-central-003`\n *   - `r2`:            `auto` only\n *   - `gcs`, `azure_blob`: lower-case letters, digits and `-`, 1 to 32 characters, first and last alphanumeric (the gateway's bound)\n *   - `s3_compatible`, `minio`: the same closed charset as GCS and Azure. The ruling gives the AWS grammar only for an\n *     S3-compatible store that uses an AWS endpoint; every other region name is accepted only if it cannot reshape a host.\n */\n\nimport { KError } from \"./kerror.ts\";\n\nexport type ProviderRegionProvider = \"s3\" | \"s3_compatible\" | \"gcs\" | \"azure_blob\" | \"minio\" | \"r2\" | \"b2\";\n\nconst CHARSET = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;\nconst GRAMMAR: Record<ProviderRegionProvider, (v: string) => boolean> = {\n  s3: (v) => /^[a-z]{2}(-gov)?-[a-z]+-\\d$/.test(v),\n  b2: (v) => /^[a-z]{2}-[a-z]+-\\d{3}$/.test(v),\n  r2: (v) => v === \"auto\",\n  gcs: (v) => CHARSET.test(v),\n  azure_blob: (v) => CHARSET.test(v),\n  s3_compatible: (v) => CHARSET.test(v),\n  minio: (v) => CHARSET.test(v),\n};\n\n/** True if `value` is a well-formed provider region for `provider`; with no provider, the closed charset only. */\nexport function isProviderRegion(value: unknown, provider?: ProviderRegionProvider): boolean {\n  if (typeof value !== \"string\" || value.length === 0) return false;\n  return provider === undefined ? CHARSET.test(value) : GRAMMAR[provider](value);\n}\n\n/**\n * Throw `K9O_INVALID_FIELD_VALUE` (`reason: \"provider_region_invalid\"`, the gateway's own reason) unless `value` is a\n * well-formed provider region. The value is never echoed.\n */\nexport function assertProviderRegion(value: unknown, provider?: ProviderRegionProvider): void {\n  if (isProviderRegion(value, provider)) return;\n  throw new KError({\n    code: \"K9O_INVALID_FIELD_VALUE\",\n    message:\n      provider === undefined\n        ? \"providerRegion must be lower-case letters, digits and '-' (at most 32 characters)\"\n        : `providerRegion is not a valid ${provider} region`,\n    context: { field: \"providerRegion\", reason: \"provider_region_invalid\", ...(provider !== undefined ? { provider } : {}) },\n    recommendation:\n      provider === \"r2\" ? \"Use `auto` for R2.\" : \"Pass the provider's own region name (for example `us-east-1`), not the platform region (`de01`).\",\n  });\n}\n","/**\n * `client.storage.locations.*` — storage locations: the customer's own object stores (Bring-Your-Own-Store),\n * registered once per project and then linked to buckets and Datasets. Per-project CRUD against\n * `/@<projectSlug>/storage/locations`; it replaces the withdrawn purpose-based `client.byos.*` /\n * `/@<projectSlug>/byos` (hard cutover: the old routes answer 404).\n *\n * Deliberately independent of `byos.ts` (the credential pre-create/reference helpers) and of\n * `client.kibo.vault.secrets` — a location's `credentialRef` is just a string here. The caller pre-creates the\n * credential separately (`k9o byos-cred create` / `client.kibo.vault.secrets.create`) and passes the resulting\n * `kibo://byos-creds/<secId>` reference in; this namespace never creates, reads or returns a credential.\n *\n * A location carries no \"purpose\": which bucket or Dataset uses it is decided at link time, not here.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { KError } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport { makeBucketOperations } from \"./storage-buckets.ts\";\nimport { assertProviderRegion } from \"./provider-region.ts\";\n\n/** Storage provider. */\nexport type StorageLocationProvider = \"s3\" | \"s3_compatible\" | \"gcs\" | \"azure_blob\" | \"minio\" | \"r2\" | \"b2\";\n/** Key-custody mode. */\nexport type StorageLocationCustodyMode = \"PLATFORM_MANAGED\" | \"BYOK\" | \"HYOK\";\n\n/**\n * Non-secret, provider-specific configuration. Keys the platform reads: `accountId` and `parentAccessKeyId`\n * (`r2`), `bucketId` (`b2`). The gateway stores them as given and the credential mint fails closed when a\n * required one is missing, so set them when you create the location.\n */\nexport type StorageLocationProviderParams = Record<string, string>;\n\n/** A storage location. */\nexport type StorageLocation = {\n  id: string;\n  projectId: string;\n  provider: StorageLocationProvider;\n  bucketName: string;\n  /** The platform region (a 4-character short code such as `de01`), checked against the project's residency set. */\n  region: string;\n  /** The provider's own name for the bucket's location (`us-east-1`, `auto` for R2, the GCS or Azure location). Never residency-checked. */\n  providerRegion: string;\n  endpointOverride: string | null;\n  /** The `kibo://byos-creds/<secId>` reference. The credential itself is never returned. */\n  credentialRef: string;\n  custodyMode: StorageLocationCustodyMode;\n  providerParams: StorageLocationProviderParams;\n  createdAt: string;\n  /** `null` while the location is live. */\n  retiredAt: string | null;\n};\n\n/** Input to register a location from a pre-created credential reference. */\nexport type CreateStorageLocationInput = {\n  provider: StorageLocationProvider;\n  bucketName: string;\n  /** The platform region (short code), checked against the project's residency set. */\n  region: string;\n  /** The provider's own name for the bucket's location. Required; `auto` for R2. */\n  providerRegion: string;\n  endpointOverride?: string;\n  credentialRef: string;\n  custodyMode?: StorageLocationCustodyMode;\n  providerParams?: StorageLocationProviderParams;\n};\n\n/**\n * Fields you may change on a live location. `provider` cannot change. Moving a location that is in use (its\n * bucket, region, providerRegion, endpoint, `providerParams` or `custodyMode`) is refused with `409 location_in_use`; rotating\n * the credential is allowed. A `custodyMode` change counts as a move because it re-states the custody claim for\n * data already stored there. `providerParams`, when given, REPLACES the whole map (send every key you want to keep).\n */\nexport type UpdateStorageLocationInput = {\n  bucketName?: string;\n  region?: string;\n  providerRegion?: string;\n  /** `null` clears a previously set override. */\n  endpointOverride?: string | null;\n  credentialRef?: string;\n  custodyMode?: StorageLocationCustodyMode;\n  providerParams?: StorageLocationProviderParams;\n};\n\n/** Result of retiring a location. */\nexport type RetiredStorageLocation = { id: string; status: \"retired\" };\n\n/**\n * Result of `test`. Today this is a dry run that echoes the location's coordinates; the live probe is not\n * built yet (`dependencyOn` names what it waits for).\n */\nexport type StorageLocationTestResult = {\n  dryRun: boolean;\n  locationId: string;\n  provider: StorageLocationProvider;\n  bucketName: string;\n  region: string;\n  providerRegion: string;\n  endpointOverride: string | null;\n  dependencyOn: string;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (config.projectSlug === undefined || config.projectSlug.length === 0) {\n    throw new KError({\n      code: \"K9O_MISSING_PROJECT_CONTEXT\",\n      message: \"client.storage.locations requires a bound projectSlug (per-project resource)\",\n      context: {},\n      recommendation: \"Pass projectSlug when constructing the client.\",\n    });\n  }\n  return config.projectSlug;\n}\n\nconst locationsPath = (config: HttpClientConfig, suffix = \"\"): string =>\n  projectPath(requireProjectSlug(config), `storage/locations${suffix}`);\n\nexport function makeStorageNamespace(config: HttpClientConfig) {\n  return {\n    // Buckets and objects (storage-buckets.ts): createBucket, listBuckets, from(bucket).upload, ...\n    ...makeBucketOperations(config),\n    locations: {\n      /** List the live storage locations of the bound project. `GET /@<projectSlug>/storage/locations`. */\n      async list(): Promise<Envelope<ReadonlyArray<StorageLocation>>> {\n        return request<ReadonlyArray<StorageLocation>>(config, { method: \"GET\", path: locationsPath(config) });\n      },\n\n      /**\n       * Register a location. `POST /@<projectSlug>/storage/locations`. The region must be inside the project's\n       * residency set (`400`, reason `region_outside_residency`).\n       */\n      async create(input: CreateStorageLocationInput): Promise<Envelope<StorageLocation>> {\n        assertProviderRegion(input.providerRegion, input.provider);\n        return request<StorageLocation>(config, { method: \"POST\", path: locationsPath(config), body: input });\n      },\n\n      /** Read one location. `GET /@<projectSlug>/storage/locations/<locationId>`. */\n      async get(locationId: string): Promise<Envelope<StorageLocation>> {\n        return request<StorageLocation>(config, {\n          method: \"GET\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n        });\n      },\n\n      /** Update a live location. `PATCH /@<projectSlug>/storage/locations/<locationId>`. */\n      async update(locationId: string, patch: UpdateStorageLocationInput): Promise<Envelope<StorageLocation>> {\n        // The provider of an existing location cannot change and is not in the patch, so only the closed charset is\n        // checked here; the gateway applies the provider's own grammar.\n        if (patch.providerRegion !== undefined) assertProviderRegion(patch.providerRegion);\n        return request<StorageLocation>(config, {\n          method: \"PATCH\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n          body: patch,\n        });\n      },\n\n      /**\n       * Retire a location. `DELETE /@<projectSlug>/storage/locations/<locationId>`. Refused with\n       * `409 location_in_use` while a bucket or any Dataset (retired ones included) still uses it.\n       */\n      async retire(locationId: string): Promise<Envelope<RetiredStorageLocation>> {\n        return request<RetiredStorageLocation>(config, {\n          method: \"DELETE\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}`),\n        });\n      },\n\n      /** Dry-run check of a location. `POST /@<projectSlug>/storage/locations/<locationId>/test`. */\n      async test(locationId: string): Promise<Envelope<StorageLocationTestResult>> {\n        return request<StorageLocationTestResult>(config, {\n          method: \"POST\",\n          path: locationsPath(config, `/${encodeURIComponent(locationId)}/test`),\n        });\n      },\n    },\n  };\n}\n","/**\n * Migration lifecycle SDK — `client.migrations.*`.\n *\n * Backed by the gateway migrations routes.\n * All routes are member-plane (`/@<projectSlug>/migrations/...`).\n *\n * Wire mapping:\n *   - `apply({ migrations })`     → POST   /@<slug>/migrations/apply\n *   - `list()`                    → GET    /@<slug>/migrations\n *   - `get(version)`              → GET    /@<slug>/migrations/<version>\n *   - `queue({ migrations })`     → POST   /@<slug>/migrations/queue\n *   - `listPending()`             → GET    /@<slug>/migrations/pending\n *   - `applyPending(pendingId)`   → POST   /@<slug>/migrations/pending/<pendingId>/apply\n *   - `rejectPending(pendingId)`  → POST   /@<slug>/migrations/pending/<pendingId>/reject\n *   - `deletePending(pendingId)`  → DELETE /@<slug>/migrations/pending/<pendingId>\n *\n * Migration shape — STRUCTURED\n * DECLARATIVE DDL, never raw SQL. Every schema change is a typed, key-tagged\n * operation, so schema drift is impossible at the SDK layer (the\n * invariant). Raw SQL is the separate runtime `client.query()` surface,\n * which cannot create/alter schema. The gateway checksums each migration and\n * stores it in `_sys.migrations`; already-applied versions are skipped on\n * re-run and mismatched checksums are rejected, preserving the drift invariant.\n *\n * Per-operation field shapes are grounded in the gateway DDL parser\n * (`services/gateway/src/db/migration-runner.ts`), NOT invented.\n *\n * Verified against the gateway DDL parser:\n *   - `up`/`down` arrays — parser now iterates them (shipped `2.58.0-beta.1`).\n *   - ColumnSpec protection attrs — live since `2.56.0`; `encrypted` is the\n *     `true | { store, searchable }` union with `searchable` NESTED (not a\n *     sibling); `blind_indexed` is the C-mode sibling. Aligned above.\n *   - Op set FROZEN at 6 (no alter_column/rename_table/constraint at v2).\n *     `rename_column` is a pending 7th — to be added once its field\n *     names are finalised and the re-encryption pass ships.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** Foreign-key reference on a column — compiles to a REFERENCES clause. */\nexport type ColumnReferences = {\n  collection: string;\n  on: string;\n  on_delete?: \"CASCADE\" | \"RESTRICT\" | \"SET NULL\" | \"NO ACTION\";\n  on_update?: \"CASCADE\" | \"RESTRICT\" | \"SET NULL\" | \"NO ACTION\";\n};\n\n/**\n * A column definition. `type` is the column-type vocabulary\n * (parser-owned; kept as `string` rather than a fabricated enum). The\n * protection attributes declare at-rest field encryption (gateway\n * shape verified vs the parser, live since `2.56.0`).\n */\nexport type ColumnSpec = {\n  name: string;\n  type: string;\n  primary_key?: boolean;\n  not_null?: boolean;\n  unique?: boolean;\n  default?: string;\n  references?: ColumnReferences;\n  /**\n   * At-rest field encryption. `true` = inline-stored encrypted column;\n   * the object form opts into a `store` (\"inline\" | \"vault\") and the D-mode\n   * searchable-encryption index (`searchable`). NOTE: `searchable` is NESTED\n   * here — it is NOT a sibling attribute.\n   */\n  encrypted?: true | { store: \"inline\" | \"vault\"; searchable?: boolean };\n  /** C-mode: deterministic blind index for equality lookup over an encrypted column. */\n  blind_indexed?: boolean;\n};\n\n/** An index definition. `name` defaults to `<table>_<cols>_idx`. */\nexport type IndexSpec = {\n  name?: string;\n  columns: ReadonlyArray<string>;\n  unique?: boolean;\n};\n\n/**\n * A single declarative DDL operation — KEY-TAGGED (exactly one key set), the\n * shape the gateway applies. The v2 set is these 7 — no `alter_column`,\n * `rename_table`, or constraint ops at v2. `alter_table` is the BATCHED column\n * mutation (one op carries optional `add_columns[]` + `drop_columns[]`), live in\n * the gateway runner (`migration-runner.ts:156`).\n * `rename_column` remains a pending future op (its parser field names are not yet\n * finalised); NOTE / a `rename_column` on an ENCRYPTED column\n * is fail-closed-rejected (`K9O_ENCRYPTED_COLUMN_DECLARATION_INVALID`) pending the\n * re-encryption pass — to document when that op lands.\n */\nexport type Operation =\n  | { create_table: { name: string; columns: ReadonlyArray<ColumnSpec>; indexes?: ReadonlyArray<IndexSpec> } }\n  | { drop_table: string }\n  | { add_column: { table: string; column: ColumnSpec } }\n  | { drop_column: { table: string; column: string } }\n  | { alter_table: { name: string; add_columns?: ReadonlyArray<ColumnSpec>; drop_columns?: ReadonlyArray<string> } }\n  | { create_index: { table: string; index: IndexSpec } }\n  | { drop_index: { name: string } };\n\n/** A declarative authorization/relationship rule (compiles to RLS USING + WITH\n *  CHECK). The rule grammar is the policy-expression DSL. */\nexport type ActionRule = { rule?: unknown };\n\n/** A declared relationship for embedding/joins (references). */\nexport type RelationshipSpec = {\n  collection: string;\n  on: string;\n  as: string;\n  type?: \"inner\" | \"left\";\n};\n\n/** Per-collection policy block (RLS + relationships),. */\nexport type CollectionPolicy = {\n  references?: ReadonlyArray<RelationshipSpec>;\n  actions?: {\n    select?: ActionRule;\n    insert?: ActionRule;\n    update?: ActionRule;\n    delete?: ActionRule;\n  };\n};\n\n/** Per-bucket storage policy block,. */\nexport type StorageBucketPolicy = {\n  public?: boolean;\n  actions?: {\n    read?: ActionRule;\n    upload?: ActionRule;\n    delete?: ActionRule;\n    list?: ActionRule;\n  };\n};\n\n/** The optional `policy` section authored alongside a migration. */\nexport type MigrationPolicy = {\n  collections?: Record<string, CollectionPolicy>;\n  storage?: { buckets?: Record<string, StorageBucketPolicy> };\n};\n\n/**\n * A migration — a versioned, checksummed unit of structured DDL. `up` applies\n * the change; `down` reverses it. Both are operation arrays.\n */\nexport type Migration = {\n  version: number;\n  slug: string;\n  up: ReadonlyArray<Operation>;\n  down: ReadonlyArray<Operation>;\n  policy?: MigrationPolicy;\n};\n\n/**\n * Applied-migration record returned by `list` + `get`. `get` also carries `opPayload`\n * (the migration body as submitted, or `null` for old migrations).\n */\nexport type AppliedMigration = {\n  version: number;\n  slug: string;\n  checksum: string;\n  appliedAt: string;\n  noPolicy: boolean;\n  affectedCollections: ReadonlyArray<string>;\n  opPayload?: unknown;\n};\n\n/** A migration that `apply` or `applyPending` just applied. Carries no `appliedAt`. */\nexport type AppliedMigrationRow = {\n  version: number;\n  slug: string;\n  checksum: string;\n};\n\n/** A migration `apply` left alone, e.g. `already_applied`. */\nexport type SkippedMigrationRow = {\n  version: number;\n  slug: string;\n  reason: string;\n};\n\n/** Result of `apply`. */\nexport type ApplyMigrationsResult = {\n  applied: ReadonlyArray<AppliedMigrationRow>;\n  skipped: ReadonlyArray<SkippedMigrationRow>;\n};\n\n/** Result of `applyPending`: `pendingId` is the queued row that was applied. */\nexport type ApplyPendingResult = ApplyMigrationsResult & {\n  pendingId: string;\n};\n\nexport type PendingMigrationStatus = \"queued\" | \"pending_approval\" | \"applied\" | \"rejected\" | \"cancelled\";\n\n/**\n * Pending migration record returned by `listPending`.\n */\nexport type PendingMigration = {\n  id: string;\n  version: number;\n  slug: string;\n  checksum: string;\n  status: PendingMigrationStatus;\n  affectedCollections: ReadonlyArray<string>;\n  /** Approval that gates a `pending_approval` row, else `null`. */\n  approvalId: string | null;\n  queuedAt: string;\n  queuedBy: string;\n  decidedAt: string | null;\n  decidedBy: string | null;\n  decisionReason: string | null;\n};\n\n/** One row of the `queue` answer. */\nexport type QueuedMigration = {\n  /** The pending id to pass to `applyPending`, `rejectPending` or `deletePending`. */\n  id: string;\n  version: number;\n  slug: string;\n  status: \"queued\" | \"pending_approval\";\n  approvalId: string | null;\n  affectedCollections: ReadonlyArray<string>;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"migrations operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeMigrationsNamespace(config: HttpClientConfig) {\n  return {\n    /** Apply migrations immediately (PROJECT_ADMIN minimum). */\n    async apply(input: { migrations: ReadonlyArray<Migration> }): Promise<Envelope<ApplyMigrationsResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"migrations/apply\"),\n        body: input,\n      });\n    },\n\n    /** List applied migrations on the project. */\n    async list(): Promise<Envelope<ReadonlyArray<AppliedMigration>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"migrations\"),\n      });\n    },\n\n    /** Get a single applied migration by version. */\n    async get(version: number): Promise<Envelope<AppliedMigration>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `migrations/${encodeURIComponent(String(version))}`),\n      });\n    },\n\n    /** Queue migrations for maker-checker approval. */\n    async queue(input: { migrations: ReadonlyArray<Migration> }): Promise<Envelope<ReadonlyArray<QueuedMigration>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"migrations/queue\"),\n        body: input,\n      });\n    },\n\n    /** List pending migrations: `queued` ones by default, or those with the given `status`. */\n    async listPending(opts?: { status?: PendingMigrationStatus | undefined }): Promise<Envelope<ReadonlyArray<PendingMigration>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"migrations/pending\"),\n        query: opts,\n      });\n    },\n\n    /**\n     * Apply a queued migration by id (same-actor fast path — floors at\n     * PROJECT_ADMIN; a `pending_approval` row, i.e. a protected-collection\n     * migration awaiting a distinct-admin's review, is refused here and\n     * needs its own approval flow, not this call).\n     */\n    async applyPending(pendingId: string): Promise<Envelope<ApplyPendingResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}/apply`),\n      });\n    },\n\n    /** Reject a pending migration (transitions to rejected; does not apply). */\n    async rejectPending(pendingId: string, input?: { reason?: string }): Promise<Envelope<{ pendingId: string; status: \"rejected\" }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}/reject`),\n        body: input,\n      });\n    },\n\n    /** Delete a pending migration from the queue. */\n    async deletePending(pendingId: string): Promise<Envelope<{ pendingId: string; status: \"cancelled\" }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `migrations/pending/${encodeURIComponent(pendingId)}`),\n      });\n    },\n  };\n}\n","/**\n * Function lifecycle SDK — `client.functions.*`.\n *\n * Backed by the gateway functions and invoke routes.\n *\n * Wire mapping:\n *   - `deploy({ name, runtime, tier, artifactKey, version })` → POST /@<slug>/functions\n *   - `list()`                                → GET    /@<slug>/functions\n *   - `get(name)`                             → GET    /@<slug>/functions/<name>\n *   - `delete(name)`                          → DELETE /@<slug>/functions/<name>\n *   - `invoke(name, payload)`                 → POST   /@<slug>/functions/<name>/invoke\n *\n * Deploy requires PROJECT_ADMIN and returns with status `deploying`; the\n * function is ready when status flips to `active`.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Function record returned by gateway endpoints.\n */\nexport type FunctionRecord = {\n  /** `fn_<base62>`. */\n  id: string;\n  name: string;\n  runtime: DeployFunctionInput[\"runtime\"];\n  tier: \"gateway\" | \"sandbox\";\n  entryPoint: string;\n  version: string;\n  status: \"deploying\" | \"active\" | \"error\" | \"retired\";\n  /** Who manages the function: a developer deploy, or an extension (`extension:<id>`). */\n  source: string;\n  description: string | null;\n  createdAt: string;\n  deployedAt: string | null;\n  retiredAt: string | null;\n  errorDetail: string | null;\n};\n\n/**\n * Deploy input. The function's bytes are uploaded first (the gateway's\n * function-artifact upload returns the `artifactKey`); deploy references\n * that artifact.\n */\nexport type DeployFunctionInput = {\n  /** Function name (1 to 128 characters). */\n  name: string;\n  runtime: \"bun\" | \"python\" | \"go\" | \"java\" | \"kotlin\" | \"dotnet\" | \"swift\" | \"php\" | \"ruby\" | \"rust\" | \"tinygo\" | \"zig\" | \"assemblyscript\";\n  /** `gateway` runs WebAssembly in the gateway; `sandbox` runs an OCI image archive. */\n  tier: \"gateway\" | \"sandbox\";\n  /** Content-addressed key of the uploaded artifact. */\n  artifactKey: string;\n  /** Version label for this deploy (1 to 64 characters). */\n  version: string;\n  description?: string | undefined;\n};\n\n/** Optional invoke controls; property names are the gateway's. */\nexport type InvokeFunctionOptions = {\n  /** Run asynchronously instead of waiting for the result. */\n  background?: boolean | undefined;\n  delegation?: { token: string; invokeSessionId?: string | undefined } | undefined;\n  onBehalfOf?: string | undefined;\n  confinedTo?: string | undefined;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"functions operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeFunctionsNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * Upload a function artifact and get back its content-addressed `artifactKey`, to pass to `deploy`.\n     * `POST /@<projectSlug>/functions/artifacts` with the raw bytes: a WebAssembly module for the gateway tier (up to\n     * 16 MiB) or an OCI image archive for the sandbox tier (up to 256 MiB). Uploading the same bytes again returns the same key.\n     */\n    async uploadArtifact(bytes: Uint8Array | ArrayBuffer | Blob, kind: \"wasm\" | \"tar\"): Promise<Envelope<{ artifactKey: string }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"functions/artifacts\"),\n        rawBody: bytes,\n        headers: { \"content-type\": kind === \"wasm\" ? \"application/wasm\" : \"application/x-tar\" },\n      });\n    },\n\n    /** Deploy or redeploy a function from an uploaded artifact. Returns the function record with status. */\n    async deploy(input: DeployFunctionInput): Promise<Envelope<FunctionRecord>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"functions\"),\n        body: input,\n      });\n    },\n\n    /** List deployed functions (cursor pagination). */\n    async list(opts?: { limit?: number; cursor?: string; status?: FunctionRecord[\"status\"]; tier?: FunctionRecord[\"tier\"]; source?: string }): Promise<Envelope<ReadonlyArray<FunctionRecord>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"functions\"),\n        query: opts,\n      });\n    },\n\n    /** Get a function by name. */\n    async get(name: string): Promise<Envelope<FunctionRecord>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}`),\n      });\n    },\n\n    /** Retire a function. Returns the retired record; the function name enters a 24h cooldown. */\n    async delete(name: string): Promise<Envelope<FunctionRecord>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}`),\n      });\n    },\n\n    /**\n     * Invoke a function. The `payload` is sent as the `payload` field of\n     * the request body and passed to the function runtime verbatim; the\n     * gateway returns whatever the function returns wrapped in the standard\n     * envelope. Invoke authority is per function. This method covers the\n     * request-response variant only.\n     */\n    async invoke<TResult = unknown, TPayload = unknown>(name: string, payload?: TPayload, options?: InvokeFunctionOptions): Promise<Envelope<TResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `functions/${encodeURIComponent(name)}/invoke`),\n        body: { ...(payload !== undefined ? { payload } : {}), ...(options ?? {}) },\n      });\n    },\n  };\n}\n","/**\n * Policy bundle lifecycle SDK — `client.policies.*`.\n *\n * Backed by the gateway policies routes.\n *\n * Wire mapping:\n *   - `current()`                         → GET    /@<slug>/policy           (active policy)\n *   - `list()`                            → GET    /@<slug>/policies         (all bundles)\n *   - `create({...})`                     → POST   /@<slug>/policies         (draft bundle)\n *   - `validate({...})`                   → POST   /@<slug>/policies/validate (lint without persist)\n *   - `get(bundleId)`                     → GET    /@<slug>/policies/<id>\n *   - `update(bundleId, patch)`           → PATCH  /@<slug>/policies/<id>\n *   - `delete(bundleId)`                  → DELETE /@<slug>/policies/<id>\n *   - `publish(bundleId)`                 → POST   /@<slug>/policies/<id>/publish\n *\n * Only authoring roles write policy and only custodian roles publish.\n * `validate` is read-only and any role with policy-read can lint a\n * candidate document.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\nexport type PolicyBundle = {\n  /** `pol_<base62>`. */\n  id: string;\n  projectId: string;\n  status: \"draft\" | \"published\" | \"superseded\";\n  /** The policy document. */\n  policy: PolicyDocument;\n  /** The rules catalogue, when the bundle carries one. */\n  rules?: unknown;\n  createdBy: string;\n  createdAt: string;\n  publishedAt: string | null;\n  supersededAt: string | null;\n  supersededBy: string | null;\n  source: \"rest\" | \"migration\" | \"cli\";\n  editorMode: \"visual\" | \"json\" | \"unspecified\";\n  supersededReason: string | null;\n  /** Id of a queued publish awaiting a second approver, else `null`. */\n  pendingChangeId: string | null;\n};\n\n/** Answer of `publish`: the publish is queued for approval (HTTP 202). */\nexport type PolicyPublishResult = {\n  pendingChangeId: string;\n  bundleId: string;\n  status: \"pending_approval\";\n};\n\n/**\n * The policy document: sections keyed by resource kind (`collections`,\n * `storage`, `tools`, `functions`, `secrets`, `streams`, `analytics`);\n * other keys are allowed.\n */\nexport type PolicyDocument = Record<string, unknown>;\n\nexport type CreatePolicyInput = {\n  policy: PolicyDocument;\n  rules?: unknown;\n  editorMode?: \"visual\" | \"json\" | \"unspecified\" | undefined;\n};\n\nexport type UpdatePolicyInput = {\n  policy: PolicyDocument;\n  rules?: unknown;\n  editorMode?: \"visual\" | \"json\" | \"unspecified\" | undefined;\n};\n\nexport type ValidatePolicyInput = {\n  policy: PolicyDocument;\n  rules?: unknown;\n};\n\n/** Validation failures are errors, so a successful validate always answers `{ valid: true }`. */\nexport type ValidatePolicyResult = {\n  valid: true;\n};\n\n/** Optional publish controls; property names are the gateway's. */\nexport type PublishPolicyOptions = {\n  acknowledgeSelfLockout?: boolean | undefined;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"policies operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makePoliciesNamespace(config: HttpClientConfig) {\n  return {\n    /** Return the currently-active policy for the project. */\n    async current(): Promise<Envelope<PolicyBundle | null>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"policy\"),\n      });\n    },\n\n    /** List all policy bundles (draft + published + superseded). */\n    async list(opts?: { status?: PolicyBundle[\"status\"] | undefined }): Promise<Envelope<ReadonlyArray<PolicyBundle>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"policies\"),\n        query: opts,\n      });\n    },\n\n    /** Create a draft policy bundle. */\n    async create(input: CreatePolicyInput): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"policies\"),\n        body: input,\n      });\n    },\n\n    /** Lint a candidate policy document without persisting. */\n    async validate(input: ValidatePolicyInput): Promise<Envelope<ValidatePolicyResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, \"policies/validate\"),\n        body: input,\n      });\n    },\n\n    /** Get a single bundle by id. */\n    async get(bundleId: string): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n      });\n    },\n\n    /** Replace a draft bundle's policy document. Cannot patch published bundles (publish→republish flow). */\n    async update(bundleId: string, patch: UpdatePolicyInput): Promise<Envelope<PolicyBundle>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n        body: patch,\n      });\n    },\n\n    /** Delete a draft bundle. Cannot delete published bundles. The gateway answers 204 with no body. */\n    async delete(bundleId: string): Promise<Envelope<undefined>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}`),\n      });\n    },\n\n    /**\n     * Publish a draft bundle. The gateway answers 202 with `{ pendingChangeId, bundleId }`: the publish waits for\n     * approval, then the bundle becomes active. Pass `acknowledgeSelfLockout: true` to proceed when the bundle\n     * would remove your own read access to a collection.\n     */\n    async publish(bundleId: string, options?: PublishPolicyOptions): Promise<Envelope<PolicyPublishResult>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `policies/${encodeURIComponent(bundleId)}/publish`),\n        ...(options !== undefined ? { body: options } : {}),\n      });\n    },\n  };\n}\n","/**\n * Audit log query SDK — `client.audit.*`.\n *\n * Backed by the gateway audit-log routes.\n *\n * Wire mapping:\n *   - `query({ eventType, actorId, after, before, limit, cursor })`\n *     → GET /@<slug>/audit-log?...\n *\n * Option names are the gateway's query parameter names. The endpoint\n * accepts cursor-paginated reverse-chronological queries. `eventType` is\n * the audit-event name (e.g. `data.write.access.insert`).\n *\n * Returns audit events with full context payload.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** Audit event record. */\nexport type AuditEvent = {\n  id: string;\n  /** Dotted namespace (e.g. `data.write.access.insert`). */\n  type: string;\n  actorId: string | null;\n  targetKind: string | null;\n  targetId: string | null;\n  payload: Record<string, unknown>;\n  occurredAt: string;\n  requestId: string | null;\n  traceId: string | null;\n};\n\nexport type AuditQueryOpts = {\n  /** Filter by event type. */\n  eventType?: string | undefined;\n  /** Filter by actor. */\n  actorId?: string | undefined;\n  /** ISO 8601 lower bound: only events after this instant. */\n  after?: string | undefined;\n  /** ISO 8601 upper bound: only events before this instant. */\n  before?: string | undefined;\n  /** Page size (per-tier max bounded server-side). */\n  limit?: number | undefined;\n  /** Cursor from prior response. */\n  cursor?: string | undefined;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"audit operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeAuditNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * Query the audit log. Returns reverse-chronological events matching\n     * all supplied filters (AND composition).\n     *\n     * Requires the `AUDIT_READER` role at minimum. This endpoint is\n     * project-scoped.\n     */\n    async query(opts?: AuditQueryOpts): Promise<Envelope<ReadonlyArray<AuditEvent>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"audit-log\"),\n        query: opts,\n      });\n    },\n\n    /**\n     * Convenience: live-tail recent events. Currently single-shot read\n     * with `after` defaulted to \"1 minute ago\".\n     */\n    async tail(opts?: { sinceMinutes?: number; limit?: number }): Promise<Envelope<ReadonlyArray<AuditEvent>>> {\n      const slug = requireProjectSlug(config);\n      const minutes = opts?.sinceMinutes ?? 1;\n      const since = new Date(Date.now() - minutes * 60_000).toISOString();\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, \"audit-log\"),\n        query: { after: since, limit: opts?.limit ?? 100 },\n      });\n    },\n  };\n}\n","/**\n * Org lifecycle SDK — `client.orgs.*`.\n *\n * Backed by the gateway orgs routes.\n *\n * Wire mapping (all org-plane / platform-plane):\n *   - `list()`                    → GET    /orgs\n *   - `get(orgSlug)`              → GET    /orgs/<orgSlug>\n *   - `restore(orgId)`            → POST   /orgs/<orgId>/restore\n *   - `current()`                 → GET    /org\n *\n * The `current()` endpoint returns the org bound to the caller's session\n * context (via `x-k9o-org-slug` header or token claim). `get` addresses an\n * explicit org by its **slug** (slug-first management grammar) for\n * cross-org admin scenarios; most callers reach for `current()`.\n * `restore` is the one exception — it stays keyed by `orgId`, because a\n * soft-deleted org's slug is tombstoned and may have been reassigned.\n *\n *: org listing is scoped by the caller's accessible orgs\n * (most callers see exactly one — their own). Org creation is not available\n * through the SDK yet; `client.orgs.create()` will be added once sign-up\n * is exposed as an API).\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath, validateSlug } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/**\n * Org record, as the gateway returns it. `list` rows add `viaToken` and `consoleDomain`;\n * `get`, `current` and `restore` add `customDomain` and `deletedAt`.\n */\nexport type Org = {\n  /** `org_<base62>`. */\n  id: string;\n  slug: string;\n  displayName: string;\n  products: ReadonlyArray<string>;\n  billingTier: string;\n  signupProduct: string;\n  /** The caller's role in the org. */\n  role: string;\n  createdAt: string;\n  customDomain?: string | null | undefined;\n  deletedAt?: string | null | undefined;\n  /** List rows only: `true` when the org is reached through the token rather than a membership. */\n  viaToken?: boolean | undefined;\n  /** List rows only: the org's Console host. */\n  consoleDomain?: string | undefined;\n};\n\nexport function makeOrgsNamespace(config: HttpClientConfig) {\n  return {\n    /** List orgs accessible to the caller. */\n    async list(): Promise<Envelope<ReadonlyArray<Org>>> {\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(\"orgs\"),\n      });\n    },\n\n    /** Get a single org by slug. */\n    async get(orgSlug: string): Promise<Envelope<Org>> {\n      validateSlug(orgSlug, \"org\");\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(`orgs/${encodeURIComponent(orgSlug)}`),\n      });\n    },\n\n    /** Restore a soft-deleted org. */\n    async restore(orgId: string): Promise<Envelope<Org>> {\n      return request(config, {\n        method: \"POST\",\n        path: orgPath(`orgs/${encodeURIComponent(orgId)}/restore`),\n      });\n    },\n\n    /** Get the org bound to the caller's current session context. */\n    async current(): Promise<Envelope<Org>> {\n      return request(config, {\n        method: \"GET\",\n        path: orgPath(\"org\"),\n      });\n    },\n  };\n}\n","/**\n * Org-plane SDK namespace — `client.org.*`.\n *\n * Covers org members, groups, SMTP, audit and gate administration.\n *\n * Distinct from `client.orgs` (collection-style; list/get/restore/current\n * across accessible orgs) — `client.org` is the singular bound-org\n * namespace with member / group / smtp / audit / gate sub-namespaces.\n *\n * Org-plane URL grammar: requests go to the org's API host (`<orgSlug>.api.<apex>`) WITHOUT the\n * `@<projectSlug>/` prefix used by project-plane requests. The gateway resolves the org context from the host.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport type { LLMModelId } from \"./compute/llms.ts\";\nimport type { Org } from \"./orgs.ts\";\n\n// ----------------------------------------------------------------------\n// Types\n// ----------------------------------------------------------------------\n\nexport type OrgMember = {\n  /** `usr_<base62>`. */\n  userId: string;\n  orgId: string;\n  email: string;\n  displayName: string;\n  /** Org-level role. */\n  role: \"ORG_OWNER\" | \"ORG_ADMIN\" | \"ORG_BILLING_ADMIN\" | \"ORG_MEMBER\";\n  invitedAt: string;\n  /** `null` until the invitation is accepted. */\n  acceptedAt: string | null;\n  status: \"active\" | \"suspended\";\n  /** `invited` until accepted, then the same as `status`. */\n  state: \"invited\" | \"active\" | \"suspended\";\n  suspendedAt: string | null;\n};\n\n/**\n * Answer of `members.invite` when the email has no account yet (HTTP 202): an invitation was created\n * instead of a member. `delivery` says whether the invitation email went out.\n */\nexport type OrgInviteResult = {\n  invitation: { id: string; orgId: string; email: string; role: OrgMember[\"role\"]; expiresAt: string };\n  delivery: \"sent\" | \"not_configured\" | \"failed\";\n};\n\nexport type OrgGroup = {\n  /** `grp_<base62>`. */\n  id: string;\n  orgId: string;\n  name: string;\n  description: string | null;\n  /** Groups come from an identity provider. */\n  source: \"idp\";\n  sourceGroupId: string;\n  createdAt: string;\n};\n\nexport type OrgRoleGrant = {\n  /** `grt_<base62>`. */\n  id: string;\n  userId: string;\n  role: \"ORG_OWNER\" | \"ORG_ADMIN\" | \"ORG_BILLING_ADMIN\" | \"ORG_AUDITOR\" | \"ORG_MEMBER\";\n  grantedBy: string;\n  grantedAt: string;\n  revokedAt: string | null;\n  revokedBy: string | null;\n  viaDelegationId: string | null;\n};\n\n/**\n * Org-level audit event: member invited or removed, role granted or revoked, identity provider\n * or settings changed.\n */\nexport type OrgAuditEvent = {\n  id: string;\n  type: string;\n  actorId: string | null;\n  targetKind: string | null;\n  targetId: string | null;\n  payload: Record<string, unknown>;\n  createdAt: string;\n  requestId: string | null;\n  traceId: string | null;\n};\n\n/**\n * Org SMTP configuration, as the gateway takes it in the `smtpConfig` field of PATCH /org.\n * The password is never sent: `passwordRef` is a reference to a stored secret.\n */\nexport type SmtpConfig = {\n  host: string;\n  port: number;\n  username: string;\n  /** Reference to the stored SMTP password; opaque token. */\n  passwordRef: string;\n  fromAddress: string;\n  fromName?: string | undefined;\n};\n\nexport type SmtpTestEmailInput = {\n  to: string;\n  subject?: string | undefined;\n};\n\nexport type SmtpTestEmailResult = {\n  accepted: boolean;\n  /** Which SMTP configuration serves the org: `org` when it has its own, else `platform`. */\n  resolvedTier: \"org\" | \"platform\";\n  to: string;\n  /** `true` while the gateway does not send the message itself. */\n  dryRun: boolean;\n};\n\nexport type OrgDefaultLlm = {\n  orgId: string;\n  defaultModelId: string;\n  updatedAt: string;\n  updatedBy: string | null;\n};\n\nexport type OrgIdpProviderKind =\n  | \"google\" | \"github\" | \"microsoft\" | \"oidc\" | \"saml\" | \"scim\" | \"ldap\" | \"active_directory\" | \"apple\" | \"facebook\" | \"twitter\";\n\nexport type OrgIdpProvider = {\n  id: string;\n  idpProvider: OrgIdpProviderKind;\n  displayName: string;\n  clientId: string;\n  enabled: boolean;\n  createdAt: string;\n};\n\n/** Body of POST /identity-providers. `clientSecretRef` is a reference to a stored secret, never the secret itself. */\nexport type CreateOrgIdpInput = {\n  idpProvider: OrgIdpProviderKind;\n  displayName: string;\n  clientId: string;\n  clientSecretRef: string;\n  tierGating: \"free_tier_ok\" | \"ridge_plus\";\n  redirectUri?: string | undefined;\n  metadataUrl?: string | null | undefined;\n  attributeMap?: Record<string, unknown> | undefined;\n  enabled?: boolean | undefined;\n};\n\n/** Body of PATCH /identity-providers/<id>. */\nexport type UpdateOrgIdpInput = {\n  displayName?: string | undefined;\n  clientId?: string | undefined;\n  clientSecretRef?: string | undefined;\n  redirectUri?: string | undefined;\n  metadataUrl?: string | null | undefined;\n  attributeMap?: Record<string, unknown> | undefined;\n  enabled?: boolean | undefined;\n};\n\n// ----------------------------------------------------------------------\n// Sub-namespace factories\n// ----------------------------------------------------------------------\n\nfunction makeMembersNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /members (org-plane LIST). The route is not paged; it filters by userId, role, acceptanceStatus, status and state. */\n    async list(opts?: {\n      userId?: string | undefined; role?: OrgMember[\"role\"] | undefined;\n      acceptanceStatus?: \"accepted\" | \"pending\" | undefined; status?: \"active\" | \"suspended\" | undefined; state?: string | undefined;\n    }): Promise<Envelope<ReadonlyArray<OrgMember>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"members\"), query: opts });\n    },\n\n    /**\n     * POST /members — add a member by email. An existing user becomes a member at once (201, the member row);\n     * an unknown email gets an invitation (202, `{ invitation, delivery }`).\n     */\n    async invite(input: { email: string; role: OrgMember[\"role\"] }): Promise<Envelope<OrgMember | OrgInviteResult>> {\n      return request(config, { method: \"POST\", path: orgPath(\"members\"), body: input });\n    },\n\n    /** DELETE /members/<userId> — remove a member from the org. The gateway answers 204 with no body. */\n    async remove(userId: string): Promise<Envelope<undefined>> {\n      return request(config, { method: \"DELETE\", path: orgPath(`members/${encodeURIComponent(userId)}`) });\n    },\n  };\n}\n\nfunction makeGroupsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /groups (org-plane LIST). */\n    async list(opts?: { userId?: string | undefined }): Promise<Envelope<ReadonlyArray<OrgGroup>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"groups\"), query: opts });\n    },\n\n    /** GET /groups/<groupId> — single-read. */\n    async get(groupId: string): Promise<Envelope<OrgGroup>> {\n      return request(config, { method: \"GET\", path: orgPath(`groups/${encodeURIComponent(groupId)}`) });\n    },\n\n  };\n}\n\nfunction makeOrgAuditLogNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * GET /audit-log (org-plane), newest first. The route reads `type` and `limit` (1 to 500, default 100) only.\n     * Distinct from project-plane `client.audit.query()` which routes to `@<projectSlug>/audit-log`.\n     */\n    async query(opts?: { type?: string | undefined; limit?: number | undefined }): Promise<Envelope<ReadonlyArray<OrgAuditEvent>>> {\n      return request(config, { method: \"GET\", path: orgPath(\"audit-log\"), query: opts });\n    },\n  };\n}\n\nfunction makeOrgGateNamespace(config: HttpClientConfig) {\n  return {\n    roles: {\n      /** GET /role-grants — list role grants. */\n      async list(): Promise<Envelope<ReadonlyArray<OrgRoleGrant>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"role-grants\") });\n      },\n\n      /** POST /role-grants — grant an org role. */\n      async grant(input: { userId: string; role: OrgRoleGrant[\"role\"]; decisionReason?: string | undefined }): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"POST\", path: orgPath(\"role-grants\"), body: input });\n      },\n\n      /** GET /role-grants/<grantId> — single-read. */\n      async get(grantId: string): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"GET\", path: orgPath(`role-grants/${encodeURIComponent(grantId)}`) });\n      },\n\n      /** DELETE /role-grants/<grantId> — revoke a grant (soft delete; sets revokedAt). */\n      async revoke(grantId: string, opts?: { decisionReason?: string | undefined }): Promise<Envelope<OrgRoleGrant>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`role-grants/${encodeURIComponent(grantId)}`), ...(opts ? { body: opts } : {}) });\n      },\n    },\n\n    idpProviders: {\n      /** GET /identity-providers — list configured identity providers. */\n      async list(): Promise<Envelope<ReadonlyArray<OrgIdpProvider>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"identity-providers\") });\n      },\n\n      /** POST /identity-providers — create a new IdP integration. */\n      async create(input: CreateOrgIdpInput): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"POST\", path: orgPath(\"identity-providers\"), body: input });\n      },\n\n      /** GET /identity-providers/<idpId>. */\n      async get(idpId: string): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"GET\", path: orgPath(`identity-providers/${encodeURIComponent(idpId)}`) });\n      },\n\n      /** PATCH /identity-providers/<idpId> — update settings or enable/disable. */\n      async configure(idpId: string, patch: UpdateOrgIdpInput): Promise<Envelope<OrgIdpProvider>> {\n        return request(config, { method: \"PATCH\", path: orgPath(`identity-providers/${encodeURIComponent(idpId)}`), body: patch });\n      },\n\n      /** DELETE /identity-providers/<idpId>. */\n      async delete(idpId: string): Promise<Envelope<{ deleted: boolean }>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`identity-providers/${encodeURIComponent(idpId)}`) });\n      },\n    },\n  };\n}\n\nfunction makeSmtpNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * PATCH /org with `smtpConfig` body — set or update SMTP. Answers the org record.\n     * The body carries `passwordRef` (a reference to the stored password), not the password.\n     */\n    async set(config_: SmtpConfig): Promise<Envelope<Org>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"org\"), body: { smtpConfig: config_ } });\n    },\n\n    /**\n     * POST /org/smtp/test-email — send a diagnostic email to verify config.\n     * 5/hour rate limit; RFC 5322 validation;\n     * 3-tier resolution (platform→org→project) of effective SMTP.\n     */\n    async test(input: SmtpTestEmailInput): Promise<Envelope<SmtpTestEmailResult>> {\n      return request(config, { method: \"POST\", path: orgPath(\"org/smtp/test-email\"), body: input });\n    },\n\n    /** PATCH /org with `smtpConfig: null` — clear org-level SMTP. Answers the org record. */\n    async unset(): Promise<Envelope<Org>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"org\"), body: { smtpConfig: null } });\n    },\n  };\n}\n\nfunction makeDefaultLlmNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * GET /default-llm — read the org-default LLM model id.\n     * Any accepted member of the org may read it.\n     */\n    async get(): Promise<Envelope<OrgDefaultLlm>> {\n      return request(config, { method: \"GET\", path: orgPath(\"default-llm\") });\n    },\n\n    /**\n     * PATCH /default-llm — set the org-default LLM.\n     * ORG_ADMIN or ORG_OWNER only. The model must be available to the org's tier\n     * or the gateway returns K9O_TIER_FEATURE_GATED.\n     */\n    async set(input: { modelId: LLMModelId }): Promise<Envelope<{ orgId: string; defaultModelId: string }>> {\n      return request(config, { method: \"PATCH\", path: orgPath(\"default-llm\"), body: input });\n    },\n  };\n}\n\n// ----------------------------------------------------------------------\n// Top-level namespace\n// ----------------------------------------------------------------------\n\nexport function makeOrgNamespace(config: HttpClientConfig) {\n  return {\n    /** Member lifecycle — list / invite / remove. */\n    members: makeMembersNamespace(config),\n    /** Groups — list / get (read-only). */\n    groups: makeGroupsNamespace(config),\n    /** Org-plane audit log — query. Distinct from project-plane `client.audit`. */\n    auditLog: makeOrgAuditLogNamespace(config),\n    /** Gate (IAK) org-level surfaces — role-grants + IdP-providers. */\n    gate: makeOrgGateNamespace(config),\n    /** Org-level SMTP config — set / test / unset. */\n    smtp: makeSmtpNamespace(config),\n    /** Org-default LLM — get / set (ORG_ADMIN). */\n    defaultLLM: makeDefaultLlmNamespace(config),\n\n    /**\n     * GET /org — read the current org (slug, displayName, products, billing tier, your role).\n     * Mirrors `client.orgs.current()` for symmetry; `client.org.get()` is\n     * the singular-namespace convention for use within an org-bound client.\n     */\n    async get(): Promise<Envelope<Org>> {\n      return request(config, { method: \"GET\", path: orgPath(\"org\") });\n    },\n  };\n}\n","/**\n * Operator-self SDK namespace — `client.me.*`.\n *\n * Distinct from tenant-\n * scoped surfaces: `/me/*` is the operator-self lane that does NOT\n * require org or project context.\n *\n * Wire mapping (gateway uses platform-plane / cross-org `/me/...` routes):\n *   - `client.me.profile.get/update` → GET/PATCH /me\n *   - `client.me.sessions.list` → GET /me/sessions\n *   - `client.me.sessions.revoke` → POST /auth/sessions/<sessionId>/revoke\n *   - `client.me.sessions.revokeAll` → POST /me/sessions/revoke-all\n *   - `client.me.apiTokens.list/create/delete` → GET/POST/DELETE /me/api-tokens\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { orgPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\nexport type MyProfile = {\n  /** `usr_<base62>`. */\n  id: string;\n  email: string;\n  displayName: string;\n  mfaEnabled: boolean;\n  verifiedAt: string | null;\n  /** Set while the account is in its deletion grace period. */\n  deletedAt: string | null;\n  deletionRequestedAt: string | null;\n  deletionScheduledFor: string | null;\n  avatarUrl: string | null;\n  /** BCP 47 language tag, or `null` when unset. */\n  locale: string | null;\n  /** IANA time zone name, or `null` when unset. */\n  timezone: string | null;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601. */\n  updatedAt: string;\n};\n\nexport type MySession = {\n  /** `sess_<base62>`. */\n  id: string;\n  userId: string;\n  /** Sign-in time. */\n  issuedAt: string;\n  expiresAt: string;\n  revokedAt: string | null;\n  mfaVerifiedAt: string | null;\n  userAgent: string | null;\n  ipAddress: string | null;\n  /** Always `null` for now. */\n  geoCountry: string | null;\n  /** Whether this session is the one issuing the current request. */\n  isCurrentSession: boolean;\n};\n\n/** Fields `profile.update` may change; `null` clears `locale` and `timezone`. */\nexport type UpdateMyProfileInput = {\n  displayName?: string | undefined;\n  /** BCP 47 language tag, for example `de-DE`. */\n  locale?: string | null | undefined;\n  /** IANA time zone name, for example `Europe/Berlin`. */\n  timezone?: string | null | undefined;\n};\n\nexport type MyApiToken = {\n  /** `pat_<base62>`. */\n  id: string;\n  userId: string;\n  orgId: string;\n  label: string;\n  scopeManifest: CreateMyApiTokenInput[\"scopeManifest\"];\n  ttlSeconds: number;\n  /** ISO 8601. */\n  createdAt: string;\n  /** ISO 8601. */\n  expiresAt: string;\n  lastUsedAt: string | null;\n  revokedReason: string | null;\n  status: \"active\" | \"revoked\" | \"expired\";\n};\n\n/** Body of POST /me/api-tokens. Each `scopeManifest` field narrows the token; `null` or absent leaves it unrestricted. */\nexport type CreateMyApiTokenInput = {\n  label: string;\n  scopeManifest: {\n    operations?: ReadonlyArray<\"read\" | \"write\" | \"admin\"> | null | undefined;\n    projects?: ReadonlyArray<string> | null | undefined;\n    resourceClasses?: ReadonlyArray<string> | null | undefined;\n    collections?: Record<string, unknown> | null | undefined;\n    cidrs?: ReadonlyArray<string> | null | undefined;\n  };\n  /** Token lifetime in seconds (60 to 31536000). */\n  ttlSeconds?: number | undefined;\n};\n\nexport function makeMeNamespace(config: HttpClientConfig) {\n  return {\n    profile: {\n      /** GET /me — operator profile (cross-org). */\n      async get(): Promise<Envelope<MyProfile>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me\") });\n      },\n\n      /** PATCH /me — update mutable profile fields (displayName, locale, timezone). */\n      async update(patch: UpdateMyProfileInput): Promise<Envelope<MyProfile>> {\n        return request(config, { method: \"PATCH\", path: orgPath(\"me\"), body: patch });\n      },\n    },\n\n    sessions: {\n      /** GET /me/sessions — list active sessions for the operator. */\n      async list(): Promise<Envelope<ReadonlyArray<MySession>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/sessions\") });\n      },\n\n      /** POST /auth/sessions/<sessionId>/revoke — revoke a specific session. */\n      async revoke(sessionId: string): Promise<Envelope<{ revoked: boolean }>> {\n        return request(config, { method: \"POST\", path: orgPath(`auth/sessions/${encodeURIComponent(sessionId)}/revoke`) });\n      },\n\n      /** POST /me/sessions/revoke-all — revoke all of the operator's sessions except the current one. */\n      async revokeAll(): Promise<Envelope<{ revoked: number }>> {\n        return request(config, { method: \"POST\", path: orgPath(\"me/sessions/revoke-all\") });\n      },\n    },\n\n    /** Personal access tokens for scripting. */\n    apiTokens: {\n      async list(): Promise<Envelope<ReadonlyArray<MyApiToken>>> {\n        return request(config, { method: \"GET\", path: orgPath(\"me/api-tokens\") });\n      },\n\n      async create(input: CreateMyApiTokenInput): Promise<Envelope<MyApiToken & { plaintext: string }>> {\n        return request(config, { method: \"POST\", path: orgPath(\"me/api-tokens\"), body: input });\n      },\n\n      async delete(tokenId: string): Promise<Envelope<MyApiToken>> {\n        return request(config, { method: \"DELETE\", path: orgPath(`me/api-tokens/${encodeURIComponent(tokenId)}`) });\n      },\n    },\n  };\n}\n","/**\n * Studio Workflows SDK — `client.studio.workflows.*`.\n *\n * Workflows substrate. Mirrors\n * `_sys.workflows` + `_sys.workflow_runs` row shapes.\n *\n * Wire mapping (project-plane):\n *   - list()                       → GET    /@<slug>/workflows\n *   - create(workflow)             → POST   /@<slug>/workflows\n *   - read(id)                     → GET    /@<slug>/workflows/<wfl-id>\n *   - update(id, updates)          → PATCH  /@<slug>/workflows/<wfl-id>\n *   - delete(id)                   → DELETE /@<slug>/workflows/<wfl-id>\n *   - trigger(id, triggerContext)  → POST   /@<slug>/workflows/<wfl-id>/runs\n *   - runs.list(id)                → GET    /@<slug>/workflows/<wfl-id>/runs\n *   - runs.read(id, runId)         → GET    /@<slug>/workflows/<wfl-id>/runs/<wfr-id>\n *   - runs.cancel(id, runId)       → POST   /@<slug>/workflows/<wfl-id>/runs/<wfr-id>/cancel\n *\n * RBAC: create/update/delete/trigger/cancel require\n * PROJECT_AUTHOR; list/read/runs read against all cohort roles subject\n * to RLS. Surfaces 6 K9O_WORKFLOW_* error codes (see\n * `WORKFLOW_ERROR_CODES`); callers narrow on `error.code`.\n */\n\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\n\n// ----------------------------------------------------------------------\n// Enums (closed set)\n// ----------------------------------------------------------------------\n\n/** 5-trigger catalogue. */\nexport type WorkflowTriggerType =\n  | \"view_row_event\"\n  | \"form_submission\"\n  | \"scheduled\"\n  | \"manual\"\n  | \"webhook\";\n\n/** 9-action catalogue. */\nexport type WorkflowActionType =\n  | \"write_collection\"\n  | \"read_collection\"\n  | \"invoke_function\"\n  | \"invoke_extension\"\n  | \"llm_inference\"\n  | \"send_notification\"\n  | \"http_request\"\n  | \"approval_step\"\n  | \"branch\";\n\nexport type WorkflowStatus = \"active\" | \"archived\" | \"draft\";\n\nexport type WorkflowRunStatus =\n  | \"pending\"\n  | \"running\"\n  | \"succeeded\"\n  | \"failed\"\n  | \"cancelled\";\n\n/** A single step in the `actions` chain. */\nexport type WorkflowAction = {\n  index: number;\n  action_type: WorkflowActionType;\n  config: Record<string, unknown>;\n  retry?: { maxAttempts: number; backoffStrategy?: string };\n  condition?: Record<string, unknown>;\n  /** Sibling steps with parallel:true execute concurrently. */\n  parallel?: boolean;\n};\n\n// ----------------------------------------------------------------------\n// Resource shapes (mirror _sys.workflows + _sys.workflow_runs rows)\n// ----------------------------------------------------------------------\n\n/** Workflow record. */\nexport type Workflow = {\n  /** `wfl_<base62>`. */\n  id: string;\n  projectId: string;\n  name: string;\n  description: string;\n  status: WorkflowStatus;\n  triggerType: WorkflowTriggerType;\n  /** Shape varies per triggerType. */\n  triggerConfig: Record<string, unknown>;\n  /** Chain definition. */\n  actions: ReadonlyArray<WorkflowAction>;\n  /** Approver-step participant resolution. */\n  rbacBinding: Record<string, unknown>;\n  authoredBy: string;\n  authoredAt: string;\n  updatedBy: string;\n  updatedAt: string;\n};\n\n/** Per-step status entry in a run `per_step_status`. */\nexport type WorkflowRunStep = {\n  stepIndex: number;\n  actionType: WorkflowActionType;\n  status: \"running\" | \"succeeded\" | \"failed\" | \"awaiting_approval\";\n  startedAt: string;\n  completedAt?: string | null;\n  error?: Record<string, unknown> | null;\n  outputSummary?: unknown;\n  costSubtotal?: number;\n};\n\n/** Workflow run record. */\nexport type WorkflowRun = {\n  /** `wfr_<base62>`. */\n  id: string;\n  workflowId: string;\n  projectId: string;\n  status: WorkflowRunStatus;\n  triggerContext: Record<string, unknown>;\n  perStepStatus: ReadonlyArray<WorkflowRunStep>;\n  costAccountingTotal: number;\n  errorContext?: Record<string, unknown> | null;\n  startedAt: string;\n  completedAt: string | null;\n  firedBy: string;\n};\n\n/** Create input — omits server-assigned fields. */\nexport type CreateWorkflowInput = {\n  name: string;\n  description?: string;\n  status?: WorkflowStatus;\n  triggerType: WorkflowTriggerType;\n  triggerConfig: Record<string, unknown>;\n  actions: ReadonlyArray<WorkflowAction>;\n  rbacBinding?: Record<string, unknown>;\n};\n\nexport type UpdateWorkflowInput = Partial<\n  Pick<\n    CreateWorkflowInput,\n    \"name\" | \"description\" | \"status\" | \"triggerType\" | \"triggerConfig\" | \"actions\" | \"rbacBinding\"\n  >\n>;\n\nexport type WorkflowListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: WorkflowStatus;\n  triggerType?: WorkflowTriggerType;\n};\n\nexport type WorkflowRunListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: WorkflowRunStatus;\n};\n\n/**\n * 6 K9O_WORKFLOW_* error codes. KError code-space is\n * open; these constants document the well-known codes for narrowing\n * (`if (e.code === WORKFLOW_ERROR_CODES.RUN_NOT_CANCELLABLE)`).\n */\nexport const WORKFLOW_ERROR_CODES = {\n  NOT_FOUND: \"K9O_WORKFLOW_NOT_FOUND\",\n  TRIGGER_INVALID: \"K9O_WORKFLOW_TRIGGER_INVALID\",\n  ACTION_INVALID: \"K9O_WORKFLOW_ACTION_INVALID\",\n  RUN_NOT_FOUND: \"K9O_WORKFLOW_RUN_NOT_FOUND\",\n  RUN_NOT_CANCELLABLE: \"K9O_WORKFLOW_RUN_NOT_CANCELLABLE\",\n  WEBHOOK_SIGNATURE_INVALID: \"K9O_WORKFLOW_WEBHOOK_SIGNATURE_INVALID\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"studio.workflows operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nfunction makeRunsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/workflows/<wfl-id>/runs — cursor-paginated runs list. */\n    async list(workflowId: string, filters?: WorkflowRunListFilters): Promise<Envelope<ReadonlyArray<WorkflowRun>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs`),\n        query: filters,\n      });\n    },\n\n    /** GET /@<slug>/workflows/<wfl-id>/runs/<wfr-id> — run detail (per-step + cost). */\n    async read(workflowId: string, runId: string): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}`),\n      });\n    },\n\n    /** POST /@<slug>/workflows/<wfl-id>/runs/<wfr-id>/cancel — cancel pending or running run. */\n    async cancel(workflowId: string, runId: string): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/cancel`),\n      });\n    },\n  };\n}\n\nexport function makeWorkflowsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/workflows — list workflows (cursor pagination). */\n    async list(filters?: WorkflowListFilters): Promise<Envelope<ReadonlyArray<Workflow>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"workflows\"), query: filters });\n    },\n\n    /** POST /@<slug>/workflows — create a workflow. Requires PROJECT_AUTHOR. */\n    async create(workflow: CreateWorkflowInput): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"POST\", path: projectPath(slug, \"workflows\"), body: workflow });\n    },\n\n    /** GET /@<slug>/workflows/<wfl-id> — read a workflow. */\n    async read(workflowId: string): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n      });\n    },\n\n    /** PATCH /@<slug>/workflows/<wfl-id> — update a workflow. Requires PROJECT_AUTHOR. */\n    async update(workflowId: string, updates: UpdateWorkflowInput): Promise<Envelope<Workflow>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n        body: updates,\n      });\n    },\n\n    /** DELETE /@<slug>/workflows/<wfl-id> — delete a workflow. Requires PROJECT_AUTHOR. */\n    async delete(workflowId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}`),\n      });\n    },\n\n    /**\n     * POST /@<slug>/workflows/<wfl-id>/runs — manual-trigger a run.\n     * Valid only for `triggerType: 'manual'` workflows.\n     * Requires PROJECT_AUTHOR. The argument is sent as `{ triggerContext }`. Returns the materialised WorkflowRun.\n     */\n    async trigger(workflowId: string, triggerContext: Record<string, unknown> = {}): Promise<Envelope<WorkflowRun>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `workflows/${encodeURIComponent(workflowId)}/runs`),\n        body: { triggerContext },\n      });\n    },\n\n    /** Run sub-namespace — list / read / cancel runs of a workflow. */\n    runs: makeRunsNamespace(config),\n  };\n}\n","/**\n * Studio Dashboards SDK — `client.studio.dashboards.*`.\n *\n * Dashboards persisted authoring substrate.\n * Mirrors `_sys.dashboards` row shape.\n *\n * Wire mapping (project-plane;):\n *   - list()                  → GET    /@<slug>/dashboards\n *   - create(dashboard)       → POST   /@<slug>/dashboards\n *   - read(id)                → GET    /@<slug>/dashboards/<dsh-id>\n *   - update(id, updates)     → PATCH  /@<slug>/dashboards/<dsh-id>\n *   - delete(id)              → DELETE /@<slug>/dashboards/<dsh-id>\n *   - pin(id)                 → POST   /@<slug>/dashboards/<dsh-id>/pin\n *   - unpin(id)               → POST   /@<slug>/dashboards/<dsh-id>/unpin\n *\n * Per RBAC: create/update/delete/pin/unpin require\n * PROJECT_AUTHOR; list/read read against all cohort roles subject\n * to RLS. Per, surfaces 2 K9O_DASHBOARD_* codes.\n */\n\nimport { request, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\n\n// ----------------------------------------------------------------------\n// Enums (closed at v2 launch +)\n// ----------------------------------------------------------------------\n\n/** 9-widget catalogue. */\nexport type WidgetType =\n  | \"kpi_card\"\n  | \"bar_chart\"\n  | \"line_chart\"\n  | \"pie_chart\"\n  | \"data_table\"\n  | \"filter_dropdown\"\n  | \"filter_date_range\"\n  | \"text_panel\"\n  | \"workflow_status\";\n\n/** Widget data source modes. */\nexport type WidgetDataSourceMode = \"view\" | \"query\" | \"workflow\" | \"rollup\" | \"form\";\n\nexport type DashboardStatus = \"active\" | \"archived\" | \"draft\";\n\n/** A widget config entry in the `widgets` array. */\nexport type Widget = {\n  id: string;\n  widgetType: WidgetType;\n  title?: string;\n  dataSource: {\n    mode: WidgetDataSourceMode;\n    /** Resolved per mode: viewId / queryId / workflowId / rollupSlug / formId. */\n    config: Record<string, unknown>;\n  };\n  /** Widget-local config (display options, thresholds, etc.). */\n  config?: Record<string, unknown>;\n};\n\n// ----------------------------------------------------------------------\n// Resource shapes (mirror _sys.dashboards row)\n// ----------------------------------------------------------------------\n\n/** Dashboard record `_sys.dashboards` row. */\nexport type Dashboard = {\n  /** `dsh_<base62>`. */\n  id: string;\n  projectId: string;\n  name: string;\n  description: string;\n  status: DashboardStatus;\n  /** Widget positions + sizes per output-03 layout schema. */\n  layoutGrid: Record<string, unknown>;\n  widgets: ReadonlyArray<Widget>;\n  /** Dashboard-level filter widgets cascade to per-widget data sources. */\n  filterConfig: Record<string, unknown>;\n  /** Pathmaker org-pin per output-03; surfaces in Workspace sidebar. */\n  pinnedToWorkspace: boolean;\n  rbacBinding: Record<string, unknown>;\n  authoredBy: string;\n  authoredAt: string;\n  updatedBy: string;\n  updatedAt: string;\n};\n\nexport type CreateDashboardInput = {\n  name: string;\n  description?: string;\n  status?: DashboardStatus;\n  layoutGrid?: Record<string, unknown>;\n  widgets?: ReadonlyArray<Widget>;\n  filterConfig?: Record<string, unknown>;\n  rbacBinding?: Record<string, unknown>;\n};\n\nexport type UpdateDashboardInput = Partial<CreateDashboardInput>;\n\nexport type DashboardListFilters = {\n  limit?: number;\n  cursor?: string;\n  status?: DashboardStatus;\n  pinnedToWorkspace?: boolean;\n};\n\n/** 2 K9O_DASHBOARD_* error codes. */\nexport const DASHBOARD_ERROR_CODES = {\n  NOT_FOUND: \"K9O_DASHBOARD_NOT_FOUND\",\n  WIDGET_INVALID: \"K9O_DASHBOARD_WIDGET_INVALID\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"studio.dashboards operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeDashboardsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/dashboards — list dashboards (cursor pagination). */\n    async list(filters?: DashboardListFilters): Promise<Envelope<ReadonlyArray<Dashboard>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"dashboards\"), query: filters });\n    },\n\n    /** POST /@<slug>/dashboards — create a dashboard. Requires PROJECT_AUTHOR. */\n    async create(dashboard: CreateDashboardInput): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"POST\", path: projectPath(slug, \"dashboards\"), body: dashboard });\n    },\n\n    /** GET /@<slug>/dashboards/<dsh-id> — read a dashboard. */\n    async read(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n      });\n    },\n\n    /** PATCH /@<slug>/dashboards/<dsh-id> — update a dashboard. Requires PROJECT_AUTHOR. */\n    async update(dashboardId: string, updates: UpdateDashboardInput): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"PATCH\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n        body: updates,\n      });\n    },\n\n    /** DELETE /@<slug>/dashboards/<dsh-id> — delete a dashboard. Requires PROJECT_AUTHOR. */\n    async delete(dashboardId: string): Promise<Envelope<{ deleted: boolean }>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"DELETE\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}`),\n      });\n    },\n\n    /** POST /@<slug>/dashboards/<dsh-id>/pin — pin to Workspace sidebar. Requires PROJECT_AUTHOR. */\n    async pin(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}/pin`),\n      });\n    },\n\n    /** POST /@<slug>/dashboards/<dsh-id>/unpin — unpin. Requires PROJECT_AUTHOR. */\n    async unpin(dashboardId: string): Promise<Envelope<Dashboard>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `dashboards/${encodeURIComponent(dashboardId)}/unpin`),\n      });\n    },\n  };\n}\n","/**\n * Studio namespace — `client.studio.*`.\n *\n * Groups the Pathmaker-authored Studio surfaces: dashboards and workflows.\n */\n\nimport type { HttpClientConfig } from \"../http.ts\";\nimport { makeWorkflowsNamespace } from \"./workflows.ts\";\nimport { makeDashboardsNamespace } from \"./dashboards.ts\";\n\nexport function makeStudioNamespace(config: HttpClientConfig) {\n  return {\n    /** Workflow lifecycle + runs — `client.studio.workflows.*`. */\n    workflows: makeWorkflowsNamespace(config),\n    /** Dashboard lifecycle + widget data — `client.studio.dashboards.*`. */\n    dashboards: makeDashboardsNamespace(config),\n  };\n}\n","/**\n * Minimal SSE (Server-Sent Events) stream parser — internal.\n *\n * Used by:\n *   - `client.compute.llms.invokeStream()` (`/invoke-stream`)\n *   - `client.realtime.subscribe()` SSE transport fallback\n *\n * Parses an SSE byte stream (a `ReadableStream<Uint8Array>` from a fetch\n * `Response.body`) into an async iterable of parsed `data:` payloads.\n * Each event's `data:` field is JSON-parsed; events whose data is the\n * sentinel `[DONE]` terminate the stream (OpenAI-compatible convention,\n * matched by the gateway's streaming surfaces).\n *\n * Per the SDK-abstracted-primitive discipline\n * (`feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`),\n * transport mechanics stay internal; consumers see a clean async iterable.\n */\n\n/**\n * Parse an SSE stream into an async iterable of JSON-decoded `data:`\n * payloads. Multi-line `data:` fields are concatenated with `\\n` per the\n * SSE spec; the assembled payload is `JSON.parse`d. Non-JSON payloads\n * yield the raw string.\n */\nexport async function* parseSseStream<T>(\n  body: ReadableStream<Uint8Array>,\n): AsyncGenerator<T, void, void> {\n  const reader = body.getReader();\n  const decoder = new TextDecoder();\n  let buffer = \"\";\n\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      buffer += decoder.decode(value, { stream: true });\n\n      // Events are separated by a blank line (\\n\\n). Process complete events.\n      let sepIndex: number;\n      while ((sepIndex = indexOfEventBoundary(buffer)) !== -1) {\n        const rawEvent = buffer.slice(0, sepIndex);\n        buffer = buffer.slice(sepIndex).replace(/^(\\r?\\n)+/, \"\");\n        const payload = extractData(rawEvent);\n        if (payload === null) continue;\n        if (payload === \"[DONE]\") return;\n        yield decodePayload<T>(payload);\n      }\n    }\n\n    // Flush any trailing event without a terminating blank line.\n    const tail = buffer.trim();\n    if (tail.length > 0) {\n      const payload = extractData(tail);\n      if (payload !== null && payload !== \"[DONE]\") {\n        yield decodePayload<T>(payload);\n      }\n    }\n  } finally {\n    reader.releaseLock();\n  }\n}\n\nfunction indexOfEventBoundary(buffer: string): number {\n  const lf = buffer.indexOf(\"\\n\\n\");\n  const crlf = buffer.indexOf(\"\\r\\n\\r\\n\");\n  if (lf === -1) return crlf;\n  if (crlf === -1) return lf;\n  return Math.min(lf, crlf);\n}\n\n/** Extract + concatenate `data:` lines from a single raw SSE event block. */\nfunction extractData(rawEvent: string): string | null {\n  const lines = rawEvent.split(/\\r?\\n/);\n  const dataLines: string[] = [];\n  for (const line of lines) {\n    if (line.startsWith(\":\")) continue; // comment / heartbeat\n    if (line.startsWith(\"data:\")) {\n      dataLines.push(line.slice(5).replace(/^ /, \"\"));\n    }\n  }\n  if (dataLines.length === 0) return null;\n  return dataLines.join(\"\\n\");\n}\n\nfunction decodePayload<T>(payload: string): T {\n  try {\n    return JSON.parse(payload) as T;\n  } catch {\n    return payload as unknown as T;\n  }\n}\n","/**\n * Compute LLMs SDK — `client.compute.llms.*`.\n *\n * Compute LLMs registry: a curated model library, four endpoints and\n * per-model tier gating.\n *\n * Wire mapping (project-plane):\n *   - list()                    → GET  /@<slug>/compute/llms\n *   - read(modelId)             → GET  /@<slug>/compute/llms/<model-id>\n *   - invoke(modelId, ...)      → POST /@<slug>/compute/llms/<model-id>/invoke\n *   - invokeStream(modelId,...) → POST /@<slug>/compute/llms/<model-id>/invoke-stream (SSE)\n *\n * RBAC: list/read against all cohort roles; invoke + invokeStream require\n * PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate). External-provider models\n * answer 501 `K9O_NOT_IMPLEMENTED` until the provider client is built.\n * Surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503), K9O_MODEL_NOT_DECLARED and\n * K9O_TIER_FEATURE_GATED.\n */\n\nimport { request, requestStream, type HttpClientConfig } from \"../http.ts\";\nimport { projectPath } from \"../url-grammar.ts\";\nimport type { Envelope } from \"../envelope.ts\";\nimport { parseSseStream } from \"../internal/sse.ts\";\n\n/** Curated model ids. */\nexport type LLMModelId =\n  | \"mistral-7b\"\n  | \"mistral-8x7b\"\n  | \"llama-3-8b\"\n  | \"llama-3-70b\"\n  | \"claude-3-5-sonnet\"\n  | \"gpt-4o\"\n  | \"gpt-4o-mini\"\n  | \"text-embedding-3-small\"\n  | \"text-embedding-3-large\";\n\nexport type LLMProviderClass = \"self-hosted\" | \"external\";\nexport type LLMModality = \"text-completion\" | \"text-completion+tool-use\" | \"embeddings\";\n\n/** Model metadata with per-model cost. */\nexport type LLMModel = {\n  id: LLMModelId;\n  providerClass: LLMProviderClass;\n  modality: LLMModality;\n  /** Minimum tier gate (e.g. \"base-camp\", \"ascent\", \"ridge\"). */\n  tierGate: string;\n  contextWindow: number;\n  capabilities: ReadonlyArray<string>;\n  /** Per-model token cost. */\n  costPerMillionInputTokens: number;\n  costPerMillionOutputTokens: number;\n};\n\n/** Inference parameters the route reads; sent flat in the request body. */\nexport type LLMInvokeParams = {\n  /** 1 to 32000. */\n  maxTokens?: number;\n  /** 0 to 2. */\n  temperature?: number;\n  /** Free-form usage label recorded with the call. */\n  usageType?: string;\n};\n\n/** Token counts the model server reported for a call. */\nexport type LLMUsage = {\n  promptTokens: number;\n  completionTokens: number;\n  totalTokens: number;\n};\n\n/** Synchronous inference response from `/invoke`. */\nexport type LLMResponse = {\n  modelId: string;\n  /** The generated text. */\n  content: string;\n  finishReason: string | null;\n  usage: LLMUsage;\n  usageType: string;\n};\n\n/**\n * One chunk of the `/invoke-stream` response: the model server's OpenAI-style\n * chat-completion chunk, passed through unchanged. Read incremental text from\n * `choices[0].delta.content`; the final chunk may carry `usage`.\n */\nexport type LLMStreamChunk = {\n  id?: string;\n  object?: string;\n  model?: string;\n  choices?: ReadonlyArray<{\n    index?: number;\n    delta?: { role?: string; content?: string | null };\n    finish_reason?: string | null;\n  }>;\n  usage?: { prompt_tokens?: number; completion_tokens?: number; total_tokens?: number } | null;\n  [key: string]: unknown;\n};\n\nexport type LLMInvokeInput = {\n  prompt: string;\n  params?: LLMInvokeParams;\n};\n\nfunction invokeBody(input: LLMInvokeInput): Record<string, unknown> {\n  return { prompt: input.prompt, ...input.params };\n}\n\n/** Error codes specific to LLM calls. */\nexport const LLM_ERROR_CODES = {\n  PROVIDER_UNAVAILABLE: \"K9O_LLM_PROVIDER_UNAVAILABLE\",\n} as const;\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"compute.llms operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeLlmsNamespace(config: HttpClientConfig) {\n  return {\n    /** GET /@<slug>/compute/llms — list models available to the project tier. */\n    async list(opts?: { modality?: LLMModality; providerClass?: LLMProviderClass }): Promise<Envelope<ReadonlyArray<LLMModel>>> {\n      const slug = requireProjectSlug(config);\n      return request(config, { method: \"GET\", path: projectPath(slug, \"compute/llms\"), query: opts });\n    },\n\n    /** GET /@<slug>/compute/llms/<model-id> — read single model metadata + cost. */\n    async read(modelId: LLMModelId | string): Promise<Envelope<LLMModel>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"GET\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}`),\n      });\n    },\n\n    /**\n     * POST /@<slug>/compute/llms/<model-id>/invoke — synchronous inference.\n     * Requires PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).\n     */\n    async invoke(modelId: LLMModelId | string, input: LLMInvokeInput): Promise<Envelope<LLMResponse>> {\n      const slug = requireProjectSlug(config);\n      return request(config, {\n        method: \"POST\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}/invoke`),\n        body: invokeBody(input),\n      });\n    },\n\n    /**\n     * POST /@<slug>/compute/llms/<model-id>/invoke-stream — streaming\n     * inference (SSE; the model server's OpenAI-style chunks).\n     * Returns an async iterable of `LLMStreamChunk` — caller writes\n     * `for await (const chunk of client.compute.llms.invokeStream(...))`.\n     * The SDK handles SSE framing internally.\n     */\n    async *invokeStream(modelId: LLMModelId | string, input: LLMInvokeInput): AsyncGenerator<LLMStreamChunk, void, void> {\n      const slug = requireProjectSlug(config);\n      const response = await requestStream(config, {\n        method: \"POST\",\n        path: projectPath(slug, `compute/llms/${encodeURIComponent(modelId)}/invoke-stream`),\n        body: invokeBody(input),\n        accept: \"text/event-stream\",\n      });\n      // requestStream guarantees a non-null body on 2xx.\n      yield* parseSseStream<LLMStreamChunk>(response.body as ReadableStream<Uint8Array>);\n    },\n  };\n}\n\nexport function makeComputeNamespace(config: HttpClientConfig) {\n  return {\n    /** LLM registry + inference — `client.compute.llms.*` . */\n    llms: makeLlmsNamespace(config),\n  };\n}\n","/**\n * `client.ai.*` — platform AI primitives (`k9o.ai.embed()` is a platform primitive, not sugar over\n * `context.embed`).\n *\n * Wire mapping (project-plane):\n *   - embed({ model?, input }) → POST /@<slug>/ai/embeddings   body { model?, input: string | string[] }\n *                              → { data: { embeddings: number[][], model, dimensions }, meta }\n *\n * Callers are an extension (authority is the `(ai, embed, \"*\")` manifest grant) or a project member's own\n * backend; the gateway refuses an end user's client. Bounds (enforced by the gateway, not here): at most 64\n * inputs, each non-empty, at most 256 KiB of input per request, at most 4 requests in flight per project.\n * The platform adds nothing to the input: callers add the model's task prefixes themselves. The SDK sends the\n * input exactly as given and never puts it in an error.\n */\n\nimport { request, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport type { Envelope } from \"./envelope.ts\";\n\n/** The one declared embedding model today. A different `model` is refused with `K9O_MODEL_NOT_DECLARED`. */\nexport type EmbeddingModelId = \"nomic-embed-text-v1.5\";\n\nexport type EmbedInput = {\n  /** Optional; defaults server-side to the one declared embedding model. */\n  model?: EmbeddingModelId | (string & {});\n  /** One string, or an array of strings; the result has one vector per string, in order. */\n  input: string | ReadonlyArray<string>;\n};\n\nexport type EmbedResult = {\n  /** One vector per input string, in input order. */\n  embeddings: number[][];\n  model: string;\n  dimensions: number;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"ai operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\nexport function makeAiNamespace(config: HttpClientConfig) {\n  return {\n    /** POST /@<slug>/ai/embeddings — embed one or more strings. */\n    async embed(input: EmbedInput): Promise<Envelope<EmbedResult>> {\n      const slug = requireProjectSlug(config);\n      const body: { model?: string; input: string | string[] } = {\n        input: typeof input.input === \"string\" ? input.input : [...input.input],\n      };\n      if (input.model !== undefined) body.model = input.model;\n      return request(config, { method: \"POST\", path: projectPath(slug, \"ai/embeddings\"), body });\n    },\n  };\n}\n","/**\n * Realtime Subscriptions SDK — `client.realtime.*`.\n *\n * Realtime Subscriptions ALL-LIVE primitive.\n *\n * `client.realtime.subscribe(topic, options?)` returns an async iterable\n * yielding `RealtimeEvent`s — the caller writes idiomatic\n * `for await (const event of client.realtime.subscribe(topic)) { ... }`.\n *\n * Transport: SSE over `GET /@<slug>/realtime/subscribe`. The gateway\n * serves no WebSocket upgrade and no durable replay, so neither is\n * offered; after an `event: resync` frame the client re-reads current\n * state from the data plane and resubscribes.\n *\n * Wire mapping (project-plane):\n *   - subscribe → GET  /@<slug>/realtime/subscribe?topic=<t>&filter=<jsonb>  (SSE)\n *\n * `filter` + RLS compose (filter narrows, RLS gates). Surfaces\n * K9O_INVALID_FILTER, K9O_SUBSCRIPTION_LIMIT_EXCEEDED and K9O_TIER_FEATURE_GATED.\n */\n\nimport { requestStream, type HttpClientConfig } from \"./http.ts\";\nimport { projectPath } from \"./url-grammar.ts\";\nimport { parseSseStream } from \"./internal/sse.ts\";\n\n// ----------------------------------------------------------------------\n// Topic catalogue \n// ----------------------------------------------------------------------\n\n/**\n * The 6 closed subscription topic families . Concrete\n * topic strings carry a dynamic segment (collection name, resource id,\n * event family) — use `realtimeTopic.*` builders to construct them.\n */\nexport type RealtimeTopicFamily =\n  | \"collections\"\n  | \"studio.workflows.runs\"\n  | \"studio.queries.executed\"\n  | \"studio.dashboards.refresh\"\n  | \"forge.functions.invocations\"\n  | \"audit.org\";\n\n/** A concrete topic string, e.g. `studio.dashboards.refresh.dsh_abc`. */\nexport type RealtimeTopic = string;\n\n/**\n * Typed builders for the 6 topic families . Prefer these\n * over hand-built strings for compile-time family safety.\n */\nexport const realtimeTopic = {\n  /** `collections.<collection>.*` — row insert / update / delete events. */\n  collection(collection: string): RealtimeTopic {\n    return `collections.${collection}.*`;\n  },\n  /** `studio.workflows.runs.*` — run started / step_changed / approval_pending / completed. */\n  workflowRuns(): RealtimeTopic {\n    return \"studio.workflows.runs.*\";\n  },\n  /** `studio.queries.executed.<query-id>` — query execute events. */\n  queryExecuted(queryId: string): RealtimeTopic {\n    return `studio.queries.executed.${queryId}`;\n  },\n  /** `studio.dashboards.refresh.<dashboard-id>` — widget data refresh. */\n  dashboardRefresh(dashboardId: string): RealtimeTopic {\n    return `studio.dashboards.refresh.${dashboardId}`;\n  },\n  /** `forge.functions.invocations.<function-id>` — invoked / completed / failed. */\n  functionInvocations(functionId: string): RealtimeTopic {\n    return `forge.functions.invocations.${functionId}`;\n  },\n  /** `audit.org.<event-family>` — org-plane audit events. */\n  auditOrg(eventFamily: string): RealtimeTopic {\n    return `audit.org.${eventFamily}`;\n  },\n} as const;\n\n// ----------------------------------------------------------------------\n// Event + filter shapes\n// ----------------------------------------------------------------------\n\n/** Per-topic filter predicate . */\nexport type RealtimeFilter = Record<string, unknown>;\n\n/** A single realtime event, as the gateway frames it (wire spelling). */\nexport type RealtimeEvent<T = unknown> = {\n  topic: RealtimeTopic;\n  /** Event type within the topic family (e.g. `row_inserted`, `workflow.run.completed`). */\n  eventType: string;\n  payload: T;\n  occurredAt: string;\n};\n\nexport type SubscribeOptions = {\n  filter?: RealtimeFilter;\n  /** Abort the subscription (closes the underlying transport). */\n  signal?: AbortSignal;\n};\n\n/**\n * A live subscription. It is itself an async iterable (`for await`) and\n * exposes `close()` for explicit teardown.\n */\nexport type RealtimeSubscription<T = unknown> = AsyncIterable<RealtimeEvent<T>> & {\n  /** Stop the subscription + release the underlying transport. */\n  close(): void;\n};\n\nfunction requireProjectSlug(config: HttpClientConfig): string {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    throw new Error(\"realtime operations require projectSlug bound on the client\");\n  }\n  return config.projectSlug;\n}\n\n/** SSE transport — rides on fetch streaming. `resync` control frames are not events and are skipped. */\nasync function* sseTransport<T>(\n  config: HttpClientConfig,\n  topic: RealtimeTopic,\n  options: SubscribeOptions,\n  closed: { value: boolean },\n): AsyncGenerator<RealtimeEvent<T>, void, void> {\n  const slug = requireProjectSlug(config);\n  const query: Record<string, string | number | boolean | undefined> = { topic };\n  if (options.filter) query.filter = JSON.stringify(options.filter);\n  const response = await requestStream(config, {\n    method: \"GET\",\n    path: projectPath(slug, \"realtime/subscribe\"),\n    query,\n    accept: \"text/event-stream\",\n  });\n  for await (const event of parseSseStream<RealtimeEvent<T>>(response.body as ReadableStream<Uint8Array>)) {\n    if (closed.value || options.signal?.aborted) return;\n    if (typeof (event as { eventType?: unknown }).eventType !== \"string\") continue;\n    yield event;\n  }\n}\n\nexport function makeRealtimeNamespace(config: HttpClientConfig) {\n  return {\n    /**\n     * Subscribe to a topic. Returns a `RealtimeSubscription` — an async\n     * iterable of `RealtimeEvent`s over SSE.\n     *\n     * ```ts\n     * const sub = client.realtime.subscribe(\n     *   realtimeTopic.dashboardRefresh(\"dsh_abc\"),\n     * );\n     * for await (const event of sub) {\n     *   if (event.eventType === \"dashboard.widget.data_refreshed\") rerender(event.payload);\n     * }\n     * ```\n     */\n    subscribe<T = unknown>(topic: RealtimeTopic, options: SubscribeOptions = {}): RealtimeSubscription<T> {\n      requireProjectSlug(config);\n      const closed = { value: false };\n      const iterate = (): AsyncGenerator<RealtimeEvent<T>, void, void> => sseTransport<T>(config, topic, options, closed);\n\n      let active: AsyncGenerator<RealtimeEvent<T>, void, void> | null = null;\n      return {\n        [Symbol.asyncIterator]() {\n          active = iterate();\n          return active;\n        },\n        close() {\n          closed.value = true;\n          void active?.return(undefined);\n        },\n      };\n    },\n  };\n}\n","/**\n * Pillar composition: `@k9o/core` ↔ `@k9o/gate`.\n *\n * `@k9o/core` composes `@k9o/gate` as the `client.gate` namespace on\n * the K9oClient, sharing the same `baseUrl` + `projectSlug` config.\n *\n * `@k9o/gate` remains independently importable for Auth0-parity\n * standalone deployments (Trojan Horse motion); the bridge here is the\n * composition path when the caller imports `@k9o/core` and wants the\n * full platform surface.\n *\n * Mode defaults to `native` for the composition path — Native is the\n * mode that pairs with the broader Kilimanjaro billing model per\n * `@k9o/gate/mode.ts`. Standalone customers should import\n * `@k9o/gate` directly and call `createGateClient({ mode: 'standalone', ... })`.\n *\n * KError vs GateError alignment is still open.\n * Until then both error types remain shape-compatible (`code` /\n * `message` / `context` / `recommendation` fields are identical),\n * and caller code that narrows on `error.code` works against either.\n */\n\nimport { createGateClient, type GateClient } from \"@k9o/gate\";\nimport type { HttpClientConfig } from \"./http.ts\";\nimport { KError } from \"./kerror.ts\";\n\n/**\n * Build the composed `client.gate` namespace bound to the K9oClient's\n * baseUrl + projectSlug. Requires `projectSlug` to be set on the\n * client config — gate operations are inherently project-scoped per\n * URL grammar.\n *\n * Returns `null` when projectSlug is not bound — the K9oClient may be\n * constructed for org-plane operations only (e.g. `client.orgs.list()`\n * or `client.projects.create()`), in which case gate operations are\n * not available until a per-project client is constructed.\n */\nexport function makeGateBridge(config: HttpClientConfig): GateClient | null {\n  if (typeof config.projectSlug !== \"string\" || config.projectSlug.length === 0) {\n    return null;\n  }\n  // Spread optional fields only when defined — GateConfig's partnerToken\n  // + fetch are non-optional-undefined under exactOptionalPropertyTypes.\n  return createGateClient({\n    mode: \"native\",\n    baseUrl: config.baseUrl,\n    projectSlug: config.projectSlug,\n    ...(config.apiKey !== undefined ? { partnerToken: config.apiKey } : {}),\n    ...(config.fetch !== undefined ? { fetch: config.fetch } : {}),\n  });\n}\n\n/**\n * Throw a helpful error when `client.gate` is accessed but projectSlug\n * is not bound. Wraps the null-return from `makeGateBridge` so callers\n * get a typed `K9O_MISSING_PROJECT_CONTEXT` rather than a null deref.\n */\nexport function gateNotAvailable(): never {\n  throw new KError({\n    code: \"K9O_MISSING_PROJECT_CONTEXT\",\n    message: \"client.gate requires projectSlug bound on the createClient options\",\n    context: {},\n    recommendation: \"Pass `projectSlug` in createClient options. For multi-project apps, construct one client per project context.\",\n  });\n}\n","/**\n * Pillar composition: `@k9o/core` ↔ `@k9o/extensions`.\n *\n * Re-exports the `k9o.extension(slug)` factory from `@k9o/extensions`.\n *\n * `@k9o/extensions` exports a `k9o` namespace with `extension(slug)`\n * factory returning typed bindings for Trailblazer/Anchor/Keystone\n * class extensions (baked in at SDK publish time). Circuit-class\n * (Long Tail) extensions use the install-time `k9o codegen` tool\n * path (a) OR raw HTTP / vendor-SDK fallback per path (b).\n *\n * The bridge re-exports the factory directly — it is config-free\n * (extension stubs do not require HTTP routing yet). Once per-method dispatch\n * ships, the bridge will thread baseUrl + auth into the extension runtime;\n * until then the re-export is a thin pass-through.\n */\n\nimport { k9o as extensionsNamespace, type ExtensionSlug, type Extension } from \"@k9o/extensions\";\n\nexport { extensionsNamespace, type ExtensionSlug, type Extension };\n\n/**\n * Build the composed `client.extensions` namespace. Currently a thin\n * re-export of the `@k9o/extensions` `k9o.extension(slug)` factory.\n * Config-free for now; it will use the client HTTP config once runtime\n * dispatch ships.\n */\nexport function makeExtensionsBridge() {\n  return {\n    /** Resolve a typed extension instance by slug. See `@k9o/extensions` for the factory contract. */\n    extension: extensionsNamespace.extension,\n  };\n}\n","/**\n * `@k9o/core` — Kilimanjaro platform SDK entry point.\n *\n * Customer-facing surface. The `createClient(options)`\n * factory returns a `K9oClient` instance with namespaces:\n *\n *   - `client.from(collection)`  — data-plane DSL\n *   - `client.projects`          — project lifecycle\n *   - `client.gate`, `client.extensions`, `client.migrations`, `client.functions`, `client.policies`,\n *     `client.audit`, `client.orgs` and the other namespaces on the client type\n *\n * `@k9o/core` composes `@k9o/gate` and `@k9o/extensions` and adds client construction and the data-plane surface.\n * The SDK shape stays stable whether pillars are imported directly or\n * through `@k9o/core` — only the package boundary moves.\n *\n * Every async method throws `KError` on non-2xx\n * gateway responses, transport failures, or SDK-side validation errors.\n * Caller code narrows on `error.code` per the closed taxonomy.\n *\n * Canonical usage:\n *\n * ```typescript\n * import { createClient, KError } from \"@k9o/core\";\n *\n * // `orgSlug` selects your organization's host (https://acme.api.k9o.io); do not also pass `baseUrl`.\n * const client = createClient({\n *   apiKey: process.env.K9O_API_KEY,\n *   orgSlug: \"acme\",\n *   projectSlug: \"member-portal\",\n * });\n *\n * try {\n *   const { data, meta } = await client.from(\"posts\").select().limit(10);\n *   console.log(data, meta.cursor.next);\n * } catch (e) {\n *   if (e instanceof KError && e.code === \"K9O_TIER_CAP_HIT\") {\n *     console.warn(e.message, e.recommendation);\n *   }\n *   throw e;\n * }\n * ```\n */\n\nimport { resolveBaseUrl } from \"./url-grammar.ts\";\nimport type { HttpClientConfig } from \"./http.ts\";\nimport { makeFromFactory } from \"./data/from.ts\";\nimport { makeProjectsNamespace } from \"./projects.ts\";\nimport { makeStorageNamespace } from \"./storage-locations.ts\";\nexport type {\n  StorageBucket, CreateBucketOptions, UpdateBucketOptions, StorageObject, UploadOptions, SignedUrlOptions,\n  SignedUrl, RemovedObject, DeletedBucket,\n} from \"./storage-buckets.ts\";\nimport { makeMigrationsNamespace } from \"./migrations.ts\";\nimport { makeFunctionsNamespace } from \"./functions.ts\";\nimport { makePoliciesNamespace } from \"./policies.ts\";\nimport { makeAuditNamespace } from \"./audit.ts\";\nimport { makeOrgsNamespace } from \"./orgs.ts\";\nimport { makeOrgNamespace } from \"./org.ts\";\nimport { makeMeNamespace } from \"./me.ts\";\nimport { makeStudioNamespace } from \"./studio/index.ts\";\nimport { makeComputeNamespace } from \"./compute/llms.ts\";\nimport { makeAiNamespace } from \"./ai.ts\";\nimport { makeRealtimeNamespace } from \"./realtime.ts\";\nimport { makeGateBridge, gateNotAvailable } from \"./gate-bridge.ts\";\nimport { makeExtensionsBridge } from \"./extensions-bridge.ts\";\nimport type { GateClient } from \"@k9o/gate\";\nimport { createKiboClient, type KiboClient } from \"@k9o/kibo\";\nimport type { CreateClientOptions } from \"./types.ts\";\n\nexport { KError, kerrorFromWire, type KErrorWire } from \"./kerror.ts\";\nexport {\n  type Envelope,\n  type MetaCursor,\n  type MetaSubscription,\n  type MetaIdempotency,\n  type MetaWarning,\n  type MetaCost,\n  type MetaTiming,\n  type MetaContext,\n  type PaginatedEnvelope,\n} from \"./envelope.ts\";\nexport {\n  validateBaseUrl,\n  resolveBaseUrl,\n  parseApiHost,\n  DEFAULT_BASE_URL,\n  type ApiHost,\n  validateSlug,\n  projectPath,\n  orgPath,\n  platformPath,\n} from \"./url-grammar.ts\";\nexport type {\n  CreateClientOptions,\n  RetryConfig,\n  FilterOp,\n} from \"./types.ts\";\nexport type { Project, CreateProjectInput, UpdateProjectInput } from \"./projects.ts\";\nexport {\n  BYOS_CRED_REF_PREFIX,\n  BYOS_CRED_FORMAT_VERSION,\n  BYOS_CRED_VAULT_NAME_PREFIX,\n  BYOS_PROVIDER_SCHEME,\n  encodeByosCredential,\n  byosCredentialRef,\n  byosCredVaultName,\n  type ByosCredProvider,\n  type ByosCredInput,\n} from \"./byos.ts\";\nexport type {\n  StorageLocation, StorageLocationProvider, StorageLocationCustodyMode, StorageLocationProviderParams,\n  CreateStorageLocationInput, UpdateStorageLocationInput, RetiredStorageLocation, StorageLocationTestResult,\n} from \"./storage-locations.ts\";\nexport type {\n  Migration, AppliedMigration, AppliedMigrationRow, SkippedMigrationRow, ApplyMigrationsResult, ApplyPendingResult,\n  PendingMigration, PendingMigrationStatus, QueuedMigration,\n  Operation, ColumnSpec, IndexSpec, ColumnReferences,\n  MigrationPolicy, CollectionPolicy, StorageBucketPolicy, RelationshipSpec, ActionRule,\n} from \"./migrations.ts\";\nexport type { FunctionRecord, DeployFunctionInput } from \"./functions.ts\";\nexport type {\n  PolicyBundle, PolicyDocument, PolicyPublishResult, PublishPolicyOptions, CreatePolicyInput, UpdatePolicyInput, ValidatePolicyResult,\n} from \"./policies.ts\";\nexport type { AuditEvent, AuditQueryOpts } from \"./audit.ts\";\nexport type { Org } from \"./orgs.ts\";\nexport type {\n  OrgMember,\n  OrgInviteResult,\n  OrgGroup,\n  OrgRoleGrant,\n  OrgAuditEvent,\n  SmtpConfig,\n  SmtpTestEmailInput,\n  SmtpTestEmailResult,\n  OrgIdpProvider,\n  CreateOrgIdpInput,\n  UpdateOrgIdpInput,\n  OrgIdpProviderKind,\n  OrgDefaultLlm,\n} from \"./org.ts\";\nexport type {\n  MyProfile,\n  MySession,\n  UpdateMyProfileInput,\n  MyApiToken,\n  CreateMyApiTokenInput,\n} from \"./me.ts\";\nexport type { ExtensionSlug, Extension } from \"./extensions-bridge.ts\";\nexport type { GateClient } from \"@k9o/gate\";\nexport type {\n  KiboClient, KmsProvider, StoreZkDekInput, ZkDekHandle, ZkDekRecord,\n  SecretVisibility, CreateSecretInput, SecretSummary,\n  ListSecretsInput, ListSecretsResult, AttestationTier, RevealChallenge, RevealSecretResult,\n  UpdateSecretInput, UpdateSecretResult, RotateSecretResult, MoveSecretResult,\n} from \"@k9o/kibo\";\n\n// Studio surfaces (workflows + dashboards)\nexport {\n  WORKFLOW_ERROR_CODES,\n  type Workflow,\n  type WorkflowRun,\n  type WorkflowRunStep,\n  type WorkflowAction,\n  type WorkflowStatus,\n  type WorkflowRunStatus,\n  type WorkflowTriggerType,\n  type WorkflowActionType,\n  type CreateWorkflowInput,\n  type UpdateWorkflowInput,\n  type WorkflowListFilters,\n  type WorkflowRunListFilters,\n} from \"./studio/workflows.ts\";\nexport {\n  DASHBOARD_ERROR_CODES,\n  type Dashboard,\n  type Widget,\n  type WidgetType,\n  type WidgetDataSourceMode,\n  type DashboardStatus,\n  type CreateDashboardInput,\n  type UpdateDashboardInput,\n  type DashboardListFilters,\n} from \"./studio/dashboards.ts\";\n\n// Compute LLMs\nexport {\n  LLM_ERROR_CODES,\n  type LLMModelId,\n  type LLMModel,\n  type LLMModality,\n  type LLMProviderClass,\n  type LLMInvokeParams,\n  type LLMInvokeInput,\n  type LLMResponse,\n  type LLMUsage,\n  type LLMStreamChunk,\n} from \"./compute/llms.ts\";\n\nexport type { EmbedInput, EmbedResult, EmbeddingModelId } from \"./ai.ts\";\n\nexport { assertProviderRegion, isProviderRegion, type ProviderRegionProvider } from \"./provider-region.ts\";\n\n// Realtime subscriptions\nexport {\n  realtimeTopic,\n  type RealtimeTopic,\n  type RealtimeTopicFamily,\n  type RealtimeFilter,\n  type RealtimeEvent,\n  type RealtimeSubscription,\n  type SubscribeOptions,\n} from \"./realtime.ts\";\n\n/**\n * The client returned by `createClient`. Namespaces hang off the\n * instance — composed from per-resource factories that share the\n * bound HTTP config.\n */\nexport type K9oClient = {\n  /** Data-plane DSL — `client.from(collection).select()` etc. */\n  from: ReturnType<typeof makeFromFactory>;\n  /** Project lifecycle — `client.projects.list()` etc. */\n  projects: ReturnType<typeof makeProjectsNamespace>;\n  /** Storage locations — `client.storage.locations.create({..., credentialRef})` etc. Independent of\n   *  `client.kibo.vault.secrets` (credential pre-create): this namespace only registers a caller-supplied\n   *  `credentialRef` string, never creates or resolves one. */\n  storage: ReturnType<typeof makeStorageNamespace>;\n  /** Migration lifecycle — `client.migrations.apply()` etc. */\n  migrations: ReturnType<typeof makeMigrationsNamespace>;\n  /** Function deploy + invoke — `client.functions.deploy()` etc. */\n  functions: ReturnType<typeof makeFunctionsNamespace>;\n  /** Policy bundle lifecycle — `client.policies.publish()` etc. */\n  policies: ReturnType<typeof makePoliciesNamespace>;\n  /** Audit log queries — `client.audit.query()` etc. */\n  audit: ReturnType<typeof makeAuditNamespace>;\n  /** Org lifecycle — `client.orgs.list()` etc. (collection-style across accessible orgs) */\n  orgs: ReturnType<typeof makeOrgsNamespace>;\n  /** Org-bound namespace — `client.org.members`, `client.org.groups`, `client.org.smtp`, `client.org.auditLog`, `client.org.gate`. */\n  org: ReturnType<typeof makeOrgNamespace>;\n  /** Operator-self namespace — `client.me.profile`, `client.me.sessions`, etc. Cross-org; no tenant context required. */\n  me: ReturnType<typeof makeMeNamespace>;\n  /** Studio surfaces — `client.studio.workflows.*` + `client.studio.dashboards.*`. */\n  studio: ReturnType<typeof makeStudioNamespace>;\n  /** Compute surfaces — `client.compute.llms.*`. */\n  compute: ReturnType<typeof makeComputeNamespace>;\n  /** Platform AI primitives — `client.ai.embed({ model?, input })`. */\n  ai: ReturnType<typeof makeAiNamespace>;\n  /** Realtime subscriptions — `client.realtime.subscribe()` (SSE). */\n  realtime: ReturnType<typeof makeRealtimeNamespace>;\n  /** Gate (Identity-Aware Kernel) — composed from `@k9o/gate`. Available when projectSlug is bound on the client. */\n  readonly gate: GateClient;\n  /** Kibo (Zero-Knowledge vault) — composed from `@k9o/kibo`. `client.kibo.vault.zkDeks.*` (F.5); project-scoped methods self-guard the project context. */\n  readonly kibo: KiboClient;\n  /** Extensions consumption — composed from `@k9o/extensions`. `client.extensions.extension(slug)` returns typed extension bindings. */\n  extensions: ReturnType<typeof makeExtensionsBridge>;\n  /** Bound config — exposed for advanced use (custom HTTP per-call). */\n  readonly config: Readonly<HttpClientConfig>;\n};\n\n/**\n * Construct a `K9oClient` bound to the supplied gateway baseUrl + auth\n * + project context. Validates the baseUrl at construct time\n * — path-bearing baseUrls throw `K9O_INVALID_BASE_URL` synchronously.\n */\nexport function createClient(options: CreateClientOptions): K9oClient {\n  const baseUrl = resolveBaseUrl(options.baseUrl, options.orgSlug);\n  const config: HttpClientConfig = {\n    baseUrl,\n    apiKey: options.apiKey,\n    projectSlug: options.projectSlug,\n    orgSlug: options.orgSlug,\n    fetch: options.fetch,\n    defaultHeaders: options.defaultHeaders,\n    retryConfig: options.retryConfig,\n  };\n  const gateBridge = makeGateBridge(config);\n  return {\n    from: makeFromFactory(config),\n    projects: makeProjectsNamespace(config),\n    storage: makeStorageNamespace(config),\n    migrations: makeMigrationsNamespace(config),\n    functions: makeFunctionsNamespace(config),\n    policies: makePoliciesNamespace(config),\n    audit: makeAuditNamespace(config),\n    orgs: makeOrgsNamespace(config),\n    org: makeOrgNamespace(config),\n    me: makeMeNamespace(config),\n    studio: makeStudioNamespace(config),\n    compute: makeComputeNamespace(config),\n    ai: makeAiNamespace(config),\n    realtime: makeRealtimeNamespace(config),\n    // gate is a proxy — null when projectSlug isn't bound; surfacing a\n    // helpful K9O_MISSING_PROJECT_CONTEXT instead of a null deref when\n    // the caller reaches for any gate method without project context.\n    get gate() {\n      if (gateBridge === null) return gateNotAvailable();\n      return gateBridge;\n    },\n    extensions: makeExtensionsBridge(),\n    kibo: createKiboClient(config),\n    config: Object.freeze({ ...config }),\n  };\n}\n","/**\n * BYOS (Bring-Your-Own-Store) credential-reference wire format — the client-side counterpart of the\n * gateway's B2 seal-plane gate (mirrors `services/gateway/src/analytics/\n * byos-credential-ref.ts` + `byos-credential-resolver.ts`) plus the 5-provider envelope shapes from the\n * provisioning spec — each provider's long-lived cred is\n * revealed CORE-side via an already-wired scheme that reads one exact field shape.\n *\n * The customer PRE-CREATES their cloud credential as a vault secret under their OWN auth, then binds\n * only a `kibo://byos-creds/<secId>` reference — the gateway never handles the raw long-lived cloud\n * credential at bind time (`byos-cred create`, `packages/cli/src/commands/byos-cred.ts`).\n */\n\nimport { KError } from \"./kerror.ts\";\nimport { assertProviderRegion } from \"./provider-region.ts\";\n\n/** The reference scheme the gateway's `assertByosCredentialRef` accepts at bind time. */\nexport const BYOS_CRED_REF_PREFIX = \"kibo://byos-creds/\";\n\n/**\n * The reserved vault SECRET-NAME namespace `byos-cred create` always stores under (distinct from\n * {@link BYOS_CRED_REF_PREFIX}, the `kibo://` reference scheme formed from the resulting secret id).\n * `SecretRecord` has no class/purpose column — `name` is the only vault-stored,\n * non-caller-asserted field the reveal endpoint's class gate can check authoritatively to tell \"this\n * is a BYOS credential\" and refuse revealing an install-scoped secret through the BYOS reveal path\n * (closing a receipt-bypass). `byos-cred create` enforces this prefix unconditionally —\n * it is not a convention callers opt into.\n */\nexport const BYOS_CRED_VAULT_NAME_PREFIX = \"byos-creds/\";\n\n/** The allowed charset for the caller-given part of a BYOS vault secret name (after stripping\n *  {@link BYOS_CRED_VAULT_NAME_PREFIX} if present) — hygiene, not a security boundary (the seal is\n *  customer-plane-scoped and the reveal resolves by vault-generated secId, never by name), but an\n *  unvalidated name could otherwise land a secret at an odd vault path. */\nconst VAULT_NAME_SEGMENT = /^[a-z0-9._-]+(?:\\/[a-z0-9._-]+)*$/;\n\n/** Prefix a caller-given secret name with {@link BYOS_CRED_VAULT_NAME_PREFIX} if it isn't already\n *  under it. Idempotent so re-running with an already-prefixed name doesn't double-nest.\n *  Two independent checks, not one: a literal `..` substring is rejected\n *  outright (traversal), separately from {@link VAULT_NAME_SEGMENT} restricting the charset to\n *  `[a-z0-9._/-]` (hygiene) — the charset still permits a lone `.`, which is not itself a traversal\n *  token and is not what blocks `..`. */\nexport function byosCredVaultName(name: string): string {\n  const suffix = name.startsWith(BYOS_CRED_VAULT_NAME_PREFIX) ? name.slice(BYOS_CRED_VAULT_NAME_PREFIX.length) : name;\n  if (suffix.length === 0 || suffix.includes(\"..\") || !VAULT_NAME_SEGMENT.test(suffix)) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: \"a BYOS credential name must be non-empty, lowercase alphanumeric/._- per path segment, and must not contain '..'\",\n      context: { field: \"name\" },\n      recommendation: \"Use a name like 's3-prod' or 'team/s3-prod' — no '..', no uppercase, no other punctuation.\",\n    });\n  }\n  return `${BYOS_CRED_VAULT_NAME_PREFIX}${suffix}`;\n}\n\n/** The sealed BYOS credential format version (pin `v`, fail-closed on\n *  an unrecognised version so a future cred shape never silently mis-parses as v1). */\nexport const BYOS_CRED_FORMAT_VERSION = 1;\n\n/** The CORE-mintable providers — each maps to exactly one wired reveal scheme.\n *  `azure_blob` has no envelope shape yet (not in the provisioning spec). */\nexport type ByosCredProvider = \"s3\" | \"s3_compatible\" | \"minio\" | \"gcs\" | \"b2\" | \"r2\";\n\n/** provider → WIRED reveal scheme — informational; not itself sent on the wire (the\n *  scheme name IS part of each envelope below). */\nexport const BYOS_PROVIDER_SCHEME: Record<ByosCredProvider, string> = {\n  s3: \"aws_sigv4\",\n  s3_compatible: \"aws_sigv4\",\n  minio: \"aws_sigv4\",\n  gcs: \"gcp_workload_identity\",\n  b2: \"http_basic\",\n  r2: \"bearer\",\n};\n\ntype SigV4Input = {\n  provider: \"s3\" | \"s3_compatible\" | \"minio\";\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** The provider's STS-signing region the CORE mint signs its STS request against (`us-east-1`), NOT a platform region. */\n  providerRegion: string;\n  /** Present only to be rejected — a sealed cred must be long-lived. */\n  sessionToken?: string | undefined;\n};\n\ntype GcsInput = {\n  provider: \"gcs\";\n  /** The service account's PKCS8 private key, PEM-encoded. */\n  privateKeyPem: string;\n  /** The service account's email — the mint's `clientId`. */\n  clientId: string;\n};\n\ntype B2Input = {\n  provider: \"b2\";\n  /** The B2 master key's `keyId` — sealed as `username` (RFC 7617; must not contain `:`). */\n  keyId: string;\n  /** The B2 master key's `appKey` — sealed as `password`. */\n  appKey: string;\n};\n\ntype R2Input = {\n  provider: \"r2\";\n  /** The Cloudflare API token — sealed as `token`. */\n  apiToken: string;\n};\n\n/** Discriminated input to {@link encodeByosCredential} — one shape per CORE-mintable provider. */\nexport type ByosCredInput = SigV4Input | GcsInput | B2Input | R2Input;\n\nfunction rejectTempCred(sessionToken: string | undefined): void {\n  if (typeof sessionToken === \"string\" && sessionToken.length > 0) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message:\n        \"cannot seal a temporary BYOS credential (a sessionToken expires and would invalidate the credentialRef once sealed); supply a long-lived access key\",\n      context: { field: \"sessionToken\" },\n      recommendation: \"Create a bucket-scoped, long-lived IAM access key for this credential instead of a temporary/STS one.\",\n    });\n  }\n}\n\n/**\n * Encode a customer cloud credential to the exact versioned JSON string the vault secret's `value`\n * must carry, per provider:\n *\n *   - s3 / s3_compatible / minio: `{v:1, scheme:\"aws_sigv4\", service:\"sts\", providerRegion, accessKeyId, secretAccessKey}`\n *     🔴 `service` MUST be `\"sts\"` — the long-lived cred signs ONLY the STS mint; the CORE\n *     mint fail-closes on `service !== \"sts\"`. Not caller-configurable.\n *   - gcs: `{v:1, scheme:\"gcp_workload_identity\", privateKeyPem, clientId}`\n *   - b2: `{v:1, scheme:\"http_basic\", username, password}` — 🔴 the B2 master's `keyId` seals as\n *     `username`, `appKey` as `password` (RFC 7617 field names, not B2's native ones); throws if\n *     `keyId` contains `:` (RFC 7617 forbids it in `username`).\n *   - r2: `{v:1, scheme:\"bearer\", token}`\n *\n * 🔴 Rejects a temporary/session credential on the `aws_sigv4` path —\n * a `sessionToken` expires and would silently invalidate the `credentialRef` once sealed, so this\n * refuses to encode one rather than deferring to the gateway's own reveal-time rejection. The other\n * three schemes have no analogous temporary-credential field in this envelope shape.\n */\nexport function encodeByosCredential(input: ByosCredInput): string {\n  switch (input.provider) {\n    case \"s3\":\n    case \"s3_compatible\":\n    case \"minio\": {\n      rejectTempCred(input.sessionToken);\n      // Sealed into the envelope and later put into hostnames by the mint: refuse a malformed one before it is sealed.\n      assertProviderRegion(input.providerRegion, input.provider);\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"aws_sigv4\",\n        service: \"sts\",\n        providerRegion: input.providerRegion,\n        accessKeyId: input.accessKeyId,\n        secretAccessKey: input.secretAccessKey,\n      });\n    }\n    case \"gcs\":\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"gcp_workload_identity\",\n        privateKeyPem: input.privateKeyPem,\n        clientId: input.clientId,\n      });\n    case \"b2\": {\n      if (input.keyId.includes(\":\")) {\n        throw new KError({\n          code: \"K9O_INVALID_FIELD_VALUE\",\n          message: \"a B2 master keyId sealed as the http_basic username must not contain ':' (RFC 7617)\",\n          context: { field: \"keyId\" },\n          recommendation: null,\n        });\n      }\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"http_basic\",\n        username: input.keyId,\n        password: input.appKey,\n      });\n    }\n    case \"r2\":\n      return JSON.stringify({\n        v: BYOS_CRED_FORMAT_VERSION,\n        scheme: \"bearer\",\n        token: input.apiToken,\n      });\n  }\n}\n\n/** Form the `kibo://byos-creds/<secId>` reference from a vault secret id — the inverse of the\n *  gateway's `byosCredentialSecId`. */\nexport function byosCredentialRef(secId: string): string {\n  return `${BYOS_CRED_REF_PREFIX}${secId}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgDA,IAAM,eAAN,MAAmB;AAAA,EACP,UAAoB,CAAC;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAG,QAAgB,OAAwC;AACzD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAwC;AAC1D,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA8B;AAC/C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAA8B;AAChD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA8B;AAC/C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAA8B;AAChD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,OAAO,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,QAA8C;AAC/D,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,OAAO,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,QAA8C;AAClE,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,SAAS,OAAO,OAAO,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,KAAK,QAAgB,SAAuB;AAC1C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,QAAQ,OAAO,QAAQ,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,SAAuB;AAC3C,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,SAAS,OAAO,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAwC;AACzD,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAgB,IAAc,OAAyE;AAC5G,SAAK,QAAQ,KAAK,EAAE,QAAQ,IAAI,MAAM,CAAC;AACvC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,GAAiB;AACrB,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,QAAsB;AAC3B,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAA4C;AAChD,SAAK,YAAY;AACjB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOU,UAAuD;AAC/D,UAAM,IAAiD,CAAC;AACxD,eAAW,KAAK,KAAK,SAAS;AAC5B,YAAM,MAAM,MAAM,QAAQ,EAAE,KAAK,IAC7B,IAAK,EAAE,MAAyC,KAAK,GAAG,CAAC,MACzD,OAAO,EAAE,KAAK;AAKlB,QAAE,EAAE,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG;AAAA,IAC9B;AACA,QAAI,KAAK,aAAa,OAAW,GAAE,OAAO,IAAI,KAAK;AACnD,QAAI,KAAK,cAAc,OAAW,GAAE,QAAQ,IAAI,KAAK;AACrD,QAAI,KAAK,cAAc,OAAW,GAAE,OAAO,IAAI,KAAK;AACpD,WAAO;AAAA,EACT;AACF;AAMA,IAAM,cAAN,MAAkB;AAAA,EAChB,YACmB,QACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,SAAwC;AACtC,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,UAAU;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAoB,QAA0C;AAClE,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,eAAe,KAAK,QAAQ,KAAK,UAAU;AAAA,MACjD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAoB,OAAqC;AACvD,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,YAAY,KAAK;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAwC;AACtC,WAAO,IAAI,cAAiB,KAAK,QAAQ,KAAK,UAAU;AAAA,EAC1D;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAgE;AAAA,EAC7F,YACmB,QACA,YACjB;AACA,UAAM;AAHW;AACA;AAAA,EAGnB;AAAA,EAJmB;AAAA,EACA;AAAA,EAKX,OAA4C;AAClD,WAAO,QAA0B,KAAK,QAAQ;AAAA,MAC5C,QAAQ;AAAA,MACR,MAAM,eAAe,KAAK,QAAQ,KAAK,UAAU;AAAA,MACjD,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAiD;AAAA,EAC9E,YACmB,QACA,YACA,OACjB;AACA,UAAM;AAJW;AACA;AACA;AAAA,EAGnB;AAAA,EALmB;AAAA,EACA;AAAA,EACA;AAAA,EAKX,OAA6B;AACnC,UAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,IAAI;AAC5E,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,OAAO;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,SAAS,EAAE,YAAY,KAAK,WAAW;AAAA,QACvC,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AACA,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,GAAG,eAAe,KAAK,QAAQ,KAAK,UAAU,CAAC,IAAI,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC;AAAA,MACnG,MAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAEA,IAAM,gBAAN,cAA+B,aAAiD;AAAA,EAC9E,YACmB,QACA,YACjB;AACA,UAAM;AAHW;AACA;AAAA,EAGnB;AAAA,EAJmB;AAAA,EACA;AAAA,EAKX,OAA6B;AACnC,UAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,EAAE,OAAO,IAAI;AAC5E,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI,OAAO;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,SAAS,EAAE,YAAY,KAAK,WAAW;AAAA,QACvC,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AACA,WAAO,QAAW,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,GAAG,eAAe,KAAK,QAAQ,KAAK,UAAU,CAAC,IAAI,mBAAmB,OAAO,SAAS,KAAK,CAAC,CAAC;AAAA,IACrG,CAAC;AAAA,EACH;AAAA,EAEA,KACE,aACA,YACkC;AAClC,WAAO,KAAK,KAAK,EAAE,KAAK,aAAa,UAAU;AAAA,EACjD;AACF;AAOA,SAAS,eAAe,QAA0B,YAA4B;AAC5E,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,WAAW;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,eAAa,OAAO,aAAa,SAAS;AAE1C,MAAI,CAAC,0BAA0B,KAAK,UAAU,GAAG;AAC/C,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,oBAAoB,UAAU;AAAA,MACvC,SAAS,EAAE,WAAW;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,YAAY,OAAO,aAAa,QAAQ,UAAU,EAAE;AAC7D;AAMO,SAAS,gBAAgB,QAA0B;AACxD,SAAO,SAAS,KAAK,YAAiC;AACpD,WAAO,IAAI,YAAY,QAAQ,UAAU;AAAA,EAC3C;AACF;;;AC3PO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,OAAkD;AACtD,aAAO,QAAgC,QAAQ;AAAA,QAC7C,QAAQ;AAAA,QACR,MAAM,QAAQ,UAAU;AAAA,MAC1B,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,OAAuD;AAClE,UAAI,MAAM,SAAS,OAAW,cAAa,MAAM,MAAM,SAAS;AAChE,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,QAAQ,UAAU;AAAA,QACxB,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,IAAI,MAA0C;AAClD,mBAAa,MAAM,SAAS;AAC5B,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,QAAQ,YAAY,IAAI,EAAE;AAAA,MAClC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,MAAc,OAAuD;AAChF,mBAAa,MAAM,SAAS;AAC5B,aAAO,QAAiB,QAAQ;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM,QAAQ,YAAY,IAAI,EAAE;AAAA,QAChC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC5CA,IAAM,iBAAiB;AAEvB,SAAS,mBAAmB,QAAkC;AAC5D,MAAI,OAAO,gBAAgB,UAAa,OAAO,YAAY,WAAW,GAAG;AACvE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAChB;AAEA,IAAM,cAAc,CAAC,QAA0B,SAAS,OACtD,YAAY,mBAAmB,MAAM,GAAG,kBAAkB,MAAM,EAAE;AAEpE,IAAM,aAAa,CAAC,QAA0B,MAAc,SAAS,OAAe;AAClF,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,UAAU,QAAQ,QAAQ;AAAA,MAC5C,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAIA,MAAI,SAAS,OAAO,SAAS,MAAM;AACjC,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,UAAU,QAAQ,cAAc;AAAA,MAClD,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,YAAY,QAAQ,IAAI,mBAAmB,IAAI,CAAC,GAAG,MAAM,EAAE;AACpE;AAEA,SAAS,kBAAkB,MAAoB;AAC7C,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,QAAQ,QAAQ,QAAQ;AAAA,MAC1C,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,OAAO,cAAc,YAAY,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,KAAK,YAAY,gBAAgB;AAChH,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,0DAA0D,cAAc;AAAA,MACjF,SAAS,EAAE,OAAO,aAAa,QAAQ,eAAe;AAAA,MACtD,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,OAAO,MAAgD,aAA4B;AAC1F,QAAM,OAAO,gBAAgB,SAAY,EAAE,MAAM,YAAY,IAAI,CAAC;AAClE,MAAI,gBAAgB,KAAM,QAAO,gBAAgB,UAAa,KAAK,SAAS,cAAc,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,IAAI;AACnH,MAAI,OAAO,SAAS,SAAU,QAAO,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI;AAC1D,SAAO,IAAI,KAAK,CAAC,IAA8B,GAAG,IAAI;AACxD;AAGO,SAAS,iBAAiB,QAA0B,QAAgB;AACzE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,OAAO,MAAc,MAAgD,UAAyB,CAAC,GAAqC;AACxI,wBAAkB,IAAI;AACtB,YAAM,OAAO,IAAI,SAAS;AAC1B,WAAK,OAAO,QAAQ,OAAO,MAAM,QAAQ,WAAW,GAAG,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,MAAM;AACtF,WAAK,OAAO,QAAQ,IAAI;AACxB,UAAI,QAAQ,gBAAgB,OAAW,MAAK,OAAO,eAAe,QAAQ,WAAW;AACrF,WAAK,OAAO,UAAU,QAAQ,WAAW,OAAO,SAAS,OAAO;AAChE,UAAI,QAAQ,aAAa,OAAW,MAAK,OAAO,YAAY,KAAK,UAAU,QAAQ,QAAQ,CAAC;AAC5F,aAAO,QAAuB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,WAAW,QAAQ,QAAQ,UAAU,GAAG,MAAM,KAAK,CAAC;AAAA,IACpH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,gBAAgB,MAAc,SAAyD;AAC3F,wBAAkB,IAAI;AACtB,uBAAiB,SAAS,SAAS;AACnC,aAAO,QAAmB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,QAAQ,eAAe;AAAA,QAChD,MAAM,EAAE,MAAM,WAAW,QAAQ,WAAW,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC,EAAG;AAAA,MACxH,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,UAA+B,CAAC,GAAoD;AAC7F,aAAO,QAAsC,QAAQ;AAAA,QACnD,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,QAAQ,UAAU;AAAA,QAC3C,GAAI,QAAQ,WAAW,SAAY,EAAE,OAAO,EAAE,QAAQ,QAAQ,OAAO,EAAE,IAAI,CAAC;AAAA,MAC9E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,MAAgD;AAC3D,wBAAkB,IAAI;AACtB,aAAO,QAAuB,QAAQ,EAAE,QAAQ,UAAU,MAAM,WAAW,QAAQ,QAAQ,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC3H;AAAA,EACF;AACF;AAGO,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,MAAM,cAA+D;AACnE,aAAO,QAAsC,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,EAAE,CAAC;AAAA,IACnG;AAAA;AAAA,IAGA,MAAM,UAAU,MAAgD;AAC9D,aAAO,QAAuB,QAAQ,EAAE,QAAQ,OAAO,MAAM,WAAW,QAAQ,IAAI,EAAE,CAAC;AAAA,IACzF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,aAAa,MAAc,UAA+B,CAAC,GAAqC;AACpG,aAAO,QAAuB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;AAAA,IACjH;AAAA;AAAA,IAGA,MAAM,aAAa,MAAc,SAAgE;AAC/F,aAAO,QAAuB,QAAQ,EAAE,QAAQ,SAAS,MAAM,WAAW,QAAQ,IAAI,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1G;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,aAAa,MAAc,UAA+B,CAAC,GAAqC;AACpG,aAAO,QAAuB,QAAQ;AAAA,QACpC,QAAQ;AAAA,QACR,MAAM,WAAW,QAAQ,IAAI;AAAA,QAC7B,GAAI,QAAQ,UAAU,OAAO,EAAE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,KAAK,QAAgB;AACnB,aAAO,iBAAiB,QAAQ,MAAM;AAAA,IACxC;AAAA,EACF;AACF;;;AC/OA,IAAM,UAAU;AAChB,IAAM,UAAkE;AAAA,EACtE,IAAI,CAAC,MAAM,8BAA8B,KAAK,CAAC;AAAA,EAC/C,IAAI,CAAC,MAAM,0BAA0B,KAAK,CAAC;AAAA,EAC3C,IAAI,CAAC,MAAM,MAAM;AAAA,EACjB,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC1B,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EACjC,eAAe,CAAC,MAAM,QAAQ,KAAK,CAAC;AAAA,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,CAAC;AAC9B;AAGO,SAAS,iBAAiB,OAAgB,UAA4C;AAC3F,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,SAAO,aAAa,SAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,QAAQ,EAAE,KAAK;AAC/E;AAMO,SAAS,qBAAqB,OAAgB,UAAyC;AAC5F,MAAI,iBAAiB,OAAO,QAAQ,EAAG;AACvC,QAAM,IAAI,OAAO;AAAA,IACf,MAAM;AAAA,IACN,SACE,aAAa,SACT,sFACA,iCAAiC,QAAQ;AAAA,IAC/C,SAAS,EAAE,OAAO,kBAAkB,QAAQ,2BAA2B,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC,EAAG;AAAA,IACvH,gBACE,aAAa,OAAO,uBAAuB;AAAA,EAC/C,CAAC;AACH;;;ACiDA,SAASA,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,gBAAgB,UAAa,OAAO,YAAY,WAAW,GAAG;AACvE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAChB;AAEA,IAAM,gBAAgB,CAAC,QAA0B,SAAS,OACxD,YAAYA,oBAAmB,MAAM,GAAG,oBAAoB,MAAM,EAAE;AAE/D,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,GAAG,qBAAqB,MAAM;AAAA,IAC9B,WAAW;AAAA;AAAA,MAET,MAAM,OAA0D;AAC9D,eAAO,QAAwC,QAAQ,EAAE,QAAQ,OAAO,MAAM,cAAc,MAAM,EAAE,CAAC;AAAA,MACvG;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,OAAO,OAAuE;AAClF,6BAAqB,MAAM,gBAAgB,MAAM,QAAQ;AACzD,eAAO,QAAyB,QAAQ,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,GAAG,MAAM,MAAM,CAAC;AAAA,MACtG;AAAA;AAAA,MAGA,MAAM,IAAI,YAAwD;AAChE,eAAO,QAAyB,QAAQ;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,QAClE,CAAC;AAAA,MACH;AAAA;AAAA,MAGA,MAAM,OAAO,YAAoB,OAAuE;AAGtG,YAAI,MAAM,mBAAmB,OAAW,sBAAqB,MAAM,cAAc;AACjF,eAAO,QAAyB,QAAQ;AAAA,UACtC,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,UAChE,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,OAAO,YAA+D;AAC1E,eAAO,QAAgC,QAAQ;AAAA,UAC7C,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,EAAE;AAAA,QAClE,CAAC;AAAA,MACH;AAAA;AAAA,MAGA,MAAM,KAAK,YAAkE;AAC3E,eAAO,QAAmC,QAAQ;AAAA,UAChD,QAAQ;AAAA,UACR,MAAM,cAAc,QAAQ,IAAI,mBAAmB,UAAU,CAAC,OAAO;AAAA,QACvE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;ACgDA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,wBAAwB,QAA0B;AAChE,SAAO;AAAA;AAAA,IAEL,MAAM,MAAM,OAA2F;AACrG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,kBAAkB;AAAA,QAC1C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAA2D;AAC/D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY;AAAA,MACtC,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,SAAsD;AAC9D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,OAAO,OAAO,CAAC,CAAC,EAAE;AAAA,MAC7E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,MAAM,OAAoG;AAC9G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,kBAAkB;AAAA,QAC1C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,YAAY,MAA4G;AAC5H,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,oBAAoB;AAAA,QAC5C,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,aAAa,WAA0D;AAC3E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,QAAQ;AAAA,MACrF,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,cAAc,WAAmB,OAA2F;AAChI,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,SAAS;AAAA,QACpF,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,cAAc,WAAkF;AACpG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,sBAAsB,mBAAmB,SAAS,CAAC,EAAE;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtPA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAML,MAAM,eAAe,OAAwC,MAAkE;AAC7H,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,qBAAqB;AAAA,QAC7C,SAAS;AAAA,QACT,SAAS,EAAE,gBAAgB,SAAS,SAAS,qBAAqB,oBAAoB;AAAA,MACxF,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,OAA+D;AAC1E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,MAAiL;AAC1L,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,MAAiD;AACzD,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,MAAiD;AAC5D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,MAAM,OAA8C,MAAc,SAAoB,SAA6D;AACjJ,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,IAAI,CAAC,SAAS;AAAA,QACtE,MAAM,EAAE,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,GAAI,GAAI,WAAW,CAAC,EAAG;AAAA,MAC5E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC5DA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA,IAEL,MAAM,UAAkD;AACtD,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,QAAQ;AAAA,MAClC,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,MAAwG;AACjH,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,UAAU;AAAA,QAClC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,OAA2D;AACtE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,UAAU;AAAA,QAClC,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,SAAS,OAAqE;AAClF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,mBAAmB;AAAA,QAC3C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,UAAmD;AAC3D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACpE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,UAAkB,OAA2D;AACxF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,QAClE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,UAAgD;AAC3D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACpE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QAAQ,UAAkB,SAAwE;AACtG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,YAAY,mBAAmB,QAAQ,CAAC,UAAU;AAAA,QAC1E,GAAI,YAAY,SAAY,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC/HA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,mBAAmB,QAA0B;AAC3D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,MAAM,MAAM,MAAqE;AAC/E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,KAAK,MAAgG;AACzG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,YAAM,UAAU,MAAM,gBAAgB;AACtC,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,GAAM,EAAE,YAAY;AAClE,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,WAAW;AAAA,QACnC,OAAO,EAAE,OAAO,OAAO,OAAO,MAAM,SAAS,IAAI;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtCO,SAAS,kBAAkB,QAA0B;AAC1D,SAAO;AAAA;AAAA,IAEL,MAAM,OAA8C;AAClD,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,MAAM;AAAA,MACtB,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,SAAyC;AACjD,mBAAa,SAAS,KAAK;AAC3B,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,QAAQ,mBAAmB,OAAO,CAAC,EAAE;AAAA,MACrD,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,QAAQ,OAAuC;AACnD,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,QAAQ,mBAAmB,KAAK,CAAC,UAAU;AAAA,MAC3D,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,UAAkC;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,QAAQ,KAAK;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AC8EA,SAAS,qBAAqB,QAA0B;AACtD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAGqC;AAC9C,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,SAAS,GAAG,OAAO,KAAK,CAAC;AAAA,IACjF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,OAAO,OAAmG;AAC9G,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,SAAS,GAAG,MAAM,MAAM,CAAC;AAAA,IAClF;AAAA;AAAA,IAGA,MAAM,OAAO,QAA8C;AACzD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,WAAW,mBAAmB,MAAM,CAAC,EAAE,EAAE,CAAC;AAAA,IACrG;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA0B;AACrD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAAoF;AAC7F,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,QAAQ,GAAG,OAAO,KAAK,CAAC;AAAA,IAChF;AAAA;AAAA,IAGA,MAAM,IAAI,SAA8C;AACtD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,UAAU,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,IAClG;AAAA,EAEF;AACF;AAEA,SAAS,yBAAyB,QAA0B;AAC1D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,MAAM,MAAmH;AAC7H,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,WAAW,GAAG,OAAO,KAAK,CAAC;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,QAA0B;AACtD,SAAO;AAAA,IACL,OAAO;AAAA;AAAA,MAEL,MAAM,OAAuD;AAC3D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,aAAa,EAAE,CAAC;AAAA,MACxE;AAAA;AAAA,MAGA,MAAM,MAAM,OAA6H;AACvI,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,aAAa,GAAG,MAAM,MAAM,CAAC;AAAA,MACtF;AAAA;AAAA,MAGA,MAAM,IAAI,SAAkD;AAC1D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,eAAe,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,MACvG;AAAA;AAAA,MAGA,MAAM,OAAO,SAAiB,MAAiF;AAC7G,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,eAAe,mBAAmB,OAAO,CAAC,EAAE,GAAG,GAAI,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,MAC3I;AAAA,IACF;AAAA,IAEA,cAAc;AAAA;AAAA,MAEZ,MAAM,OAAyD;AAC7D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,oBAAoB,EAAE,CAAC;AAAA,MAC/E;AAAA;AAAA,MAGA,MAAM,OAAO,OAA6D;AACxE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,oBAAoB,GAAG,MAAM,MAAM,CAAC;AAAA,MAC7F;AAAA;AAAA,MAGA,MAAM,IAAI,OAAkD;AAC1D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,sBAAsB,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,MAC5G;AAAA;AAAA,MAGA,MAAM,UAAU,OAAe,OAA6D;AAC1F,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,sBAAsB,mBAAmB,KAAK,CAAC,EAAE,GAAG,MAAM,MAAM,CAAC;AAAA,MAC3H;AAAA;AAAA,MAGA,MAAM,OAAO,OAAwD;AACnE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,sBAAsB,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,MAC/G;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAA0B;AACnD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,IAAI,SAA6C;AACrD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,EAAE,YAAY,QAAQ,EAAE,CAAC;AAAA,IACjG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,KAAK,OAAmE;AAC5E,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,qBAAqB,GAAG,MAAM,MAAM,CAAC;AAAA,IAC9F;AAAA;AAAA,IAGA,MAAM,QAAgC;AACpC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,GAAG,MAAM,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,QAA0B;AACzD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,MAAM,MAAwC;AAC5C,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,aAAa,EAAE,CAAC;AAAA,IACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,IAAI,OAA8F;AACtG,aAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,aAAa,GAAG,MAAM,MAAM,CAAC;AAAA,IACvF;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,QAA0B;AACzD,SAAO;AAAA;AAAA,IAEL,SAAS,qBAAqB,MAAM;AAAA;AAAA,IAEpC,QAAQ,oBAAoB,MAAM;AAAA;AAAA,IAElC,UAAU,yBAAyB,MAAM;AAAA;AAAA,IAEzC,MAAM,qBAAqB,MAAM;AAAA;AAAA,IAEjC,MAAM,kBAAkB,MAAM;AAAA;AAAA,IAE9B,YAAY,wBAAwB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO1C,MAAM,MAA8B;AAClC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,KAAK,EAAE,CAAC;AAAA,IAChE;AAAA,EACF;AACF;;;ACtPO,SAAS,gBAAgB,QAA0B;AACxD,SAAO;AAAA,IACL,SAAS;AAAA;AAAA,MAEP,MAAM,MAAoC;AACxC,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,MAC/D;AAAA;AAAA,MAGA,MAAM,OAAO,OAA2D;AACtE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,MAAM,QAAQ,IAAI,GAAG,MAAM,MAAM,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,IAEA,UAAU;AAAA;AAAA,MAER,MAAM,OAAoD;AACxD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,aAAa,EAAE,CAAC;AAAA,MACxE;AAAA;AAAA,MAGA,MAAM,OAAO,WAA4D;AACvE,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,iBAAiB,mBAAmB,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,MACnH;AAAA;AAAA,MAGA,MAAM,YAAoD;AACxD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,wBAAwB,EAAE,CAAC;AAAA,MACpF;AAAA,IACF;AAAA;AAAA,IAGA,WAAW;AAAA,MACT,MAAM,OAAqD;AACzD,eAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,QAAQ,eAAe,EAAE,CAAC;AAAA,MAC1E;AAAA,MAEA,MAAM,OAAO,OAAqF;AAChG,eAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,eAAe,GAAG,MAAM,MAAM,CAAC;AAAA,MACxF;AAAA,MAEA,MAAM,OAAO,SAAgD;AAC3D,eAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAQ,iBAAiB,mBAAmB,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,MAC5G;AAAA,IACF;AAAA,EACF;AACF;;;ACgBO,IAAM,uBAAuB;AAAA,EAClC,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,2BAA2B;AAC7B;AAEA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,kBAAkB,QAA0B;AACnD,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,YAAoB,SAAiF;AAC9G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,OAAO;AAAA,QAC1E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,KAAK,YAAoB,OAA+C;AAC5E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,SAAS,mBAAmB,KAAK,CAAC,EAAE;AAAA,MACzG,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAAoB,OAA+C;AAC9E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,SAAS,mBAAmB,KAAK,CAAC,SAAS;AAAA,MAChH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,SAA2E;AACpF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC;AAAA,IAChG;AAAA;AAAA,IAGA,MAAM,OAAO,UAA4D;AACvE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC;AAAA,IACjG;AAAA;AAAA,IAGA,MAAM,KAAK,YAAiD;AAC1D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAAoB,SAA2D;AAC1F,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,QACrE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,YAA6D;AACxE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QAAQ,YAAoB,iBAA0C,CAAC,GAAmC;AAC9G,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,aAAa,mBAAmB,UAAU,CAAC,OAAO;AAAA,QAC1E,MAAM,EAAE,eAAe;AAAA,MACzB,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,kBAAkB,MAAM;AAAA,EAChC;AACF;;;AClKO,IAAM,wBAAwB;AAAA,EACnC,WAAW;AAAA,EACX,gBAAgB;AAClB;AAEA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,wBAAwB,QAA0B;AAChE,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,SAA6E;AACtF,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC;AAAA,IACjG;AAAA;AAAA,IAGA,MAAM,OAAO,WAA+D;AAC1E,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;AAAA,IACnG;AAAA;AAAA,IAGA,MAAM,KAAK,aAAmD;AAC5D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,MACzE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,aAAqB,SAA6D;AAC7F,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,QACvE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,OAAO,aAA8D;AACzE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,EAAE;AAAA,MACzE,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,IAAI,aAAmD;AAC3D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,MAAM;AAAA,MAC7E,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,MAAM,aAAmD;AAC7D,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,cAAc,mBAAmB,WAAW,CAAC,QAAQ;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACvKO,SAAS,oBAAoB,QAA0B;AAC5D,SAAO;AAAA;AAAA,IAEL,WAAW,uBAAuB,MAAM;AAAA;AAAA,IAExC,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACF;;;ACOA,gBAAuB,eACrB,MAC+B;AAC/B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AAEb,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,gBAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAGhD,UAAI;AACJ,cAAQ,WAAW,qBAAqB,MAAM,OAAO,IAAI;AACvD,cAAM,WAAW,OAAO,MAAM,GAAG,QAAQ;AACzC,iBAAS,OAAO,MAAM,QAAQ,EAAE,QAAQ,aAAa,EAAE;AACvD,cAAM,UAAU,YAAY,QAAQ;AACpC,YAAI,YAAY,KAAM;AACtB,YAAI,YAAY,SAAU;AAC1B,cAAM,cAAiB,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,KAAK,SAAS,GAAG;AACnB,YAAM,UAAU,YAAY,IAAI;AAChC,UAAI,YAAY,QAAQ,YAAY,UAAU;AAC5C,cAAM,cAAiB,OAAO;AAAA,MAChC;AAAA,IACF;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACF;AAEA,SAAS,qBAAqB,QAAwB;AACpD,QAAM,KAAK,OAAO,QAAQ,MAAM;AAChC,QAAM,OAAO,OAAO,QAAQ,UAAU;AACtC,MAAI,OAAO,GAAI,QAAO;AACtB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO,KAAK,IAAI,IAAI,IAAI;AAC1B;AAGA,SAAS,YAAY,UAAiC;AACpD,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,GAAG,EAAG;AAC1B,QAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,gBAAU,KAAK,KAAK,MAAM,CAAC,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,SAAO,UAAU,KAAK,IAAI;AAC5B;AAEA,SAAS,cAAiB,SAAoB;AAC5C,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACaA,SAAS,WAAW,OAAgD;AAClE,SAAO,EAAE,QAAQ,MAAM,QAAQ,GAAG,MAAM,OAAO;AACjD;AAGO,IAAM,kBAAkB;AAAA,EAC7B,sBAAsB;AACxB;AAEA,SAASC,oBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,kBAAkB,QAA0B;AAC1D,SAAO;AAAA;AAAA,IAEL,MAAM,KAAK,MAAiH;AAC1H,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ,EAAE,QAAQ,OAAO,MAAM,YAAY,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC;AAAA,IAChG;AAAA;AAAA,IAGA,MAAM,KAAK,SAA2D;AACpE,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,EAAE;AAAA,MACvE,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,OAAO,SAA8B,OAAuD;AAChG,YAAM,OAAOA,oBAAmB,MAAM;AACtC,aAAO,QAAQ,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,SAAS;AAAA,QAC5E,MAAM,WAAW,KAAK;AAAA,MACxB,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,OAAO,aAAa,SAA8B,OAAmE;AACnH,YAAM,OAAOA,oBAAmB,MAAM;AACtC,YAAM,WAAW,MAAM,cAAc,QAAQ;AAAA,QAC3C,QAAQ;AAAA,QACR,MAAM,YAAY,MAAM,gBAAgB,mBAAmB,OAAO,CAAC,gBAAgB;AAAA,QACnF,MAAM,WAAW,KAAK;AAAA,QACtB,QAAQ;AAAA,MACV,CAAC;AAED,aAAO,eAA+B,SAAS,IAAkC;AAAA,IACnF;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,QAA0B;AAC7D,SAAO;AAAA;AAAA,IAEL,MAAM,kBAAkB,MAAM;AAAA,EAChC;AACF;;;AC3IA,SAASC,qBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,gBAAgB,QAA0B;AACxD,SAAO;AAAA;AAAA,IAEL,MAAM,MAAM,OAAmD;AAC7D,YAAM,OAAOA,qBAAmB,MAAM;AACtC,YAAM,OAAqD;AAAA,QACzD,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,MACxE;AACA,UAAI,MAAM,UAAU,OAAW,MAAK,QAAQ,MAAM;AAClD,aAAO,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,MAAM,YAAY,MAAM,eAAe,GAAG,KAAK,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;;;ACNO,IAAM,gBAAgB;AAAA;AAAA,EAE3B,WAAW,YAAmC;AAC5C,WAAO,eAAe,UAAU;AAAA,EAClC;AAAA;AAAA,EAEA,eAA8B;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA,EAEA,cAAc,SAAgC;AAC5C,WAAO,2BAA2B,OAAO;AAAA,EAC3C;AAAA;AAAA,EAEA,iBAAiB,aAAoC;AACnD,WAAO,6BAA6B,WAAW;AAAA,EACjD;AAAA;AAAA,EAEA,oBAAoB,YAAmC;AACrD,WAAO,+BAA+B,UAAU;AAAA,EAClD;AAAA;AAAA,EAEA,SAAS,aAAoC;AAC3C,WAAO,aAAa,WAAW;AAAA,EACjC;AACF;AAiCA,SAASC,qBAAmB,QAAkC;AAC5D,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,OAAO;AAChB;AAGA,gBAAgB,aACd,QACA,OACA,SACA,QAC8C;AAC9C,QAAM,OAAOA,qBAAmB,MAAM;AACtC,QAAM,QAA+D,EAAE,MAAM;AAC7E,MAAI,QAAQ,OAAQ,OAAM,SAAS,KAAK,UAAU,QAAQ,MAAM;AAChE,QAAM,WAAW,MAAM,cAAc,QAAQ;AAAA,IAC3C,QAAQ;AAAA,IACR,MAAM,YAAY,MAAM,oBAAoB;AAAA,IAC5C;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACD,mBAAiB,SAAS,eAAiC,SAAS,IAAkC,GAAG;AACvG,QAAI,OAAO,SAAS,QAAQ,QAAQ,QAAS;AAC7C,QAAI,OAAQ,MAAkC,cAAc,SAAU;AACtE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,sBAAsB,QAA0B;AAC9D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcL,UAAuB,OAAsB,UAA4B,CAAC,GAA4B;AACpG,MAAAA,qBAAmB,MAAM;AACzB,YAAM,SAAS,EAAE,OAAO,MAAM;AAC9B,YAAM,UAAU,MAAoD,aAAgB,QAAQ,OAAO,SAAS,MAAM;AAElH,UAAI,SAA8D;AAClE,aAAO;AAAA,QACL,CAAC,OAAO,aAAa,IAAI;AACvB,mBAAS,QAAQ;AACjB,iBAAO;AAAA,QACT;AAAA,QACA,QAAQ;AACN,iBAAO,QAAQ;AACf,eAAK,QAAQ,OAAO,MAAS;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACpJA,SAAS,wBAAyC;AAe3C,SAAS,eAAe,QAA6C;AAC1E,MAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,WAAW,GAAG;AAC7E,WAAO;AAAA,EACT;AAGA,SAAO,iBAAiB;AAAA,IACtB,MAAM;AAAA,IACN,SAAS,OAAO;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,GAAI,OAAO,WAAW,SAAY,EAAE,cAAc,OAAO,OAAO,IAAI,CAAC;AAAA,IACrE,GAAI,OAAO,UAAU,SAAY,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC9D,CAAC;AACH;AAOO,SAAS,mBAA0B;AACxC,QAAM,IAAI,OAAO;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,SAAS,CAAC;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AACH;;;AC/CA,SAAS,OAAO,2BAA+D;AAUxE,SAAS,uBAAuB;AACrC,SAAO;AAAA;AAAA,IAEL,WAAW,oBAAoB;AAAA,EACjC;AACF;;;ACkCA,SAAS,wBAAyC;;;AClD3C,IAAM,uBAAuB;AAW7B,IAAM,8BAA8B;AAM3C,IAAM,qBAAqB;AAQpB,SAAS,kBAAkB,MAAsB;AACtD,QAAM,SAAS,KAAK,WAAW,2BAA2B,IAAI,KAAK,MAAM,4BAA4B,MAAM,IAAI;AAC/G,MAAI,OAAO,WAAW,KAAK,OAAO,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,GAAG;AACpF,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,OAAO;AAAA,MACzB,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO,GAAG,2BAA2B,GAAG,MAAM;AAChD;AAIO,IAAM,2BAA2B;AAQjC,IAAM,uBAAyD;AAAA,EACpE,IAAI;AAAA,EACJ,eAAe;AAAA,EACf,OAAO;AAAA,EACP,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,IAAI;AACN;AAqCA,SAAS,eAAe,cAAwC;AAC9D,MAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,GAAG;AAC/D,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SACE;AAAA,MACF,SAAS,EAAE,OAAO,eAAe;AAAA,MACjC,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoBO,SAAS,qBAAqB,OAA8B;AACjE,UAAQ,MAAM,UAAU;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,SAAS;AACZ,qBAAe,MAAM,YAAY;AAEjC,2BAAqB,MAAM,gBAAgB,MAAM,QAAQ;AACzD,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,iBAAiB,MAAM;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,eAAe,MAAM;AAAA,QACrB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH,KAAK,MAAM;AACT,UAAI,MAAM,MAAM,SAAS,GAAG,GAAG;AAC7B,cAAM,IAAI,OAAO;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,SAAS,EAAE,OAAO,QAAQ;AAAA,UAC1B,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AACA,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,IACA,KAAK;AACH,aAAO,KAAK,UAAU;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,OAAO,MAAM;AAAA,MACf,CAAC;AAAA,EACL;AACF;AAIO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,GAAG,oBAAoB,GAAG,KAAK;AACxC;;;ADyEO,SAAS,aAAa,SAAyC;AACpE,QAAM,UAAU,eAAe,QAAQ,SAAS,QAAQ,OAAO;AAC/D,QAAM,SAA2B;AAAA,IAC/B;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,aAAa,QAAQ;AAAA,EACvB;AACA,QAAM,aAAa,eAAe,MAAM;AACxC,SAAO;AAAA,IACL,MAAM,gBAAgB,MAAM;AAAA,IAC5B,UAAU,sBAAsB,MAAM;AAAA,IACtC,SAAS,qBAAqB,MAAM;AAAA,IACpC,YAAY,wBAAwB,MAAM;AAAA,IAC1C,WAAW,uBAAuB,MAAM;AAAA,IACxC,UAAU,sBAAsB,MAAM;AAAA,IACtC,OAAO,mBAAmB,MAAM;AAAA,IAChC,MAAM,kBAAkB,MAAM;AAAA,IAC9B,KAAK,iBAAiB,MAAM;AAAA,IAC5B,IAAI,gBAAgB,MAAM;AAAA,IAC1B,QAAQ,oBAAoB,MAAM;AAAA,IAClC,SAAS,qBAAqB,MAAM;AAAA,IACpC,IAAI,gBAAgB,MAAM;AAAA,IAC1B,UAAU,sBAAsB,MAAM;AAAA;AAAA;AAAA;AAAA,IAItC,IAAI,OAAO;AACT,UAAI,eAAe,KAAM,QAAO,iBAAiB;AACjD,aAAO;AAAA,IACT;AAAA,IACA,YAAY,qBAAqB;AAAA,IACjC,MAAM,iBAAiB,MAAM;AAAA,IAC7B,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC;AAAA,EACrC;AACF;","names":["requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug","requireProjectSlug"]}