@keboola/api-client 31.0.0 → 33.0.0

package/dist/sdk/configurations/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_configurations = require("../../configurations-CujCwDcB.cjs");
+const require_configurations = require("../../configurations-Ck-mNB_E.cjs");
 exports.createConfigurationSdk = require_configurations.createConfigurationSdk;

package/dist/sdk/configurations/index.d.cts

@@ -1,7 +1,7 @@
-import { I as createStorageClient, M as RegisteredComponentId, N as registry, Ut as createDefaultBranch } from "../../index-cu8THqZV.cjs";
-import { Mn as UpdateConfigurationInput, fn as CreateConfigurationInput, tn as BaseComponentConfig, un as ConfigurationPath } from "../../types-DG_FlLJt.cjs";
-import { t as createEncryptionClient } from "../../index-D_TnbEtp.cjs";
-import { t as Project } from "../../project-CRrsxSAK.cjs";
+import { B as createStorageClient, I as RegisteredComponentId, L as registry, Wt as createDefaultBranch } from "../../index-DIVvL54G.cjs";
+import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-D6ocCyGh.cjs";
+import { t as createEncryptionClient } from "../../index-C7gxKoDF.cjs";
+import { t as Project } from "../../project-D25GH8zK.cjs";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {

package/dist/sdk/configurations/index.d.ts

@@ -1,7 +1,7 @@
-import { I as createStorageClient, M as RegisteredComponentId, N as registry, Ut as createDefaultBranch } from "../../index-BR2Fu-Wo.js";
-import { Mn as UpdateConfigurationInput, fn as CreateConfigurationInput, tn as BaseComponentConfig, un as ConfigurationPath } from "../../types-DMMMQuNt.js";
-import { t as createEncryptionClient } from "../../index-NicJZIzu.js";
-import { t as Project } from "../../project-5SLw86eZ.js";
+import { B as createStorageClient, I as RegisteredComponentId, L as registry, Wt as createDefaultBranch } from "../../index-B0V1pJAa.js";
+import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-C4mr0lop.js";
+import { t as createEncryptionClient } from "../../index-CVqk63at.js";
+import { t as Project } from "../../project-Bh954iOA.js";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {

package/dist/sdk/configurations/index.js

@@ -1,2 +1,2 @@
-import { t as createConfigurationSdk } from "../../configurations-Byt59bIa.js";
+import { t as createConfigurationSdk } from "../../configurations-ZwBXilW-.js";
 export { createConfigurationSdk };

package/dist/sdk/developerPortal/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_dedupe = require("../../dedupe-CiskLkGR.cjs");
-const require_createStore = require("../../createStore-MQbboXcB.cjs");
-const require_createFetchClient = require("../../createFetchClient-B9Cv0W9f.cjs");
-const require_credential = require("../../credential-D-tX9gP4.cjs");
-const require_developerPortalClient = require("../../developerPortalClient-B7lNR5q0.cjs");
+const require_store = require("../../store-xS-Cu_VS.cjs");
+const require_createFetchClient = require("../../createFetchClient-DvZvD31l.cjs");
+const require_credential = require("../../credential-D-X5QQrM.cjs");
+const require_developerPortalClient = require("../../developerPortalClient-Db2XVB_o.cjs");
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -103,7 +103,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 * apps-api is its own identity domain.
 */
 const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
-	const store = require_createStore.createStore(initialTokens);
+	const store = require_store.createStore(initialTokens);
 	store.subscribe((value) => onTokensChange?.(value));
 	const getTokens = () => store.get();
 	const requireTokens = (action) => {

package/dist/sdk/developerPortal/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,oBAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/developerPortal/index.d.cts

@@ -1,6 +1,7 @@
-import { T as MiddlewareFn } from "../../index-B-frWtGW.cjs";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-B2El99VY.cjs";
-import { t as DeveloperPortalTokens } from "../../index-BfVv8isU.cjs";
+import { E as MiddlewareFn } from "../../index-DhVFuQDv.cjs";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-B6JJCta-.cjs";
+import { t as DeveloperPortalTokens } from "../../index-exNi3I2Q.cjs";
+import { n as Listener } from "../../emitter-dLF1Fyfg.cjs";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
@@ -1351,7 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
   session: {
     set: (result: LoginSuccess) => void;
     get: () => DeveloperPortalTokens | null;
-    subscribe: (listener: (value: DeveloperPortalTokens | null) => void) => () => void;
+    subscribe: (listener: Listener<DeveloperPortalTokens | null>) => () => void;
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;

package/dist/sdk/developerPortal/index.d.ts

@@ -1,6 +1,7 @@
-import { T as MiddlewareFn } from "../../index-Ds8e0l7-.js";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-BMsK6T5k.js";
-import { t as DeveloperPortalTokens } from "../../index-CYMAwD3E.js";
+import { E as MiddlewareFn } from "../../index-DVhTNwvu.js";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-DHqIJKwx.js";
+import { t as DeveloperPortalTokens } from "../../index-ChMtULt4.js";
+import { n as Listener } from "../../emitter-dLF1Fyfg.js";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
@@ -1351,7 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
   session: {
     set: (result: LoginSuccess) => void;
     get: () => DeveloperPortalTokens | null;
-    subscribe: (listener: (value: DeveloperPortalTokens | null) => void) => () => void;
+    subscribe: (listener: Listener<DeveloperPortalTokens | null>) => () => void;
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;

package/dist/sdk/developerPortal/index.js

@@ -1,8 +1,8 @@
 import { t as dedupe } from "../../dedupe-DYIHgZoG.js";
-import { i as createStore } from "../../createStore-BNiCRQXa.js";
-import { o as HttpHeader } from "../../createFetchClient-B1h3-p65.js";
-import { n as isUnauthorized } from "../../credential-dKxArMic.js";
-import { t as createDeveloperPortalClient } from "../../developerPortalClient-5ABcxz1U.js";
+import { t as createStore } from "../../store-C9FQCHGe.js";
+import { s as HttpHeader } from "../../createFetchClient-DdyZMhxO.js";
+import { n as isUnauthorized } from "../../credential-Bxv7yxOZ.js";
+import { t as createDeveloperPortalClient } from "../../developerPortalClient-jk46sjwP.js";
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the

package/dist/sdk/queryService/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_jobStatus = require("../../jobStatus-kQ9JqF8t.cjs");
+const require_jobStatus = require("../../jobStatus-0_Y3Sr4i.cjs");
 const require_QueryJobTimeoutError = require("../../QueryJobTimeoutError-CVNPdCWX.cjs");
 const require_ValidationError = require("../../ValidationError-h5qvwahi.cjs");
 //#region src/sdks/queryService/queryServiceSdk.ts

package/dist/sdk/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-cu8THqZV.cjs";
+import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-DIVvL54G.cjs";
 export { ExecuteQueryOptions, WaitForJobOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-BR2Fu-Wo.js";
+import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-B0V1pJAa.js";
 export { ExecuteQueryOptions, WaitForJobOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.js

@@ -1,4 +1,4 @@
-import { i as poll, t as jobStatus } from "../../jobStatus-DbMupQEK.js";
+import { i as poll, t as jobStatus } from "../../jobStatus-PSZJMTiA.js";
 import { r as QueryJobError, t as QueryJobTimeoutError } from "../../QueryJobTimeoutError-C7JbNGOM.js";
 import { t as ValidationError } from "../../ValidationError-CzPWydEb.js";
 //#region src/sdks/queryService/queryServiceSdk.ts

package/dist/sdk/semanticLayer/index.cjs

@@ -2,6 +2,163 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_concurrent = require("../../concurrent-tbiIa0UL.cjs");
 const require_generateUUID = require("../../generateUUID-C6qKBPIv.cjs");
 let zod = require("zod");
+//#region src/sdks/semanticLayer/errorMessage.ts
+/**
+* The message out of a metastore error body.
+*
+* - The metastore reports what is actually wrong with a write only inside `errors[].message`
+*   (`missing property 'fqn'`). The HTTP status and the response's own message say no more than
+*   "Validation failed", so a caller that renders those alone tells a user nothing actionable.
+* - Every shape that is not that envelope returns `undefined` rather than a placeholder, so the
+*   caller keeps its own fallback (`?? error.message`) instead of rendering a stand-in for one.
+* - Only the first error: the metastore reports fields one at a time, so a list would be a list
+*   of one.
+*/
+const metastoreErrorMessage = (data) => {
+	if (typeof data !== "object" || data === null) return void 0;
+	const errors = data.errors;
+	if (!Array.isArray(errors)) return void 0;
+	const first = errors[0];
+	if (typeof first !== "object" || first === null) return void 0;
+	const message = first.message;
+	return typeof message === "string" && message ? message : void 0;
+};
+//#endregion
+//#region src/sdks/semanticLayer/vocabulary.ts
+/**
+* The closed value sets the metastore accepts inside a semantic object's `data`.
+*
+* - Each one is the single runtime source for a union in `./types`, which derives the type from
+*   the array here. A value cannot exist in the type and be missing from the list a dropdown or
+*   a validator is built from.
+* - The addressing vocabulary (`SEMANTIC_OBJECT_TYPE`, `MODEL_CHILD_OBJECT_TYPES`) is a
+*   different axis — which object a call targets, not what may sit inside one — and stays beside
+*   the SDK methods that take it.
+* - This file imports nothing: `./types` reads it, never the reverse.
+*/
+/**
+* The dialects the metastore accepts, exactly as it spells them. A lowercase value is
+* rejected with `422 value must be one of 'Snowflake', 'BigQuery'`, which surfaces only as a
+* generic "Validation failed" — so callers need the real set rather than a bare `string`.
+*
+* `SemanticModelData.sql_dialect` stays `string` for now: narrowing it would break any caller
+* passing a `string` variable, which is a major bump. Validate against this instead.
+*/
+const SQL_DIALECTS = ["Snowflake", "BigQuery"];
+/** The metastore's constraint kinds. */
+const CONSTRAINT_TYPES = [
+	"inequality",
+	"equality",
+	"range",
+	"composition",
+	"exclusion",
+	"temporal",
+	"conditional"
+];
+/**
+* What a dataset field is for.
+*
+* - Enumerated, unlike a field's `type`: the metastore takes any type string, but only these
+*   four roles.
+*/
+const FIELD_ROLES = [
+	"key",
+	"dimension",
+	"measure",
+	"timestamp"
+];
+/**
+* How loudly a violated constraint reports.
+*
+* - An unset severity is stored as `warning`, so a reader renders that rather than nothing.
+*/
+const CONSTRAINT_SEVERITIES = [
+	"error",
+	"warning",
+	"info"
+];
+/**
+* What a constraint's rule is evaluated per.
+*
+* - An unset scope is stored as `global`.
+*/
+const CONSTRAINT_SCOPES = [
+	"global",
+	"per_location",
+	"per_date",
+	"per_category"
+];
+/** The comparisons a constraint's `ruleExpression` can make. */
+const RULE_OPERATORS = [
+	"<",
+	"<=",
+	"=",
+	">=",
+	">",
+	"!=",
+	"between",
+	"in",
+	"sum_equals",
+	"ratio_between"
+];
+/** The join a relationship stands for. */
+const RELATIONSHIP_JOIN_TYPES = ["left", "inner"];
+//#endregion
+//#region src/sdks/semanticLayer/schemas.ts
+/**
+* Runtime validators for the semantic-layer payload shapes.
+*
+* These exist because the metastore's validation errors are opaque — a missing or misspelled
+* field surfaces only as a generic "Validation failed", and a wrong `sql_dialect` casing as a
+* 422 that names neither the field nor the accepted values. Parsing first turns those into a
+* message that says what is wrong.
+*
+* **Only the fields the SDK types mark as required are declared.** The metastore owns each
+* object type's full schema, so every schema is a `looseObject`: unknown fields pass through
+* untouched rather than being stripped or rejected. Re-declaring the optional fields here
+* would create a second source of truth that silently drops whatever the metastore adds next.
+*
+* The SDK does **not** parse on its own writes — these are for callers that accept untrusted
+* or hand-authored input (an agent's tool call, a form submission) and want to fail early.
+* `modelUUID` is omitted throughout: the SDK injects it, so callers never supply it.
+*/
+const semanticModelSchema = zod.z.looseObject({
+	name: zod.z.string().min(1),
+	sql_dialect: zod.z.enum(SQL_DIALECTS)
+});
+const semanticDatasetSchema = zod.z.looseObject({
+	name: zod.z.string().min(1),
+	tableId: zod.z.string().min(1),
+	fqn: zod.z.string().min(1)
+});
+const semanticMetricSchema = zod.z.looseObject({
+	name: zod.z.string().min(1),
+	sql: zod.z.string().min(1)
+});
+const semanticRelationshipSchema = zod.z.looseObject({
+	from: zod.z.string().min(1),
+	to: zod.z.string().min(1),
+	on: zod.z.string().min(1)
+});
+const semanticGlossarySchema = zod.z.looseObject({
+	term: zod.z.string().min(1),
+	definition: zod.z.string().min(1)
+});
+const semanticConstraintSchema = zod.z.looseObject({
+	name: zod.z.string().min(1),
+	constraintType: zod.z.enum(CONSTRAINT_TYPES),
+	metrics: zod.z.array(zod.z.string()),
+	rule: zod.z.string().min(1)
+});
+/** Keyed by object type so a caller can pick the schema from a `SemanticChildObjectType`. */
+const SEMANTIC_CHILD_OBJECT_SCHEMAS = {
+	"semantic-dataset": semanticDatasetSchema,
+	"semantic-metric": semanticMetricSchema,
+	"semantic-relationship": semanticRelationshipSchema,
+	"semantic-glossary": semanticGlossarySchema,
+	"semantic-constraint": semanticConstraintSchema
+};
+//#endregion
 //#region src/sdks/semanticLayer/semanticLayerSdk.ts
 /**
 * Thrown by `deleteModel` when the child cascade partially fails. Every child delete has
@@ -42,25 +199,6 @@ const MODEL_CHILD_OBJECT_TYPES = [
 	SEMANTIC_OBJECT_TYPE.GLOSSARY,
 	SEMANTIC_OBJECT_TYPE.CONSTRAINT
 ];
-/**
-* The dialects the metastore accepts, exactly as it spells them. A lowercase value is
-* rejected with `422 value must be one of 'Snowflake', 'BigQuery'`, which surfaces only as a
-* generic "Validation failed" — so callers need the real set rather than a bare `string`.
-*
-* `SemanticModelData.sql_dialect` stays `string` for now: narrowing it would break any caller
-* passing a `string` variable, which is a major bump. Validate against this instead.
-*/
-const SQL_DIALECTS = ["Snowflake", "BigQuery"];
-/** The metastore's constraint kinds. Runtime counterpart to `SemanticConstraintType`. */
-const CONSTRAINT_TYPES = [
-	"inequality",
-	"equality",
-	"range",
-	"composition",
-	"exclusion",
-	"temporal",
-	"conditional"
-];
 const DEFAULT_BRANCH = "main";
 const WRITE_CONCURRENCY = 5;
 const mapObject = (item) => ({
@@ -288,68 +426,19 @@ const createSemanticLayerSdk = ({ metastoreClient }) => {
 	};
 };
 //#endregion
-//#region src/sdks/semanticLayer/schemas.ts
-/**
-* Runtime validators for the semantic-layer payload shapes.
-*
-* These exist because the metastore's validation errors are opaque — a missing or misspelled
-* field surfaces only as a generic "Validation failed", and a wrong `sql_dialect` casing as a
-* 422 that names neither the field nor the accepted values. Parsing first turns those into a
-* message that says what is wrong.
-*
-* **Only the fields the SDK types mark as required are declared.** The metastore owns each
-* object type's full schema, so every schema is a `looseObject`: unknown fields pass through
-* untouched rather than being stripped or rejected. Re-declaring the optional fields here
-* would create a second source of truth that silently drops whatever the metastore adds next.
-*
-* The SDK does **not** parse on its own writes — these are for callers that accept untrusted
-* or hand-authored input (an agent's tool call, a form submission) and want to fail early.
-* `modelUUID` is omitted throughout: the SDK injects it, so callers never supply it.
-*/
-const semanticModelSchema = zod.z.looseObject({
-	name: zod.z.string().min(1),
-	sql_dialect: zod.z.enum(SQL_DIALECTS)
-});
-const semanticDatasetSchema = zod.z.looseObject({
-	name: zod.z.string().min(1),
-	tableId: zod.z.string().min(1),
-	fqn: zod.z.string().min(1)
-});
-const semanticMetricSchema = zod.z.looseObject({
-	name: zod.z.string().min(1),
-	sql: zod.z.string().min(1)
-});
-const semanticRelationshipSchema = zod.z.looseObject({
-	from: zod.z.string().min(1),
-	to: zod.z.string().min(1),
-	on: zod.z.string().min(1)
-});
-const semanticGlossarySchema = zod.z.looseObject({
-	term: zod.z.string().min(1),
-	definition: zod.z.string().min(1)
-});
-const semanticConstraintSchema = zod.z.looseObject({
-	name: zod.z.string().min(1),
-	constraintType: zod.z.enum(CONSTRAINT_TYPES),
-	metrics: zod.z.array(zod.z.string()),
-	rule: zod.z.string().min(1)
-});
-/** Keyed by object type so a caller can pick the schema from a `SemanticChildObjectType`. */
-const SEMANTIC_CHILD_OBJECT_SCHEMAS = {
-	"semantic-dataset": semanticDatasetSchema,
-	"semantic-metric": semanticMetricSchema,
-	"semantic-relationship": semanticRelationshipSchema,
-	"semantic-glossary": semanticGlossarySchema,
-	"semantic-constraint": semanticConstraintSchema
-};
-//#endregion
+exports.CONSTRAINT_SCOPES = CONSTRAINT_SCOPES;
+exports.CONSTRAINT_SEVERITIES = CONSTRAINT_SEVERITIES;
 exports.CONSTRAINT_TYPES = CONSTRAINT_TYPES;
+exports.FIELD_ROLES = FIELD_ROLES;
 exports.MODEL_CHILD_OBJECT_TYPES = MODEL_CHILD_OBJECT_TYPES;
+exports.RELATIONSHIP_JOIN_TYPES = RELATIONSHIP_JOIN_TYPES;
+exports.RULE_OPERATORS = RULE_OPERATORS;
 exports.SEMANTIC_CHILD_OBJECT_SCHEMAS = SEMANTIC_CHILD_OBJECT_SCHEMAS;
 exports.SEMANTIC_OBJECT_TYPE = SEMANTIC_OBJECT_TYPE;
 exports.SQL_DIALECTS = SQL_DIALECTS;
 exports.SemanticLayerCascadeDeleteError = SemanticLayerCascadeDeleteError;
 exports.createSemanticLayerSdk = createSemanticLayerSdk;
+exports.metastoreErrorMessage = metastoreErrorMessage;
 exports.semanticConstraintSchema = semanticConstraintSchema;
 exports.semanticDatasetSchema = semanticDatasetSchema;
 exports.semanticGlossarySchema = semanticGlossarySchema;

package/dist/sdk/semanticLayer/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["generateUUID","concurrent","z"],"sources":["../../../src/sdks/semanticLayer/semanticLayerSdk.ts","../../../src/sdks/semanticLayer/schemas.ts"],"sourcesContent":["import { concurrent, generateUUID } from '../../utils';\n\nimport type {\n  CreateSemanticObjectMeta,\n  MetastoreClient,\n  SemanticChildObjectDataMap,\n  SemanticChildObjectType,\n  SemanticConstraintType,\n  SemanticModelChildDeleteFailure,\n  SemanticModelChildRef,\n  SemanticModelData,\n  SemanticObject,\n  SemanticObjectMeta,\n  SemanticObjectType,\n  UpdateSemanticObjectMeta,\n} from './types';\n\n/**\n * Thrown by `deleteModel` when the child cascade partially fails. Every child delete has\n * settled by the time this is thrown — nothing keeps deleting in the background — and the\n * model itself was kept, so the exact remaining state is knowable: `deletedChildren` are gone,\n * `failedChildren` (and the model) still exist. `errors` carries the per-child rejection\n * reasons, AggregateError-style.\n */\nexport class SemanticLayerCascadeDeleteError extends AggregateError {\n  readonly modelUUID: string;\n  readonly deletedChildren: SemanticModelChildRef[];\n  readonly failedChildren: SemanticModelChildDeleteFailure[];\n\n  constructor({\n    modelUUID,\n    deletedChildren,\n    failedChildren,\n  }: {\n    modelUUID: string;\n    deletedChildren: SemanticModelChildRef[];\n    failedChildren: SemanticModelChildDeleteFailure[];\n  }) {\n    const total = deletedChildren.length + failedChildren.length;\n    super(\n      failedChildren.map((failure) => failure.error),\n      `The model was kept because ${failedChildren.length} of its ${total} child objects ` +\n        `could not be deleted (${deletedChildren.length} deleted).`,\n    );\n    this.name = 'SemanticLayerCascadeDeleteError';\n    this.modelUUID = modelUUID;\n    this.deletedChildren = deletedChildren;\n    this.failedChildren = failedChildren;\n  }\n}\n\nexport const SEMANTIC_OBJECT_TYPE = {\n  MODEL: 'semantic-model',\n  DATASET: 'semantic-dataset',\n  METRIC: 'semantic-metric',\n  RELATIONSHIP: 'semantic-relationship',\n  GLOSSARY: 'semantic-glossary',\n  CONSTRAINT: 'semantic-constraint',\n} as const satisfies Record<string, SemanticObjectType>;\n\n/**\n * `readonly` because this drives `createModelTree`, `listModelChildren` and `deleteModel` —\n * a consumer-side `.push()` would silently change what a cascade delete touches.\n */\nexport const MODEL_CHILD_OBJECT_TYPES: readonly SemanticChildObjectType[] = [\n  SEMANTIC_OBJECT_TYPE.DATASET,\n  SEMANTIC_OBJECT_TYPE.METRIC,\n  SEMANTIC_OBJECT_TYPE.RELATIONSHIP,\n  SEMANTIC_OBJECT_TYPE.GLOSSARY,\n  SEMANTIC_OBJECT_TYPE.CONSTRAINT,\n] as const;\n\n/**\n * The dialects the metastore accepts, exactly as it spells them. A lowercase value is\n * rejected with `422 value must be one of 'Snowflake', 'BigQuery'`, which surfaces only as a\n * generic \"Validation failed\" — so callers need the real set rather than a bare `string`.\n *\n * `SemanticModelData.sql_dialect` stays `string` for now: narrowing it would break any caller\n * passing a `string` variable, which is a major bump. Validate against this instead.\n */\nexport const SQL_DIALECTS = ['Snowflake', 'BigQuery'] as const;\n\n/** The metastore's constraint kinds. Runtime counterpart to `SemanticConstraintType`. */\nexport const CONSTRAINT_TYPES = [\n  'inequality',\n  'equality',\n  'range',\n  'composition',\n  'exclusion',\n  'temporal',\n  'conditional',\n] as const satisfies readonly SemanticConstraintType[];\n\nconst DEFAULT_BRANCH = 'main';\n\n// The metastore has no bulk endpoint; large semantic-layer inits are written as\n// concurrent single POSTs (the same approach the ai-kit sl-toolkit importer uses).\nconst WRITE_CONCURRENCY = 5;\n\n// The live metastore envelope: `attributes` carries the object's data payload directly,\n// the UUID is the top-level `id`, and revision/branch/audit fields live in `meta`. The\n// legacy wrapper types in clients/metastore/repository/types.ts do not match this shape.\ntype RawSemanticObject<TData> = {\n  type: string;\n  id: string;\n  attributes: TData;\n  meta: SemanticObjectMeta;\n};\n\nconst mapObject = <TData>(item: RawSemanticObject<TData>): SemanticObject<TData> => ({\n  uuid: item.id,\n  data: item.attributes,\n  meta: item.meta,\n});\n\nconst deriveOptionalObjectName = (data: Record<string, unknown>): string | undefined => {\n  if (typeof data.name === 'string') return data.name;\n  if (typeof data.term === 'string') return data.term;\n  return undefined;\n};\n\nconst deriveObjectName = (data: Record<string, unknown>) =>\n  deriveOptionalObjectName(data) ?? generateUUID();\n\n/**\n * The label a UI shows for an object, as opposed to the identifier it is addressed by.\n *\n * Constraints carry an optional `displayName`; kbc-ui's constraint tables already render\n * `displayName ?? name`, so a confirmation listing what a cascade delete would destroy has to\n * agree with them or it names objects the user can't find on screen.\n *\n * Deliberately **not** used for lookup: `displayName` is optional and not unique, so matching on\n * it would make `findObjectsByName` ambiguous for callers that resolve a write target by name.\n */\nconst deriveObjectLabel = (data: Record<string, unknown>): string | undefined => {\n  if (typeof data.displayName === 'string' && data.displayName !== '') return data.displayName;\n  return deriveOptionalObjectName(data);\n};\n\ntype Options = {\n  metastoreClient: MetastoreClient;\n};\n\nexport const createSemanticLayerSdk = ({ metastoreClient }: Options) => {\n  const _listObjects = async <TData extends Record<string, unknown>>(\n    objectType: SemanticObjectType,\n    signal?: AbortSignal,\n  ) => {\n    const response = await metastoreClient.repository.getMetaObjects<TData>({ objectType }, signal);\n    return (response.data as unknown as RawSemanticObject<TData>[]).map(mapObject);\n  };\n\n  const listModels = async (signal?: AbortSignal) =>\n    _listObjects<SemanticModelData>(SEMANTIC_OBJECT_TYPE.MODEL, signal);\n\n  const createModel = async (data: SemanticModelData, meta: CreateSemanticObjectMeta = {}) => {\n    const response = await metastoreClient.repository.createMetaObject<SemanticModelData>({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      data,\n      branch: DEFAULT_BRANCH,\n      ...meta,\n      // Derived name wins over meta so the metastore name stays in sync with the payload.\n      name: data.name,\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticModelData>);\n  };\n\n  const updateModel = async (\n    modelUUID: string,\n    data: Partial<SemanticModelData>,\n    meta: UpdateSemanticObjectMeta = {},\n  ) => {\n    const response = await metastoreClient.repository.updateMetaObject<SemanticModelData>({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      UUID: modelUUID,\n      data,\n      ...meta,\n      // Derived rename wins over meta so the metastore name stays in sync with the payload.\n      ...(data.name ? { name: data.name } : {}),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticModelData>);\n  };\n\n  const listObjects = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    modelUUID: string,\n    signal?: AbortSignal,\n  ) => {\n    const objects = await _listObjects<SemanticChildObjectDataMap[T]>(objectType, signal);\n    return objects.filter((object) => object.data.modelUUID === modelUUID);\n  };\n\n  /**\n   * Find a model's child objects by their user-facing name.\n   *\n   * Returns every match rather than resolving to one, because a name is not unique: the caller\n   * decides whether that's an error (an agent needs an unambiguous target) or a choice to offer\n   * (a UI can render a picker). Glossary entries key on `term`, so both are matched.\n   */\n  const findObjectsByName = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    name: string,\n    modelUUID: string,\n    signal?: AbortSignal,\n  ) => {\n    const objects = await listObjects(objectType, modelUUID, signal);\n    return objects.filter((object) => deriveOptionalObjectName(object.data) === name);\n  };\n\n  const createObject = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    data: SemanticChildObjectDataMap[T],\n    meta: CreateSemanticObjectMeta = {},\n  ) => {\n    const response = await metastoreClient.repository.createMetaObject<\n      SemanticChildObjectDataMap[T]\n    >({\n      objectType,\n      data,\n      branch: DEFAULT_BRANCH,\n      ...meta,\n      // Derived name wins over meta so the metastore name stays in sync with the payload.\n      name: deriveObjectName(data),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticChildObjectDataMap[T]>);\n  };\n\n  const createObjects = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    items: SemanticChildObjectDataMap[T][],\n    meta: CreateSemanticObjectMeta = {},\n  ) =>\n    concurrent({\n      items,\n      process: async (data) => createObject(objectType, data, meta),\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n  // Create a model and all its child objects in one call: the model first (so its\n  // UUID exists), then every child concurrently with the modelUUID injected.\n  const createModelTree = async (\n    model: SemanticModelData,\n    children: Partial<{\n      [T in SemanticChildObjectType]: Omit<SemanticChildObjectDataMap[T], 'modelUUID'>[];\n    }>,\n    meta: CreateSemanticObjectMeta = {},\n  ) => {\n    const createdModel = await createModel(model, meta);\n\n    const items = MODEL_CHILD_OBJECT_TYPES.flatMap((objectType) =>\n      (children[objectType] ?? []).map((data) => ({\n        objectType,\n        data: {\n          ...data,\n          modelUUID: createdModel.uuid,\n        } satisfies SemanticChildObjectDataMap[typeof objectType],\n      })),\n    );\n\n    const createdChildren = await concurrent({\n      items,\n      process: async ({ objectType, data }) => createObject(objectType, data, meta),\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n    return { model: createdModel, children: createdChildren };\n  };\n\n  const updateObject = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    objectUUID: string,\n    data: Partial<SemanticChildObjectDataMap[T]>,\n    meta: UpdateSemanticObjectMeta = {},\n  ) => {\n    const name = deriveOptionalObjectName(data);\n    const response = await metastoreClient.repository.updateMetaObject<\n      SemanticChildObjectDataMap[T]\n    >({\n      objectType,\n      UUID: objectUUID,\n      data,\n      ...meta,\n      // Derived rename wins over meta so the metastore name stays in sync with the payload.\n      ...(name ? { name } : {}),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticChildObjectDataMap[T]>);\n  };\n\n  const deleteObject = async (objectType: SemanticChildObjectType, objectUUID: string) => {\n    await metastoreClient.repository.deleteMetaObject({\n      objectType,\n      UUID: objectUUID,\n    });\n  };\n\n  /**\n   * Every child object of a model, across all five types, flattened.\n   *\n   * `deleteModel` uses this to find what to remove; callers can use it to say what a delete\n   * would destroy *before* asking the user to confirm. Each entry's `name` is the object's\n   * display label (a constraint's `displayName` in preference to its `name`, matching what the\n   * SL tables render), so a confirmation lists objects as the user sees them on screen.\n   *\n   * Costs five list requests: the metastore has no per-model filter, so `listObjects`\n   * fetches each collection and filters client-side.\n   */\n  const listModelChildren = async (\n    modelUUID: string,\n    signal?: AbortSignal,\n  ): Promise<SemanticModelChildRef[]> => {\n    const childrenByType = await Promise.all(\n      MODEL_CHILD_OBJECT_TYPES.map(async (objectType) => {\n        const objects = await listObjects(objectType, modelUUID, signal);\n        return objects.map((object) => ({\n          objectType,\n          objectUUID: object.uuid,\n          name: deriveObjectLabel(object.data),\n        }));\n      }),\n    );\n\n    return childrenByType.flat();\n  };\n\n  /**\n   * Cascade delete: every child object first, the model itself only once its whole tree is\n   * gone. Child deletes all settle — a failing child never aborts the others, so no delete\n   * runs on detached after this rejects — and a partial failure surfaces as\n   * `SemanticLayerCascadeDeleteError`, which says exactly which children were deleted and\n   * which survived. The model is kept on any child failure so it never orphans children.\n   */\n  const deleteModel = async (modelUUID: string) => {\n    const children = await listModelChildren(modelUUID);\n\n    const outcomes = await concurrent({\n      items: children,\n      process: async (child) => {\n        try {\n          await deleteObject(child.objectType, child.objectUUID);\n          return { ok: true as const, child };\n        } catch (error) {\n          return { ok: false as const, child, error };\n        }\n      },\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n    const deletedChildren: SemanticModelChildRef[] = [];\n    const failedChildren: SemanticModelChildDeleteFailure[] = [];\n    for (const outcome of outcomes) {\n      if (outcome.ok) deletedChildren.push(outcome.child);\n      else failedChildren.push({ ...outcome.child, error: outcome.error });\n    }\n\n    if (failedChildren.length > 0) {\n      throw new SemanticLayerCascadeDeleteError({ modelUUID, deletedChildren, failedChildren });\n    }\n\n    await metastoreClient.repository.deleteMetaObject({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      UUID: modelUUID,\n    });\n  };\n\n  /**\n   * Replace the sibling projects granted GET/consumption access to a `targeted`-scope object.\n   *\n   * Passing an empty array clears every grant, leaving the object visible to its owning project\n   * only. A grant conveys read access alone — the target projects can consume the definition but\n   * never edit it, which is enforced metastore-side rather than here.\n   */\n  const replaceTargetProjects = async (\n    objectType: SemanticObjectType,\n    objectUUID: string,\n    targetProjectIds: number[],\n  ) => {\n    await metastoreClient.repository.replaceTargetProjects({\n      objectType,\n      UUID: objectUUID,\n      targetProjectIds,\n    });\n  };\n\n  /**\n   * Step a project-scoped object up to the organization scope, in place.\n   *\n   * The object keeps its UUID and revision history; the step-up writes a new revision whose\n   * `project_id` is null. Requires the caller to hold the organization-admin role for the target\n   * organization — a project-admin gets 403 from the metastore, which callers should surface\n   * rather than pre-empt (the same person is often both).\n   */\n  const promoteToOrganizationScope = async (objectType: SemanticObjectType, objectUUID: string) => {\n    // Scope ONLY. No `data`, not even `{}`: the metastore's step-up guard rejects a PATCH that\n    // also carries name or data, and `Data *JSONData` treats `{}` as present — which 400s with\n    // \"A scope change cannot be combined with name or data changes\".\n    const response = await metastoreClient.repository.updateMetaObject({\n      objectType,\n      UUID: objectUUID,\n      scope: 'organization',\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<Record<string, unknown>>);\n  };\n\n  return {\n    // models\n    listModels,\n    createModel,\n    updateModel,\n    deleteModel,\n    listModelChildren,\n\n    // child objects (datasets, metrics, relationships, glossary, constraints)\n    listObjects,\n    findObjectsByName,\n    createObject,\n    createObjects,\n    createModelTree,\n    updateObject,\n    deleteObject,\n\n    // scoping / sharing\n    replaceTargetProjects,\n    promoteToOrganizationScope,\n  };\n};\n","import { z } from 'zod';\n\nimport { CONSTRAINT_TYPES, SQL_DIALECTS } from './semanticLayerSdk';\n\n/**\n * Runtime validators for the semantic-layer payload shapes.\n *\n * These exist because the metastore's validation errors are opaque — a missing or misspelled\n * field surfaces only as a generic \"Validation failed\", and a wrong `sql_dialect` casing as a\n * 422 that names neither the field nor the accepted values. Parsing first turns those into a\n * message that says what is wrong.\n *\n * **Only the fields the SDK types mark as required are declared.** The metastore owns each\n * object type's full schema, so every schema is a `looseObject`: unknown fields pass through\n * untouched rather than being stripped or rejected. Re-declaring the optional fields here\n * would create a second source of truth that silently drops whatever the metastore adds next.\n *\n * The SDK does **not** parse on its own writes — these are for callers that accept untrusted\n * or hand-authored input (an agent's tool call, a form submission) and want to fail early.\n * `modelUUID` is omitted throughout: the SDK injects it, so callers never supply it.\n */\n\nexport const semanticModelSchema = z.looseObject({\n  name: z.string().min(1),\n  sql_dialect: z.enum(SQL_DIALECTS),\n});\n\nexport const semanticDatasetSchema = z.looseObject({\n  name: z.string().min(1),\n  tableId: z.string().min(1),\n  fqn: z.string().min(1),\n});\n\nexport const semanticMetricSchema = z.looseObject({\n  name: z.string().min(1),\n  sql: z.string().min(1),\n});\n\nexport const semanticRelationshipSchema = z.looseObject({\n  from: z.string().min(1),\n  to: z.string().min(1),\n  on: z.string().min(1),\n});\n\nexport const semanticGlossarySchema = z.looseObject({\n  term: z.string().min(1),\n  definition: z.string().min(1),\n});\n\nexport const semanticConstraintSchema = z.looseObject({\n  name: z.string().min(1),\n  constraintType: z.enum(CONSTRAINT_TYPES),\n  metrics: z.array(z.string()),\n  rule: z.string().min(1),\n});\n\n/** Keyed by object type so a caller can pick the schema from a `SemanticChildObjectType`. */\nexport const SEMANTIC_CHILD_OBJECT_SCHEMAS = {\n  'semantic-dataset': semanticDatasetSchema,\n  'semantic-metric': semanticMetricSchema,\n  'semantic-relationship': semanticRelationshipSchema,\n  'semantic-glossary': semanticGlossarySchema,\n  'semantic-constraint': semanticConstraintSchema,\n} as const;\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAa,kCAAb,cAAqD,eAAe;CAClE;CACA;CACA;CAEA,YAAY,EACV,WACA,iBACA,kBAKC;EACD,MAAM,QAAQ,gBAAgB,SAAS,eAAe;EACtD,MACE,eAAe,KAAK,YAAY,QAAQ,KAAK,GAC7C,8BAA8B,eAAe,OAAO,UAAU,MAAM,uCACzC,gBAAgB,OAAO,WACpD;EACA,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;CACxB;AACF;AAEA,MAAa,uBAAuB;CAClC,OAAO;CACP,SAAS;CACT,QAAQ;CACR,cAAc;CACd,UAAU;CACV,YAAY;AACd;;;;;AAMA,MAAa,2BAA+D;CAC1E,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;AACvB;;;;;;;;;AAUA,MAAa,eAAe,CAAC,aAAa,UAAU;;AAGpD,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,iBAAiB;AAIvB,MAAM,oBAAoB;AAY1B,MAAM,aAAoB,UAA2D;CACnF,MAAM,KAAK;CACX,MAAM,KAAK;CACX,MAAM,KAAK;AACb;AAEA,MAAM,4BAA4B,SAAsD;CACtF,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAK;CAC/C,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAK;AAEjD;AAEA,MAAM,oBAAoB,SACxB,yBAAyB,IAAI,KAAKA,qBAAAA,aAAa;;;;;;;;;;;AAYjD,MAAM,qBAAqB,SAAsD;CAC/E,IAAI,OAAO,KAAK,gBAAgB,YAAY,KAAK,gBAAgB,IAAI,OAAO,KAAK;CACjF,OAAO,yBAAyB,IAAI;AACtC;AAMA,MAAa,0BAA0B,EAAE,sBAA+B;CACtE,MAAM,eAAe,OACnB,YACA,WACG;EAEH,QAAQ,MADe,gBAAgB,WAAW,eAAsB,EAAE,WAAW,GAAG,MAAM,EAAA,CAC7E,KAA+C,IAAI,SAAS;CAC/E;CAEA,MAAM,aAAa,OAAO,WACxB,aAAgC,qBAAqB,OAAO,MAAM;CAEpE,MAAM,cAAc,OAAO,MAAyB,OAAiC,CAAC,MAAM;EAC1F,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAoC;GACpF,YAAY,qBAAqB;GACjC;GACA,QAAQ;GACR,GAAG;GAEH,MAAM,KAAK;EACb,CAAC;EAED,OAAO,UAAU,SAAS,IAAuD;CACnF;CAEA,MAAM,cAAc,OAClB,WACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAoC;GACpF,YAAY,qBAAqB;GACjC,MAAM;GACN;GACA,GAAG;GAEH,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EACzC,CAAC;EAED,OAAO,UAAU,SAAS,IAAuD;CACnF;CAEA,MAAM,cAAc,OAClB,YACA,WACA,WACG;EAEH,QAAO,MADe,aAA4C,YAAY,MAAM,EAAA,CACrE,QAAQ,WAAW,OAAO,KAAK,cAAc,SAAS;CACvE;;;;;;;;CASA,MAAM,oBAAoB,OACxB,YACA,MACA,WACA,WACG;EAEH,QAAO,MADe,YAAY,YAAY,WAAW,MAAM,EAAA,CAChD,QAAQ,WAAW,yBAAyB,OAAO,IAAI,MAAM,IAAI;CAClF;CAEA,MAAM,eAAe,OACnB,YACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAEhD;GACA;GACA;GACA,QAAQ;GACR,GAAG;GAEH,MAAM,iBAAiB,IAAI;EAC7B,CAAC;EAED,OAAO,UAAU,SAAS,IAAmE;CAC/F;CAEA,MAAM,gBAAgB,OACpB,YACA,OACA,OAAiC,CAAC,MAElCC,mBAAAA,WAAW;EACT;EACA,SAAS,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI;EAC5D,aAAa;CACf,CAAC;CAIH,MAAM,kBAAkB,OACtB,OACA,UAGA,OAAiC,CAAC,MAC/B;EACH,MAAM,eAAe,MAAM,YAAY,OAAO,IAAI;EAElD,MAAM,QAAQ,yBAAyB,SAAS,gBAC7C,SAAS,eAAe,CAAC,EAAA,CAAG,KAAK,UAAU;GAC1C;GACA,MAAM;IACJ,GAAG;IACH,WAAW,aAAa;GAC1B;EACF,EAAE,CACJ;EAQA,OAAO;GAAE,OAAO;GAAc,UAAU,MANVA,mBAAAA,WAAW;IACvC;IACA,SAAS,OAAO,EAAE,YAAY,WAAW,aAAa,YAAY,MAAM,IAAI;IAC5E,aAAa;GACf,CAAC;EAEuD;CAC1D;CAEA,MAAM,eAAe,OACnB,YACA,YACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,OAAO,yBAAyB,IAAI;EAC1C,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAEhD;GACA;GACA,MAAM;GACN;GACA,GAAG;GAEH,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACzB,CAAC;EAED,OAAO,UAAU,SAAS,IAAmE;CAC/F;CAEA,MAAM,eAAe,OAAO,YAAqC,eAAuB;EACtF,MAAM,gBAAgB,WAAW,iBAAiB;GAChD;GACA,MAAM;EACR,CAAC;CACH;;;;;;;;;;;;CAaA,MAAM,oBAAoB,OACxB,WACA,WACqC;EAYrC,QAAO,MAXsB,QAAQ,IACnC,yBAAyB,IAAI,OAAO,eAAe;GAEjD,QAAO,MADe,YAAY,YAAY,WAAW,MAAM,EAAA,CAChD,KAAK,YAAY;IAC9B;IACA,YAAY,OAAO;IACnB,MAAM,kBAAkB,OAAO,IAAI;GACrC,EAAE;EACJ,CAAC,CACH,EAAA,CAEsB,KAAK;CAC7B;;;;;;;;CASA,MAAM,cAAc,OAAO,cAAsB;EAC/C,MAAM,WAAW,MAAM,kBAAkB,SAAS;EAElD,MAAM,WAAW,MAAMA,mBAAAA,WAAW;GAChC,OAAO;GACP,SAAS,OAAO,UAAU;IACxB,IAAI;KACF,MAAM,aAAa,MAAM,YAAY,MAAM,UAAU;KACrD,OAAO;MAAE,IAAI;MAAe;KAAM;IACpC,SAAS,OAAO;KACd,OAAO;MAAE,IAAI;MAAgB;MAAO;KAAM;IAC5C;GACF;GACA,aAAa;EACf,CAAC;EAED,MAAM,kBAA2C,CAAC;EAClD,MAAM,iBAAoD,CAAC;EAC3D,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,IAAI,gBAAgB,KAAK,QAAQ,KAAK;OAC7C,eAAe,KAAK;GAAE,GAAG,QAAQ;GAAO,OAAO,QAAQ;EAAM,CAAC;EAGrE,IAAI,eAAe,SAAS,GAC1B,MAAM,IAAI,gCAAgC;GAAE;GAAW;GAAiB;EAAe,CAAC;EAG1F,MAAM,gBAAgB,WAAW,iBAAiB;GAChD,YAAY,qBAAqB;GACjC,MAAM;EACR,CAAC;CACH;;;;;;;;CASA,MAAM,wBAAwB,OAC5B,YACA,YACA,qBACG;EACH,MAAM,gBAAgB,WAAW,sBAAsB;GACrD;GACA,MAAM;GACN;EACF,CAAC;CACH;;;;;;;;;CAUA,MAAM,6BAA6B,OAAO,YAAgC,eAAuB;EAI/F,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAiB;GACjE;GACA,MAAM;GACN,OAAO;EACT,CAAC;EAED,OAAO,UAAU,SAAS,IAA6D;CACzF;CAEA,OAAO;EAEL;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EACA;CACF;AACF;;;;;;;;;;;;;;;;;;;;ACvZA,MAAa,sBAAsBC,IAAAA,EAAE,YAAY;CAC/C,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAaA,IAAAA,EAAE,KAAK,YAAY;AAClC,CAAC;AAED,MAAa,wBAAwBA,IAAAA,EAAE,YAAY;CACjD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAa,uBAAuBA,IAAAA,EAAE,YAAY;CAChD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAa,6BAA6BA,IAAAA,EAAE,YAAY;CACtD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,MAAa,yBAAyBA,IAAAA,EAAE,YAAY;CAClD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,MAAa,2BAA2BA,IAAAA,EAAE,YAAY;CACpD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,gBAAgBA,IAAAA,EAAE,KAAK,gBAAgB;CACvC,SAASA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;CAC3B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;AAGD,MAAa,gCAAgC;CAC3C,oBAAoB;CACpB,mBAAmB;CACnB,yBAAyB;CACzB,qBAAqB;CACrB,uBAAuB;AACzB"}
+{"version":3,"file":"index.cjs","names":["z","generateUUID","concurrent"],"sources":["../../../src/sdks/semanticLayer/errorMessage.ts","../../../src/sdks/semanticLayer/vocabulary.ts","../../../src/sdks/semanticLayer/schemas.ts","../../../src/sdks/semanticLayer/semanticLayerSdk.ts"],"sourcesContent":["/**\n * The message out of a metastore error body.\n *\n * - The metastore reports what is actually wrong with a write only inside `errors[].message`\n *   (`missing property 'fqn'`). The HTTP status and the response's own message say no more than\n *   \"Validation failed\", so a caller that renders those alone tells a user nothing actionable.\n * - Every shape that is not that envelope returns `undefined` rather than a placeholder, so the\n *   caller keeps its own fallback (`?? error.message`) instead of rendering a stand-in for one.\n * - Only the first error: the metastore reports fields one at a time, so a list would be a list\n *   of one.\n */\nexport const metastoreErrorMessage = (data: unknown): string | undefined => {\n  if (typeof data !== 'object' || data === null) return undefined;\n  const errors = (data as { errors?: unknown }).errors;\n  if (!Array.isArray(errors)) return undefined;\n  const first = errors[0];\n  if (typeof first !== 'object' || first === null) return undefined;\n  const message = (first as { message?: unknown }).message;\n  return typeof message === 'string' && message ? message : undefined;\n};\n","/**\n * The closed value sets the metastore accepts inside a semantic object's `data`.\n *\n * - Each one is the single runtime source for a union in `./types`, which derives the type from\n *   the array here. A value cannot exist in the type and be missing from the list a dropdown or\n *   a validator is built from.\n * - The addressing vocabulary (`SEMANTIC_OBJECT_TYPE`, `MODEL_CHILD_OBJECT_TYPES`) is a\n *   different axis — which object a call targets, not what may sit inside one — and stays beside\n *   the SDK methods that take it.\n * - This file imports nothing: `./types` reads it, never the reverse.\n */\n\n/**\n * The dialects the metastore accepts, exactly as it spells them. A lowercase value is\n * rejected with `422 value must be one of 'Snowflake', 'BigQuery'`, which surfaces only as a\n * generic \"Validation failed\" — so callers need the real set rather than a bare `string`.\n *\n * `SemanticModelData.sql_dialect` stays `string` for now: narrowing it would break any caller\n * passing a `string` variable, which is a major bump. Validate against this instead.\n */\nexport const SQL_DIALECTS = ['Snowflake', 'BigQuery'] as const;\n\n/** The metastore's constraint kinds. */\nexport const CONSTRAINT_TYPES = [\n  'inequality',\n  'equality',\n  'range',\n  'composition',\n  'exclusion',\n  'temporal',\n  'conditional',\n] as const;\n\n/**\n * What a dataset field is for.\n *\n * - Enumerated, unlike a field's `type`: the metastore takes any type string, but only these\n *   four roles.\n */\nexport const FIELD_ROLES = ['key', 'dimension', 'measure', 'timestamp'] as const;\n\n/**\n * How loudly a violated constraint reports.\n *\n * - An unset severity is stored as `warning`, so a reader renders that rather than nothing.\n */\nexport const CONSTRAINT_SEVERITIES = ['error', 'warning', 'info'] as const;\n\n/**\n * What a constraint's rule is evaluated per.\n *\n * - An unset scope is stored as `global`.\n */\nexport const CONSTRAINT_SCOPES = ['global', 'per_location', 'per_date', 'per_category'] as const;\n\n/** The comparisons a constraint's `ruleExpression` can make. */\nexport const RULE_OPERATORS = [\n  '<',\n  '<=',\n  '=',\n  '>=',\n  '>',\n  '!=',\n  'between',\n  'in',\n  'sum_equals',\n  'ratio_between',\n] as const;\n\n/** The join a relationship stands for. */\nexport const RELATIONSHIP_JOIN_TYPES = ['left', 'inner'] as const;\n","import { z } from 'zod';\n\nimport { CONSTRAINT_TYPES, SQL_DIALECTS } from './vocabulary';\n\n/**\n * Runtime validators for the semantic-layer payload shapes.\n *\n * These exist because the metastore's validation errors are opaque — a missing or misspelled\n * field surfaces only as a generic \"Validation failed\", and a wrong `sql_dialect` casing as a\n * 422 that names neither the field nor the accepted values. Parsing first turns those into a\n * message that says what is wrong.\n *\n * **Only the fields the SDK types mark as required are declared.** The metastore owns each\n * object type's full schema, so every schema is a `looseObject`: unknown fields pass through\n * untouched rather than being stripped or rejected. Re-declaring the optional fields here\n * would create a second source of truth that silently drops whatever the metastore adds next.\n *\n * The SDK does **not** parse on its own writes — these are for callers that accept untrusted\n * or hand-authored input (an agent's tool call, a form submission) and want to fail early.\n * `modelUUID` is omitted throughout: the SDK injects it, so callers never supply it.\n */\n\nexport const semanticModelSchema = z.looseObject({\n  name: z.string().min(1),\n  sql_dialect: z.enum(SQL_DIALECTS),\n});\n\nexport const semanticDatasetSchema = z.looseObject({\n  name: z.string().min(1),\n  tableId: z.string().min(1),\n  fqn: z.string().min(1),\n});\n\nexport const semanticMetricSchema = z.looseObject({\n  name: z.string().min(1),\n  sql: z.string().min(1),\n});\n\nexport const semanticRelationshipSchema = z.looseObject({\n  from: z.string().min(1),\n  to: z.string().min(1),\n  on: z.string().min(1),\n});\n\nexport const semanticGlossarySchema = z.looseObject({\n  term: z.string().min(1),\n  definition: z.string().min(1),\n});\n\nexport const semanticConstraintSchema = z.looseObject({\n  name: z.string().min(1),\n  constraintType: z.enum(CONSTRAINT_TYPES),\n  metrics: z.array(z.string()),\n  rule: z.string().min(1),\n});\n\n/** Keyed by object type so a caller can pick the schema from a `SemanticChildObjectType`. */\nexport const SEMANTIC_CHILD_OBJECT_SCHEMAS = {\n  'semantic-dataset': semanticDatasetSchema,\n  'semantic-metric': semanticMetricSchema,\n  'semantic-relationship': semanticRelationshipSchema,\n  'semantic-glossary': semanticGlossarySchema,\n  'semantic-constraint': semanticConstraintSchema,\n} as const;\n","import { concurrent, generateUUID } from '../../utils';\n\nimport type {\n  CreateSemanticObjectMeta,\n  MetastoreClient,\n  SemanticChildObjectDataMap,\n  SemanticChildObjectType,\n  SemanticModelChildDeleteFailure,\n  SemanticModelChildRef,\n  SemanticModelData,\n  SemanticObject,\n  SemanticObjectMeta,\n  SemanticObjectType,\n  UpdateSemanticObjectMeta,\n} from './types';\n\n/**\n * Thrown by `deleteModel` when the child cascade partially fails. Every child delete has\n * settled by the time this is thrown — nothing keeps deleting in the background — and the\n * model itself was kept, so the exact remaining state is knowable: `deletedChildren` are gone,\n * `failedChildren` (and the model) still exist. `errors` carries the per-child rejection\n * reasons, AggregateError-style.\n */\nexport class SemanticLayerCascadeDeleteError extends AggregateError {\n  readonly modelUUID: string;\n  readonly deletedChildren: SemanticModelChildRef[];\n  readonly failedChildren: SemanticModelChildDeleteFailure[];\n\n  constructor({\n    modelUUID,\n    deletedChildren,\n    failedChildren,\n  }: {\n    modelUUID: string;\n    deletedChildren: SemanticModelChildRef[];\n    failedChildren: SemanticModelChildDeleteFailure[];\n  }) {\n    const total = deletedChildren.length + failedChildren.length;\n    super(\n      failedChildren.map((failure) => failure.error),\n      `The model was kept because ${failedChildren.length} of its ${total} child objects ` +\n        `could not be deleted (${deletedChildren.length} deleted).`,\n    );\n    this.name = 'SemanticLayerCascadeDeleteError';\n    this.modelUUID = modelUUID;\n    this.deletedChildren = deletedChildren;\n    this.failedChildren = failedChildren;\n  }\n}\n\nexport const SEMANTIC_OBJECT_TYPE = {\n  MODEL: 'semantic-model',\n  DATASET: 'semantic-dataset',\n  METRIC: 'semantic-metric',\n  RELATIONSHIP: 'semantic-relationship',\n  GLOSSARY: 'semantic-glossary',\n  CONSTRAINT: 'semantic-constraint',\n} as const satisfies Record<string, SemanticObjectType>;\n\n/**\n * `readonly` because this drives `createModelTree`, `listModelChildren` and `deleteModel` —\n * a consumer-side `.push()` would silently change what a cascade delete touches.\n */\nexport const MODEL_CHILD_OBJECT_TYPES: readonly SemanticChildObjectType[] = [\n  SEMANTIC_OBJECT_TYPE.DATASET,\n  SEMANTIC_OBJECT_TYPE.METRIC,\n  SEMANTIC_OBJECT_TYPE.RELATIONSHIP,\n  SEMANTIC_OBJECT_TYPE.GLOSSARY,\n  SEMANTIC_OBJECT_TYPE.CONSTRAINT,\n] as const;\n\nconst DEFAULT_BRANCH = 'main';\n\n// The metastore has no bulk endpoint; large semantic-layer inits are written as\n// concurrent single POSTs (the same approach the ai-kit sl-toolkit importer uses).\nconst WRITE_CONCURRENCY = 5;\n\n// The live metastore envelope: `attributes` carries the object's data payload directly,\n// the UUID is the top-level `id`, and revision/branch/audit fields live in `meta`. The\n// legacy wrapper types in clients/metastore/repository/types.ts do not match this shape.\ntype RawSemanticObject<TData> = {\n  type: string;\n  id: string;\n  attributes: TData;\n  meta: SemanticObjectMeta;\n};\n\nconst mapObject = <TData>(item: RawSemanticObject<TData>): SemanticObject<TData> => ({\n  uuid: item.id,\n  data: item.attributes,\n  meta: item.meta,\n});\n\nconst deriveOptionalObjectName = (data: Record<string, unknown>): string | undefined => {\n  if (typeof data.name === 'string') return data.name;\n  if (typeof data.term === 'string') return data.term;\n  return undefined;\n};\n\nconst deriveObjectName = (data: Record<string, unknown>) =>\n  deriveOptionalObjectName(data) ?? generateUUID();\n\n/**\n * The label a UI shows for an object, as opposed to the identifier it is addressed by.\n *\n * Constraints carry an optional `displayName`; kbc-ui's constraint tables already render\n * `displayName ?? name`, so a confirmation listing what a cascade delete would destroy has to\n * agree with them or it names objects the user can't find on screen.\n *\n * Deliberately **not** used for lookup: `displayName` is optional and not unique, so matching on\n * it would make `findObjectsByName` ambiguous for callers that resolve a write target by name.\n */\nconst deriveObjectLabel = (data: Record<string, unknown>): string | undefined => {\n  if (typeof data.displayName === 'string' && data.displayName !== '') return data.displayName;\n  return deriveOptionalObjectName(data);\n};\n\ntype Options = {\n  metastoreClient: MetastoreClient;\n};\n\nexport const createSemanticLayerSdk = ({ metastoreClient }: Options) => {\n  const _listObjects = async <TData extends Record<string, unknown>>(\n    objectType: SemanticObjectType,\n    signal?: AbortSignal,\n  ) => {\n    const response = await metastoreClient.repository.getMetaObjects<TData>({ objectType }, signal);\n    return (response.data as unknown as RawSemanticObject<TData>[]).map(mapObject);\n  };\n\n  const listModels = async (signal?: AbortSignal) =>\n    _listObjects<SemanticModelData>(SEMANTIC_OBJECT_TYPE.MODEL, signal);\n\n  const createModel = async (data: SemanticModelData, meta: CreateSemanticObjectMeta = {}) => {\n    const response = await metastoreClient.repository.createMetaObject<SemanticModelData>({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      data,\n      branch: DEFAULT_BRANCH,\n      ...meta,\n      // Derived name wins over meta so the metastore name stays in sync with the payload.\n      name: data.name,\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticModelData>);\n  };\n\n  const updateModel = async (\n    modelUUID: string,\n    data: Partial<SemanticModelData>,\n    meta: UpdateSemanticObjectMeta = {},\n  ) => {\n    const response = await metastoreClient.repository.updateMetaObject<SemanticModelData>({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      UUID: modelUUID,\n      data,\n      ...meta,\n      // Derived rename wins over meta so the metastore name stays in sync with the payload.\n      ...(data.name ? { name: data.name } : {}),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticModelData>);\n  };\n\n  const listObjects = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    modelUUID: string,\n    signal?: AbortSignal,\n  ) => {\n    const objects = await _listObjects<SemanticChildObjectDataMap[T]>(objectType, signal);\n    return objects.filter((object) => object.data.modelUUID === modelUUID);\n  };\n\n  /**\n   * Find a model's child objects by their user-facing name.\n   *\n   * Returns every match rather than resolving to one, because a name is not unique: the caller\n   * decides whether that's an error (an agent needs an unambiguous target) or a choice to offer\n   * (a UI can render a picker). Glossary entries key on `term`, so both are matched.\n   */\n  const findObjectsByName = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    name: string,\n    modelUUID: string,\n    signal?: AbortSignal,\n  ) => {\n    const objects = await listObjects(objectType, modelUUID, signal);\n    return objects.filter((object) => deriveOptionalObjectName(object.data) === name);\n  };\n\n  const createObject = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    data: SemanticChildObjectDataMap[T],\n    meta: CreateSemanticObjectMeta = {},\n  ) => {\n    const response = await metastoreClient.repository.createMetaObject<\n      SemanticChildObjectDataMap[T]\n    >({\n      objectType,\n      data,\n      branch: DEFAULT_BRANCH,\n      ...meta,\n      // Derived name wins over meta so the metastore name stays in sync with the payload.\n      name: deriveObjectName(data),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticChildObjectDataMap[T]>);\n  };\n\n  const createObjects = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    items: SemanticChildObjectDataMap[T][],\n    meta: CreateSemanticObjectMeta = {},\n  ) =>\n    concurrent({\n      items,\n      process: async (data) => createObject(objectType, data, meta),\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n  // Create a model and all its child objects in one call: the model first (so its\n  // UUID exists), then every child concurrently with the modelUUID injected.\n  const createModelTree = async (\n    model: SemanticModelData,\n    children: Partial<{\n      [T in SemanticChildObjectType]: Omit<SemanticChildObjectDataMap[T], 'modelUUID'>[];\n    }>,\n    meta: CreateSemanticObjectMeta = {},\n  ) => {\n    const createdModel = await createModel(model, meta);\n\n    const items = MODEL_CHILD_OBJECT_TYPES.flatMap((objectType) =>\n      (children[objectType] ?? []).map((data) => ({\n        objectType,\n        data: {\n          ...data,\n          modelUUID: createdModel.uuid,\n        } satisfies SemanticChildObjectDataMap[typeof objectType],\n      })),\n    );\n\n    const createdChildren = await concurrent({\n      items,\n      process: async ({ objectType, data }) => createObject(objectType, data, meta),\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n    return { model: createdModel, children: createdChildren };\n  };\n\n  const updateObject = async <T extends SemanticChildObjectType>(\n    objectType: T,\n    objectUUID: string,\n    data: Partial<SemanticChildObjectDataMap[T]>,\n    meta: UpdateSemanticObjectMeta = {},\n  ) => {\n    const name = deriveOptionalObjectName(data);\n    const response = await metastoreClient.repository.updateMetaObject<\n      SemanticChildObjectDataMap[T]\n    >({\n      objectType,\n      UUID: objectUUID,\n      data,\n      ...meta,\n      // Derived rename wins over meta so the metastore name stays in sync with the payload.\n      ...(name ? { name } : {}),\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<SemanticChildObjectDataMap[T]>);\n  };\n\n  const deleteObject = async (objectType: SemanticChildObjectType, objectUUID: string) => {\n    await metastoreClient.repository.deleteMetaObject({\n      objectType,\n      UUID: objectUUID,\n    });\n  };\n\n  /**\n   * Every child object of a model, across all five types, flattened.\n   *\n   * `deleteModel` uses this to find what to remove; callers can use it to say what a delete\n   * would destroy *before* asking the user to confirm. Each entry's `name` is the object's\n   * display label (a constraint's `displayName` in preference to its `name`, matching what the\n   * SL tables render), so a confirmation lists objects as the user sees them on screen.\n   *\n   * Costs five list requests: the metastore has no per-model filter, so `listObjects`\n   * fetches each collection and filters client-side.\n   */\n  const listModelChildren = async (\n    modelUUID: string,\n    signal?: AbortSignal,\n  ): Promise<SemanticModelChildRef[]> => {\n    const childrenByType = await Promise.all(\n      MODEL_CHILD_OBJECT_TYPES.map(async (objectType) => {\n        const objects = await listObjects(objectType, modelUUID, signal);\n        return objects.map((object) => ({\n          objectType,\n          objectUUID: object.uuid,\n          name: deriveObjectLabel(object.data),\n        }));\n      }),\n    );\n\n    return childrenByType.flat();\n  };\n\n  /**\n   * Cascade delete: every child object first, the model itself only once its whole tree is\n   * gone. Child deletes all settle — a failing child never aborts the others, so no delete\n   * runs on detached after this rejects — and a partial failure surfaces as\n   * `SemanticLayerCascadeDeleteError`, which says exactly which children were deleted and\n   * which survived. The model is kept on any child failure so it never orphans children.\n   */\n  const deleteModel = async (modelUUID: string) => {\n    const children = await listModelChildren(modelUUID);\n\n    const outcomes = await concurrent({\n      items: children,\n      process: async (child) => {\n        try {\n          await deleteObject(child.objectType, child.objectUUID);\n          return { ok: true as const, child };\n        } catch (error) {\n          return { ok: false as const, child, error };\n        }\n      },\n      concurrency: WRITE_CONCURRENCY,\n    });\n\n    const deletedChildren: SemanticModelChildRef[] = [];\n    const failedChildren: SemanticModelChildDeleteFailure[] = [];\n    for (const outcome of outcomes) {\n      if (outcome.ok) deletedChildren.push(outcome.child);\n      else failedChildren.push({ ...outcome.child, error: outcome.error });\n    }\n\n    if (failedChildren.length > 0) {\n      throw new SemanticLayerCascadeDeleteError({ modelUUID, deletedChildren, failedChildren });\n    }\n\n    await metastoreClient.repository.deleteMetaObject({\n      objectType: SEMANTIC_OBJECT_TYPE.MODEL,\n      UUID: modelUUID,\n    });\n  };\n\n  /**\n   * Replace the sibling projects granted GET/consumption access to a `targeted`-scope object.\n   *\n   * Passing an empty array clears every grant, leaving the object visible to its owning project\n   * only. A grant conveys read access alone — the target projects can consume the definition but\n   * never edit it, which is enforced metastore-side rather than here.\n   */\n  const replaceTargetProjects = async (\n    objectType: SemanticObjectType,\n    objectUUID: string,\n    targetProjectIds: number[],\n  ) => {\n    await metastoreClient.repository.replaceTargetProjects({\n      objectType,\n      UUID: objectUUID,\n      targetProjectIds,\n    });\n  };\n\n  /**\n   * Step a project-scoped object up to the organization scope, in place.\n   *\n   * The object keeps its UUID and revision history; the step-up writes a new revision whose\n   * `project_id` is null. Requires the caller to hold the organization-admin role for the target\n   * organization — a project-admin gets 403 from the metastore, which callers should surface\n   * rather than pre-empt (the same person is often both).\n   */\n  const promoteToOrganizationScope = async (objectType: SemanticObjectType, objectUUID: string) => {\n    // Scope ONLY. No `data`, not even `{}`: the metastore's step-up guard rejects a PATCH that\n    // also carries name or data, and `Data *JSONData` treats `{}` as present — which 400s with\n    // \"A scope change cannot be combined with name or data changes\".\n    const response = await metastoreClient.repository.updateMetaObject({\n      objectType,\n      UUID: objectUUID,\n      scope: 'organization',\n    });\n\n    return mapObject(response.data as unknown as RawSemanticObject<Record<string, unknown>>);\n  };\n\n  return {\n    // models\n    listModels,\n    createModel,\n    updateModel,\n    deleteModel,\n    listModelChildren,\n\n    // child objects (datasets, metrics, relationships, glossary, constraints)\n    listObjects,\n    findObjectsByName,\n    createObject,\n    createObjects,\n    createModelTree,\n    updateObject,\n    deleteObject,\n\n    // scoping / sharing\n    replaceTargetProjects,\n    promoteToOrganizationScope,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAWA,MAAa,yBAAyB,SAAsC;CAC1E,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO,KAAA;CACtD,MAAM,SAAU,KAA8B;CAC9C,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG,OAAO,KAAA;CACnC,MAAM,QAAQ,OAAO;CACrB,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,UAAW,MAAgC;CACjD,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;;;;;;;;;;;;;;;;ACCA,MAAa,eAAe,CAAC,aAAa,UAAU;;AAGpD,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;AAQA,MAAa,cAAc;CAAC;CAAO;CAAa;CAAW;AAAW;;;;;;AAOtE,MAAa,wBAAwB;CAAC;CAAS;CAAW;AAAM;;;;;;AAOhE,MAAa,oBAAoB;CAAC;CAAU;CAAgB;CAAY;AAAc;;AAGtF,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,0BAA0B,CAAC,QAAQ,OAAO;;;;;;;;;;;;;;;;;;;;AChDvD,MAAa,sBAAsBA,IAAAA,EAAE,YAAY;CAC/C,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAaA,IAAAA,EAAE,KAAK,YAAY;AAClC,CAAC;AAED,MAAa,wBAAwBA,IAAAA,EAAE,YAAY;CACjD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAa,uBAAuBA,IAAAA,EAAE,YAAY;CAChD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAa,6BAA6BA,IAAAA,EAAE,YAAY;CACtD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,MAAa,yBAAyBA,IAAAA,EAAE,YAAY;CAClD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,MAAa,2BAA2BA,IAAAA,EAAE,YAAY;CACpD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,gBAAgBA,IAAAA,EAAE,KAAK,gBAAgB;CACvC,SAASA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;CAC3B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;AAGD,MAAa,gCAAgC;CAC3C,oBAAoB;CACpB,mBAAmB;CACnB,yBAAyB;CACzB,qBAAqB;CACrB,uBAAuB;AACzB;;;;;;;;;;ACxCA,IAAa,kCAAb,cAAqD,eAAe;CAClE;CACA;CACA;CAEA,YAAY,EACV,WACA,iBACA,kBAKC;EACD,MAAM,QAAQ,gBAAgB,SAAS,eAAe;EACtD,MACE,eAAe,KAAK,YAAY,QAAQ,KAAK,GAC7C,8BAA8B,eAAe,OAAO,UAAU,MAAM,uCACzC,gBAAgB,OAAO,WACpD;EACA,KAAK,OAAO;EACZ,KAAK,YAAY;EACjB,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;CACxB;AACF;AAEA,MAAa,uBAAuB;CAClC,OAAO;CACP,SAAS;CACT,QAAQ;CACR,cAAc;CACd,UAAU;CACV,YAAY;AACd;;;;;AAMA,MAAa,2BAA+D;CAC1E,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;AACvB;AAEA,MAAM,iBAAiB;AAIvB,MAAM,oBAAoB;AAY1B,MAAM,aAAoB,UAA2D;CACnF,MAAM,KAAK;CACX,MAAM,KAAK;CACX,MAAM,KAAK;AACb;AAEA,MAAM,4BAA4B,SAAsD;CACtF,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAK;CAC/C,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAK;AAEjD;AAEA,MAAM,oBAAoB,SACxB,yBAAyB,IAAI,KAAKC,qBAAAA,aAAa;;;;;;;;;;;AAYjD,MAAM,qBAAqB,SAAsD;CAC/E,IAAI,OAAO,KAAK,gBAAgB,YAAY,KAAK,gBAAgB,IAAI,OAAO,KAAK;CACjF,OAAO,yBAAyB,IAAI;AACtC;AAMA,MAAa,0BAA0B,EAAE,sBAA+B;CACtE,MAAM,eAAe,OACnB,YACA,WACG;EAEH,QAAQ,MADe,gBAAgB,WAAW,eAAsB,EAAE,WAAW,GAAG,MAAM,EAAA,CAC7E,KAA+C,IAAI,SAAS;CAC/E;CAEA,MAAM,aAAa,OAAO,WACxB,aAAgC,qBAAqB,OAAO,MAAM;CAEpE,MAAM,cAAc,OAAO,MAAyB,OAAiC,CAAC,MAAM;EAC1F,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAoC;GACpF,YAAY,qBAAqB;GACjC;GACA,QAAQ;GACR,GAAG;GAEH,MAAM,KAAK;EACb,CAAC;EAED,OAAO,UAAU,SAAS,IAAuD;CACnF;CAEA,MAAM,cAAc,OAClB,WACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAoC;GACpF,YAAY,qBAAqB;GACjC,MAAM;GACN;GACA,GAAG;GAEH,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EACzC,CAAC;EAED,OAAO,UAAU,SAAS,IAAuD;CACnF;CAEA,MAAM,cAAc,OAClB,YACA,WACA,WACG;EAEH,QAAO,MADe,aAA4C,YAAY,MAAM,EAAA,CACrE,QAAQ,WAAW,OAAO,KAAK,cAAc,SAAS;CACvE;;;;;;;;CASA,MAAM,oBAAoB,OACxB,YACA,MACA,WACA,WACG;EAEH,QAAO,MADe,YAAY,YAAY,WAAW,MAAM,EAAA,CAChD,QAAQ,WAAW,yBAAyB,OAAO,IAAI,MAAM,IAAI;CAClF;CAEA,MAAM,eAAe,OACnB,YACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAEhD;GACA;GACA;GACA,QAAQ;GACR,GAAG;GAEH,MAAM,iBAAiB,IAAI;EAC7B,CAAC;EAED,OAAO,UAAU,SAAS,IAAmE;CAC/F;CAEA,MAAM,gBAAgB,OACpB,YACA,OACA,OAAiC,CAAC,MAElCC,mBAAAA,WAAW;EACT;EACA,SAAS,OAAO,SAAS,aAAa,YAAY,MAAM,IAAI;EAC5D,aAAa;CACf,CAAC;CAIH,MAAM,kBAAkB,OACtB,OACA,UAGA,OAAiC,CAAC,MAC/B;EACH,MAAM,eAAe,MAAM,YAAY,OAAO,IAAI;EAElD,MAAM,QAAQ,yBAAyB,SAAS,gBAC7C,SAAS,eAAe,CAAC,EAAA,CAAG,KAAK,UAAU;GAC1C;GACA,MAAM;IACJ,GAAG;IACH,WAAW,aAAa;GAC1B;EACF,EAAE,CACJ;EAQA,OAAO;GAAE,OAAO;GAAc,UAAU,MANVA,mBAAAA,WAAW;IACvC;IACA,SAAS,OAAO,EAAE,YAAY,WAAW,aAAa,YAAY,MAAM,IAAI;IAC5E,aAAa;GACf,CAAC;EAEuD;CAC1D;CAEA,MAAM,eAAe,OACnB,YACA,YACA,MACA,OAAiC,CAAC,MAC/B;EACH,MAAM,OAAO,yBAAyB,IAAI;EAC1C,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAEhD;GACA;GACA,MAAM;GACN;GACA,GAAG;GAEH,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACzB,CAAC;EAED,OAAO,UAAU,SAAS,IAAmE;CAC/F;CAEA,MAAM,eAAe,OAAO,YAAqC,eAAuB;EACtF,MAAM,gBAAgB,WAAW,iBAAiB;GAChD;GACA,MAAM;EACR,CAAC;CACH;;;;;;;;;;;;CAaA,MAAM,oBAAoB,OACxB,WACA,WACqC;EAYrC,QAAO,MAXsB,QAAQ,IACnC,yBAAyB,IAAI,OAAO,eAAe;GAEjD,QAAO,MADe,YAAY,YAAY,WAAW,MAAM,EAAA,CAChD,KAAK,YAAY;IAC9B;IACA,YAAY,OAAO;IACnB,MAAM,kBAAkB,OAAO,IAAI;GACrC,EAAE;EACJ,CAAC,CACH,EAAA,CAEsB,KAAK;CAC7B;;;;;;;;CASA,MAAM,cAAc,OAAO,cAAsB;EAC/C,MAAM,WAAW,MAAM,kBAAkB,SAAS;EAElD,MAAM,WAAW,MAAMA,mBAAAA,WAAW;GAChC,OAAO;GACP,SAAS,OAAO,UAAU;IACxB,IAAI;KACF,MAAM,aAAa,MAAM,YAAY,MAAM,UAAU;KACrD,OAAO;MAAE,IAAI;MAAe;KAAM;IACpC,SAAS,OAAO;KACd,OAAO;MAAE,IAAI;MAAgB;MAAO;KAAM;IAC5C;GACF;GACA,aAAa;EACf,CAAC;EAED,MAAM,kBAA2C,CAAC;EAClD,MAAM,iBAAoD,CAAC;EAC3D,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,IAAI,gBAAgB,KAAK,QAAQ,KAAK;OAC7C,eAAe,KAAK;GAAE,GAAG,QAAQ;GAAO,OAAO,QAAQ;EAAM,CAAC;EAGrE,IAAI,eAAe,SAAS,GAC1B,MAAM,IAAI,gCAAgC;GAAE;GAAW;GAAiB;EAAe,CAAC;EAG1F,MAAM,gBAAgB,WAAW,iBAAiB;GAChD,YAAY,qBAAqB;GACjC,MAAM;EACR,CAAC;CACH;;;;;;;;CASA,MAAM,wBAAwB,OAC5B,YACA,YACA,qBACG;EACH,MAAM,gBAAgB,WAAW,sBAAsB;GACrD;GACA,MAAM;GACN;EACF,CAAC;CACH;;;;;;;;;CAUA,MAAM,6BAA6B,OAAO,YAAgC,eAAuB;EAI/F,MAAM,WAAW,MAAM,gBAAgB,WAAW,iBAAiB;GACjE;GACA,MAAM;GACN,OAAO;EACT,CAAC;EAED,OAAO,UAAU,SAAS,IAA6D;CACzF;CAEA,OAAO;EAEL;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EACA;CACF;AACF"}