@makemind/sdk 0.1.0

package/dist/index.mjs

@@ -0,0 +1,4074 @@
+// src/utils/errors.ts
+var MAKEMINDError = class _MAKEMINDError extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.name = "MAKEMINDError";
+    this.code = code;
+    this.details = details;
+  }
+  static fromApiError(error) {
+    const err = error;
+    const code = err.code || "UNKNOWN_ERROR";
+    const message = err.message || "An unknown error occurred";
+    return new _MAKEMINDError(code, message, err.details);
+  }
+  static fromHttpStatus(status, body) {
+    const statusMapping = {
+      400: ErrorCodes.VALIDATION_ERROR,
+      401: ErrorCodes.UNAUTHENTICATED,
+      403: ErrorCodes.PERMISSION_DENIED,
+      404: ErrorCodes.NOT_FOUND,
+      409: ErrorCodes.ALREADY_EXISTS,
+      429: ErrorCodes.QUOTA_EXCEEDED,
+      500: ErrorCodes.INTERNAL_ERROR,
+      503: ErrorCodes.SERVICE_UNAVAILABLE
+    };
+    const code = statusMapping[status] || "UNKNOWN_ERROR";
+    const bodyObj = body;
+    const message = bodyObj?.message || `HTTP error ${status}`;
+    return new _MAKEMINDError(code, message, bodyObj?.details);
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      details: this.details
+    };
+  }
+};
+var ErrorCodes = {
+  // Auth errors
+  UNAUTHENTICATED: "UNAUTHENTICATED",
+  PERMISSION_DENIED: "PERMISSION_DENIED",
+  INVALID_TOKEN: "INVALID_TOKEN",
+  // Data errors
+  NOT_FOUND: "NOT_FOUND",
+  ALREADY_EXISTS: "ALREADY_EXISTS",
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  // Tenant errors
+  TENANT_NOT_FOUND: "TENANT_NOT_FOUND",
+  TENANT_SUSPENDED: "TENANT_SUSPENDED",
+  NOT_A_MEMBER: "NOT_A_MEMBER",
+  // Quota errors
+  QUOTA_EXCEEDED: "QUOTA_EXCEEDED",
+  // Storage errors
+  STORAGE_ERROR: "STORAGE_ERROR",
+  // System errors
+  INTERNAL_ERROR: "INTERNAL_ERROR",
+  SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR"
+};
+
+// src/services/auth.ts
+var STORAGE_KEYS = {
+  AUTH_TOKEN: "makemindAuthToken",
+  REFRESH_TOKEN: "makemindRefreshToken",
+  USER_DATA: "makemindUserData",
+  MEMBERSHIPS: "makemindMemberships"
+};
+var MAKEMINDAuth = class {
+  constructor(config) {
+    this._currentUser = null;
+    this._memberships = [];
+    this.refreshToken = null;
+    this.authStateCallbacks = /* @__PURE__ */ new Set();
+    this.apiClient = config.apiClient;
+    this.applicationId = config.applicationId;
+    this.onAuthStateChange = config.onAuthStateChange;
+    this.setAuthToken = config.setAuthToken;
+    this.restoreSession();
+  }
+  restoreSession() {
+    if (typeof window === "undefined" || typeof localStorage === "undefined") {
+      return;
+    }
+    try {
+      const storedToken = localStorage.getItem(STORAGE_KEYS.AUTH_TOKEN);
+      const storedRefreshToken = localStorage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
+      if (storedRefreshToken) localStorage.removeItem(STORAGE_KEYS.REFRESH_TOKEN);
+      const storedUserData = localStorage.getItem(STORAGE_KEYS.USER_DATA);
+      const storedMemberships = localStorage.getItem(STORAGE_KEYS.MEMBERSHIPS);
+      if (storedToken && storedUserData) {
+        this._currentUser = JSON.parse(storedUserData);
+        this.refreshToken = storedRefreshToken;
+        this._memberships = storedMemberships ? JSON.parse(storedMemberships) : [];
+        this.setAuthToken(storedToken);
+        this.onAuthStateChange(this._currentUser);
+      }
+    } catch {
+      this.clearStoredSession();
+    }
+  }
+  persistSession(user, token, refreshToken, memberships) {
+    if (typeof window === "undefined" || typeof localStorage === "undefined") {
+      return;
+    }
+    try {
+      localStorage.setItem(STORAGE_KEYS.AUTH_TOKEN, token);
+      localStorage.removeItem(STORAGE_KEYS.REFRESH_TOKEN);
+      localStorage.setItem(STORAGE_KEYS.USER_DATA, JSON.stringify(user));
+      if (memberships) {
+        localStorage.setItem(STORAGE_KEYS.MEMBERSHIPS, JSON.stringify(memberships));
+      }
+    } catch {
+    }
+  }
+  clearStoredSession() {
+    if (typeof window === "undefined" || typeof localStorage === "undefined") {
+      return;
+    }
+    try {
+      localStorage.removeItem(STORAGE_KEYS.AUTH_TOKEN);
+      localStorage.removeItem(STORAGE_KEYS.REFRESH_TOKEN);
+      localStorage.removeItem(STORAGE_KEYS.USER_DATA);
+      localStorage.removeItem(STORAGE_KEYS.MEMBERSHIPS);
+    } catch {
+    }
+  }
+  get currentUser() {
+    return this._currentUser;
+  }
+  get memberships() {
+    return this._memberships;
+  }
+  /**
+   * Set the session directly from an externally-obtained token — e.g. a Firebase
+   * ID token from Google sign-in, which the gateway accepts as a Bearer. Mirrors
+   * the post-authentication state update of signInWithEmail (set token, persist
+   * to localStorage, notify auth-state listeners) without a /auth/signin
+   * round-trip. Also used by the console's token-refresh bridge to swap in a
+   * freshly-refreshed Firebase token. Existing memberships are preserved when
+   * `memberships` is omitted.
+   */
+  setSession(user, token, refreshToken, memberships) {
+    this._currentUser = user;
+    this.refreshToken = refreshToken;
+    if (memberships) {
+      this._memberships = memberships;
+    }
+    this.setAuthToken(token);
+    this.persistSession(user, token, refreshToken, memberships ?? this._memberships);
+    this.onAuthStateChange(user);
+    this.notifyAuthStateCallbacks(user);
+  }
+  /**
+   * Load the caller's tenant memberships into the session.
+   *
+   * `signInWithEmail` gets them in its response, but a session established from
+   * an external credential (a Firebase ID token from a Google popup) has no
+   * such response — it arrives with claims only. Claims carry the *current*
+   * tenant, not the list, and a platform admin's claims carry no tenant roles
+   * at all, so a console that gates its navigation on `admin`/`owner` shows an
+   * almost empty menu until this runs.
+   *
+   * @return {Promise<TenantMembership[]>} The loaded memberships.
+   */
+  async loadMemberships() {
+    const res = await this.apiClient.dispatch(
+      "getUserTenants",
+      {}
+    );
+    const memberships = (res?.tenants ?? []).map((t) => ({
+      tenantId: String(t.id ?? ""),
+      tenantName: String(t.name ?? t.id ?? ""),
+      tenantDisplayName: String(t.displayName ?? t.name ?? t.id ?? ""),
+      roles: Array.isArray(t.roles) ? t.roles : [],
+      // The op returns the tenant's own status; a membership on a live tenant
+      // is what a consumer means by active.
+      status: String(t.status ?? "active")
+    }));
+    this._memberships = memberships;
+    if (this._currentUser) {
+      localStorage.setItem(STORAGE_KEYS.MEMBERSHIPS, JSON.stringify(memberships));
+    }
+    return memberships;
+  }
+  async signInWithEmail(email, password) {
+    try {
+      const response = await this.apiClient.post("/auth/signin", {
+        email,
+        password,
+        applicationId: this.applicationId
+      }, { skipAuth: true });
+      this._currentUser = response.user;
+      this.refreshToken = response.refreshToken ?? null;
+      this._memberships = response.memberships || [];
+      this.setAuthToken(response.token);
+      this.persistSession(response.user, response.token, response.refreshToken, response.memberships);
+      this.onAuthStateChange(response.user);
+      this.notifyAuthStateCallbacks(response.user);
+      return response.user;
+    } catch (error) {
+      if (error instanceof MAKEMINDError) {
+        throw error;
+      }
+      throw new MAKEMINDError("AUTH_ERROR", "Failed to sign in");
+    }
+  }
+  // Alias for Firebase compatibility
+  async signInWithEmailAndPassword(email, password) {
+    return this.signInWithEmail(email, password);
+  }
+  async signUp(email, password, options) {
+    try {
+      const response = await this.apiClient.post("/auth/signup", {
+        email,
+        password,
+        displayName: options?.displayName,
+        phoneNumber: options?.phoneNumber,
+        applicationId: this.applicationId
+      }, { skipAuth: true });
+      this._currentUser = response.user;
+      this.refreshToken = response.refreshToken ?? null;
+      this._memberships = response.memberships || [];
+      this.setAuthToken(response.token);
+      this.persistSession(response.user, response.token, response.refreshToken, response.memberships);
+      this.onAuthStateChange(response.user);
+      this.notifyAuthStateCallbacks(response.user);
+      return response.user;
+    } catch (error) {
+      if (error instanceof MAKEMINDError) {
+        throw error;
+      }
+      throw new MAKEMINDError("AUTH_ERROR", "Failed to sign up");
+    }
+  }
+  async signOut() {
+    try {
+      await this.apiClient.post("/auth/signout", {});
+    } catch {
+    } finally {
+      this._currentUser = null;
+      this._memberships = [];
+      this.refreshToken = null;
+      this.setAuthToken(null);
+      this.clearStoredSession();
+      this.onAuthStateChange(null);
+      this.notifyAuthStateCallbacks(null);
+    }
+  }
+  async sendPasswordResetEmail(email) {
+    await this.apiClient.post("/auth/password/reset", {
+      email,
+      applicationId: this.applicationId
+    }, { skipAuth: true });
+  }
+  onAuthStateChanged(callback) {
+    this.authStateCallbacks.add(callback);
+    callback(this._currentUser);
+    return () => {
+      this.authStateCallbacks.delete(callback);
+    };
+  }
+  notifyAuthStateCallbacks(user) {
+    this.authStateCallbacks.forEach((callback) => {
+      try {
+        callback(user);
+      } catch {
+      }
+    });
+  }
+  async refreshAuthToken() {
+    try {
+      const response = await this.apiClient.post(
+        "/auth/refresh",
+        this.refreshToken ? { refreshToken: this.refreshToken } : {},
+        { skipAuth: true }
+      );
+      this.refreshToken = response.refreshToken ?? null;
+      this.setAuthToken(response.token);
+      if (response.memberships) {
+        this._memberships = response.memberships;
+      }
+      if (response.user) {
+        this._currentUser = response.user;
+        this.onAuthStateChange(response.user);
+        this.notifyAuthStateCallbacks(response.user);
+        this.persistSession(response.user, response.token, response.refreshToken, response.memberships);
+      } else if (this._currentUser) {
+        this.persistSession(this._currentUser, response.token, response.refreshToken, response.memberships);
+      }
+    } catch {
+      await this.signOut();
+      throw new MAKEMINDError("UNAUTHENTICATED", "Session expired");
+    }
+  }
+  async switchTenant(tenantId) {
+    await this.apiClient.dispatch(
+      "switchTenant",
+      { tenantId }
+    );
+    await this.refreshAuthToken();
+    if (!this._currentUser) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "Session lost after tenant switch");
+    }
+    return this._currentUser;
+  }
+  // Returns tenants the authenticated user belongs to.
+  // Backend dispatch 'authGetUserTenants' → { tenants: Record<string, unknown>[] }
+  async getUserMemberships() {
+    const response = await this.apiClient.dispatch(
+      "authGetUserTenants"
+    );
+    return (response.tenants || []).map((t) => ({
+      tenantId: t["id"],
+      tenantName: t["displayName"] ?? t["name"],
+      roles: t["roles"] ?? [],
+      status: t["status"] ?? "active"
+    }));
+  }
+  // Permission helpers
+  hasScope(scope) {
+    if (!this._currentUser) return false;
+    return this._currentUser.scopes.includes(scope) || this._currentUser.scopes.includes("*");
+  }
+  hasRole(role) {
+    if (!this._currentUser) return false;
+    return this._currentUser.roles.includes(role);
+  }
+  hasAnyRole(roles) {
+    if (!this._currentUser) return false;
+    return roles.some((role) => this._currentUser.roles.includes(role));
+  }
+  hasAllScopes(scopes) {
+    if (!this._currentUser) return false;
+    if (this._currentUser.scopes.includes("*")) return true;
+    return scopes.every((scope) => this._currentUser.scopes.includes(scope));
+  }
+  /**
+   * Get the current ID token for use with external services
+   */
+  async getIdToken(forceRefresh = false) {
+    if (!this._currentUser) {
+      return null;
+    }
+    if (forceRefresh) {
+      await this.refreshAuthToken();
+    }
+    if (typeof localStorage !== "undefined") {
+      return localStorage.getItem(STORAGE_KEYS.AUTH_TOKEN);
+    }
+    return null;
+  }
+  /**
+   * Update the current user's password.
+   * Backend dispatch 'updatePassword' → data { currentPassword, newPassword }.
+   */
+  async updatePassword(currentPassword, newPassword) {
+    if (!this._currentUser) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No user signed in");
+    }
+    await this.apiClient.dispatch("updatePassword", { currentPassword, newPassword });
+  }
+  /**
+   * Send email verification.
+   * Backend dispatch 'resendVerificationEmail' — uid resolved from auth context, no payload needed.
+   */
+  async sendEmailVerification() {
+    if (!this._currentUser) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No user signed in");
+    }
+    await this.apiClient.dispatch("resendVerificationEmail");
+  }
+  /**
+   * Verify email with code
+   */
+  async verifyEmail(code) {
+    await this.apiClient.post("/auth/verify-email", {
+      code,
+      applicationId: this.applicationId
+    }, { skipAuth: true });
+  }
+  /**
+   * Confirm password reset with code
+   */
+  async confirmPasswordReset(code, newPassword) {
+    await this.apiClient.post("/auth/confirm-reset", {
+      code,
+      newPassword,
+      applicationId: this.applicationId
+    }, { skipAuth: true });
+  }
+  /**
+   * OAuth redirect-based sign-in is NOT supported by this backend.
+   * The backend has no /oauth/initiate or /oauth/callback routes.
+   * Use signInWithOAuthToken() with a provider-issued ID token instead,
+   * or use the Firebase Client SDK directly for OAuth redirect flows.
+   */
+  async signInWithOAuth(_provider) {
+    throw new MAKEMINDError(
+      "NOT_SUPPORTED",
+      "OAuth redirect flow is not supported. Use signInWithOAuthToken() with a provider ID token, or the Firebase Client SDK."
+    );
+  }
+  /**
+   * OAuth redirect callback handling is NOT supported by this backend.
+   * Use signInWithOAuthToken() with a provider-issued ID token instead,
+   * or use the Firebase Client SDK directly for OAuth redirect flows.
+   */
+  async handleOAuthCallback(_code, _state) {
+    throw new MAKEMINDError(
+      "NOT_SUPPORTED",
+      "OAuth redirect callback is not supported. Use signInWithOAuthToken() with a provider ID token, or the Firebase Client SDK."
+    );
+  }
+  /**
+   * Sign in with OAuth ID token directly (for native apps)
+   * Use this when you have already obtained the ID token from the OAuth provider
+   */
+  async signInWithOAuthToken(provider, idToken) {
+    try {
+      const response = await this.apiClient.post("/auth/oauth/token", {
+        provider,
+        idToken,
+        applicationId: this.applicationId
+      }, { skipAuth: true });
+      this._currentUser = response.user;
+      this.refreshToken = response.refreshToken ?? null;
+      this._memberships = response.memberships || [];
+      this.setAuthToken(response.token);
+      this.persistSession(response.user, response.token, response.refreshToken, response.memberships);
+      this.onAuthStateChange(response.user);
+      this.notifyAuthStateCallbacks(response.user);
+      return response.user;
+    } catch (error) {
+      if (error instanceof MAKEMINDError) {
+        throw error;
+      }
+      throw new MAKEMINDError("AUTH_ERROR", "OAuth token authentication failed");
+    }
+  }
+  /**
+   * OAuth redirect-based account linking is NOT supported by this backend.
+   * The backend has no /oauth/link/initiate route.
+   * Use the Firebase Client SDK linkWithRedirect() or linkWithPopup() instead.
+   */
+  async linkWithOAuth(_provider) {
+    throw new MAKEMINDError(
+      "NOT_SUPPORTED",
+      "OAuth redirect link flow is not supported. Use the Firebase Client SDK linkWithRedirect() or linkWithPopup()."
+    );
+  }
+  /**
+   * OAuth redirect link callback is NOT supported by this backend.
+   * The backend has no /oauth/link/callback route.
+   * Use the Firebase Client SDK for OAuth redirect link flows.
+   */
+  async handleOAuthLinkCallback(_code, _state) {
+    throw new MAKEMINDError(
+      "NOT_SUPPORTED",
+      "OAuth redirect link callback is not supported. Use the Firebase Client SDK for OAuth link flows."
+    );
+  }
+  /**
+   * Unlink OAuth provider from current account
+   */
+  async unlinkOAuth(provider) {
+    if (!this._currentUser) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No user signed in");
+    }
+    await this.apiClient.post("/auth/oauth/unlink", {
+      provider
+    });
+  }
+  /**
+   * Get linked OAuth providers for current user
+   */
+  async getLinkedProviders() {
+    if (!this._currentUser) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No user signed in");
+    }
+    const response = await this.apiClient.get("/auth/oauth/providers");
+    return response.providers;
+  }
+  // Update the current user in the session (e.g., after tenant creation)
+  updateCurrentUser(userData, membership) {
+    const user = {
+      uid: userData.uid,
+      email: userData.email,
+      displayName: userData.displayName || null,
+      photoURL: this._currentUser?.photoURL || null,
+      tenantId: userData.tenantId,
+      roles: userData.roles,
+      scopes: userData.scopes
+    };
+    this._currentUser = user;
+    this.onAuthStateChange(user);
+    this.notifyAuthStateCallbacks(user);
+    if (membership) {
+      const existingIndex = this._memberships.findIndex((m) => m.tenantId === membership.tenantId);
+      if (existingIndex >= 0) {
+        this._memberships[existingIndex] = membership;
+      } else {
+        this._memberships.push(membership);
+      }
+    }
+    const storedToken = typeof localStorage !== "undefined" ? localStorage.getItem(STORAGE_KEYS.AUTH_TOKEN) : null;
+    if (storedToken) {
+      this.persistSession(user, storedToken, this.refreshToken ?? "", this._memberships);
+    }
+  }
+};
+
+// src/services/data.ts
+var MAKEMINDData = class {
+  constructor(config) {
+    this.subscriptions = /* @__PURE__ */ new Map();
+    this.apiClient = config.apiClient;
+    this.applicationId = config.applicationId;
+    this.getTenantId = config.tenantId;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  async query(options) {
+    const filters = options.where?.map(({ field, op, value }) => ({
+      field,
+      operator: op,
+      value
+    }));
+    const res = await this.apiClient.dispatch("dataQuery", {
+      collection: options.collection,
+      // The service applies field-level conditions from `filters` (it adds the
+      // `data.` prefix automatically); `where` is reserved for $and/$or logic.
+      filters,
+      sort: options.orderBy,
+      limit: options.limit,
+      startAfter: options.startAfter
+    });
+    return {
+      data: res.results ?? [],
+      metadata: { hasMore: res.hasMore ?? false, lastDocId: res.nextCursor }
+    };
+  }
+  async get(options) {
+    try {
+      const response = await this.apiClient.get(
+        `/data/${options.collection}/${options.documentId}`
+      );
+      return response;
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  async create(options) {
+    const response = await this.apiClient.post(`/data/${options.collection}`, {
+      ...options.data,
+      documentId: options.documentId
+    });
+    return response;
+  }
+  async update(options) {
+    await this.apiClient.patch(`/data/${options.collection}/${options.documentId}`, options.data);
+  }
+  async delete(options) {
+    await this.apiClient.delete(`/data/${options.collection}/${options.documentId}`);
+  }
+  onSnapshot(options, callback) {
+    const subscriptionId = `doc:${options.collection}:${options.documentId}`;
+    this.createSubscription(
+      `/data/subscribe/${options.collection}/${options.documentId}`,
+      subscriptionId,
+      callback
+    );
+    return () => {
+      this.closeSubscription(subscriptionId);
+    };
+  }
+  onCollectionSnapshot(options, callback) {
+    const subscriptionId = `collection:${options.collection}:${JSON.stringify(options)}`;
+    this.createCollectionSubscription(options, subscriptionId, callback);
+    return () => {
+      this.closeSubscription(subscriptionId);
+    };
+  }
+  createSubscription(endpoint, subscriptionId, callback) {
+    this.closeSubscription(subscriptionId);
+    if (typeof EventSource !== "undefined") {
+      const url = `${this.apiClient.getBaseUrl()}${endpoint}`;
+      const eventSource = new EventSource(url, { withCredentials: true });
+      eventSource.onmessage = (event) => {
+        try {
+          const message = JSON.parse(event.data);
+          if (message.type === "data") {
+            callback(message.data);
+          }
+        } catch {
+        }
+      };
+      eventSource.onerror = () => {
+      };
+      this.subscriptions.set(subscriptionId, eventSource);
+    } else {
+      this.pollForUpdates(endpoint, subscriptionId, callback);
+    }
+  }
+  createCollectionSubscription(options, subscriptionId, callback) {
+    this.closeSubscription(subscriptionId);
+    const poll = async () => {
+      try {
+        const result = await this.query(options);
+        callback(result.data);
+      } catch {
+      }
+    };
+    poll();
+    const intervalId = setInterval(poll, 5e3);
+    this.subscriptions.set(subscriptionId, {
+      close: () => clearInterval(intervalId)
+    });
+  }
+  pollForUpdates(endpoint, subscriptionId, callback) {
+    const poll = async () => {
+      try {
+        const data = await this.apiClient.get(endpoint);
+        callback(data);
+      } catch {
+      }
+    };
+    poll();
+    const intervalId = setInterval(poll, 5e3);
+    this.subscriptions.set(subscriptionId, {
+      close: () => clearInterval(intervalId)
+    });
+  }
+  closeSubscription(subscriptionId) {
+    const subscription = this.subscriptions.get(subscriptionId);
+    if (subscription) {
+      if (subscription instanceof EventSource) {
+        subscription.close();
+      } else if (typeof subscription.close === "function") {
+        subscription.close();
+      }
+      this.subscriptions.delete(subscriptionId);
+    }
+  }
+  // collectionGroupQuery: no backend route or onCall handler exists for cross-
+  // collection group queries. REST /data/collection-group-query is not registered
+  // and no `dataCollectionGroupQuery` onCall is exported from data-platform.
+  // Callers must use `query()` against a specific collection. This method is
+  // intentionally left as a not-implemented guard so TS callers compile and get
+  // a clear runtime error rather than a silent 404 or wrong-handler response.
+  async collectionGroupQuery(_options) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "collectionGroupQuery is not yet supported by the backend. Use query() against a specific collection."
+    );
+  }
+  // Convenience methods with tenant isolation
+  async queryTenant(collectionName, additionalConditions, orderByOptions, limitCount) {
+    const conditions = [
+      ...additionalConditions || []
+    ];
+    return this.query({
+      collection: collectionName,
+      where: conditions,
+      orderBy: orderByOptions,
+      limit: limitCount
+    });
+  }
+  // Batch operations
+  //
+  // All three batch methods route through the `dataBatchWrite` onCall handler
+  // (dispatch op `dataBatchWrite`). The backend BatchWriteInput shape is:
+  //   { operations: [{ type, collection?, id?, data? }] }
+  // There are no separate REST PATCH /batch or POST /batch-delete routes.
+  async batchCreate(collection, documents) {
+    const operations = documents.map(({ data, documentId }) => ({
+      type: "create",
+      collection,
+      ...documentId ? { id: documentId } : {},
+      data
+    }));
+    const response = await this.apiClient.dispatch(
+      "dataBatchWrite",
+      { operations }
+    );
+    return response.results.map((r) => ({ id: r.id, data: {} }));
+  }
+  async batchUpdate(collection, updates) {
+    const operations = updates.map(({ documentId, data }) => ({
+      type: "update",
+      id: documentId,
+      data
+    }));
+    await this.apiClient.dispatch("dataBatchWrite", { operations });
+  }
+  async batchDelete(collection, documentIds) {
+    const operations = documentIds.map((id) => ({
+      type: "delete",
+      id
+    }));
+    await this.apiClient.dispatch("dataBatchWrite", { operations });
+  }
+  // Export/Import operations
+  //
+  // Backend uses async job pattern via onCall handlers:
+  //   dataExportCollection → returns { exportId, status }
+  //   dataImportCollection → returns { importId, status }  (sourcePath required)
+  //   dataGetExportStatus  → returns full ExportJob by { exportId }
+  //   dataGetImportStatus  → returns full ImportJob by { importId }
+  //
+  // There are no flat REST routes /data/export or /data/import; the collection-
+  // scoped synchronous REST routes (POST /:collection/export, POST /:collection/import)
+  // exist for simple inline operations but do not produce jobIds. All job-based
+  // export/import goes through dispatch.
+  //
+  // Import requires the caller to upload the file to Cloud Storage first (under
+  // imports/<tenantId>/ or uploads/<tenantId>/) and pass the GCS path as
+  // `sourcePath`. The `data` parameter accepted here must be a GCS path string;
+  // array-of-records import is not supported by the onCall handler.
+  async exportCollection(options) {
+    const res = await this.apiClient.dispatch(
+      "dataExportCollection",
+      {
+        collection: options.collection,
+        format: options.format,
+        filter: options.filter
+      }
+    );
+    return { jobId: res.exportId, status: res.status };
+  }
+  async importCollection(options) {
+    const res = await this.apiClient.dispatch(
+      "dataImportCollection",
+      {
+        collection: options.collection,
+        sourcePath: options.sourcePath,
+        format: options.format,
+        upsert: options.upsert
+      }
+    );
+    return { jobId: res.importId, status: res.status };
+  }
+  async getExportStatus(jobId) {
+    const res = await this.apiClient.dispatch("dataGetExportStatus", { exportId: jobId });
+    return {
+      jobId: res.id,
+      status: res.status,
+      documentCount: res.documentCount,
+      downloadUrl: res.downloadUrl,
+      error: res.error,
+      completedAt: res.completedAt
+    };
+  }
+  async getImportStatus(jobId) {
+    const res = await this.apiClient.dispatch("dataGetImportStatus", { importId: jobId });
+    return {
+      jobId: res.id,
+      status: res.status,
+      totalRecords: res.totalRecords,
+      processedRecords: res.processedRecords,
+      skippedRecords: res.skippedRecords,
+      failedRecords: res.failedRecords,
+      error: res.error,
+      completedAt: res.completedAt
+    };
+  }
+  // Aggregation operations
+  //
+  // Backend onCall: `dataAggregate` — accepts AggregateInput:
+  //   { collection, filters: [{ field, operator, value }], aggregations }
+  // No REST route /data/aggregate exists.
+  async aggregate(options) {
+    const filters = options.filters?.map(({ field, op, value }) => ({
+      field,
+      operator: op,
+      value
+    }));
+    return this.apiClient.dispatch("dataAggregate", {
+      collection: options.collection,
+      filters,
+      aggregations: options.aggregations
+    });
+  }
+  // Full-text search
+  //
+  // Backend onCall: `dataSearch` — accepts:
+  //   { collection, query, fields, limit? }
+  // No REST route /data/search exists.
+  async search(options) {
+    return this.apiClient.dispatch("dataSearch", {
+      collection: options.collection,
+      query: options.query,
+      fields: options.fields,
+      limit: options.limit
+    });
+  }
+};
+
+// src/services/logic.ts
+var MAKEMINDLogic = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  // Generic transition for any workflow
+  async transition(options) {
+    const response = await this.apiClient.post("/logic/transition", {
+      ...options,
+      tenantId: this.getTenantId()
+    });
+    return response;
+  }
+  // Call a logic function directly
+  async call(functionName, input) {
+    const response = await this.apiClient.post("/logic/call", {
+      functionName,
+      input,
+      tenantId: this.getTenantId()
+    });
+    return response;
+  }
+  // Execute a flow
+  async executeFlow(flowId, input, options) {
+    const response = await this.apiClient.post("/logic/execute", {
+      flowId,
+      input,
+      idempotencyKey: options?.idempotencyKey,
+      tenantId: this.getTenantId()
+    });
+    return response;
+  }
+  // Get execution status
+  async getExecution(executionId) {
+    return this.apiClient.get(`/logic/executions/${executionId}`);
+  }
+  // List executions
+  async listExecutions(options) {
+    const params = new URLSearchParams();
+    if (options?.flowId) params.append("flowId", options.flowId);
+    if (options?.status) params.append("status", options.status);
+    if (options?.limit) params.append("limit", String(options.limit));
+    if (options?.startAfter) params.append("startAfter", options.startAfter);
+    return this.apiClient.get(`/logic/executions?${params.toString()}`);
+  }
+  // Send signal to a waiting workflow
+  async sendSignal(executionId, signalName, payload) {
+    return this.apiClient.post(`/logic/executions/${executionId}/signal`, {
+      signalName,
+      payload
+    });
+  }
+  /**
+   * Cancel a running workflow execution
+   */
+  async cancelWorkflow(executionId, reason) {
+    return this.apiClient.post(`/logic/executions/${executionId}/cancel`, {
+      reason
+    });
+  }
+  /**
+   * Retry a failed workflow execution
+   */
+  async retryWorkflow(executionId) {
+    return this.apiClient.post(`/logic/executions/${executionId}/retry`, {});
+  }
+  /**
+   * Pause a running workflow execution
+   */
+  async pauseWorkflow(executionId) {
+    return this.apiClient.post(`/logic/executions/${executionId}/pause`, {});
+  }
+  /**
+   * Resume a paused workflow execution
+   */
+  async resumeWorkflow(executionId) {
+    return this.apiClient.post(`/logic/executions/${executionId}/resume`, {});
+  }
+  // ECO (Engineering Change Order) workflow helpers
+  async ecoTransition(ecoId, action, data) {
+    return this.transition({
+      workflowName: "eco",
+      documentId: ecoId,
+      action,
+      data
+    });
+  }
+  // NCR (Non-Conformance Report) workflow helpers
+  async ncrTransition(issueId, action, data) {
+    return this.transition({
+      workflowName: "ncr",
+      documentId: issueId,
+      action,
+      data
+    });
+  }
+  // Bid workflow helpers
+  async bidTransition(requestId, bidId, action, data) {
+    return this.transition({
+      workflowName: "bid",
+      documentId: `${requestId}:${bidId}`,
+      action,
+      data
+    });
+  }
+  // Gate approval
+  async gateApproval(productId, gate, action, comment) {
+    return this.transition({
+      workflowName: "gate",
+      documentId: productId,
+      action: `${gate}_${action}`,
+      data: comment ? { comment } : void 0
+    });
+  }
+  // Document access with watermark
+  async accessDocument(documentId, action) {
+    return this.apiClient.post("/logic/document-access", {
+      documentId,
+      action,
+      tenantId: this.getTenantId()
+    });
+  }
+  // Flow management
+  async createFlow(flow) {
+    return this.apiClient.post("/logic/flows", {
+      ...flow,
+      tenantId: this.getTenantId()
+    });
+  }
+  async updateFlow(flowId, updates) {
+    await this.apiClient.patch(`/logic/flows/${flowId}`, updates);
+  }
+  async publishFlow(flowId) {
+    await this.apiClient.post(`/logic/flows/${flowId}/publish`, {});
+  }
+  async archiveFlow(flowId) {
+    await this.apiClient.post(`/logic/flows/${flowId}/archive`, {});
+  }
+  /**
+   * A page of the tenant's flows.
+   *
+   * Took no arguments and returned a bare array, so a caller wanting one
+   * state — published flows, to offer as event handlers — pulled every state
+   * and filtered locally. The server has always been able to filter; asking
+   * it to means the page is spent on rows the caller wants.
+   *
+   * `hasMore` is returned rather than implied. A full page and a truncated
+   * one are the same array, and a caller that cannot tell them apart quietly
+   * drops whatever did not fit.
+   */
+  async listFlows(params = {}) {
+    const query = new URLSearchParams();
+    if (params.status) query.set("status", params.status);
+    if (params.mode) query.set("mode", params.mode);
+    if (params.limit !== void 0) query.set("limit", String(params.limit));
+    if (params.cursor) query.set("cursor", params.cursor);
+    const suffix = query.toString();
+    const response = await this.apiClient.get(`/logic/flows${suffix ? `?${suffix}` : ""}`);
+    return {
+      flows: response.flows,
+      hasMore: response.hasMore === true,
+      nextCursor: response.nextCursor
+    };
+  }
+  async getFlow(flowId) {
+    return this.apiClient.get(`/logic/flows/${flowId}`);
+  }
+  async testFlow(flowId, testInput) {
+    return this.apiClient.post(`/logic/flows/${flowId}/test`, {
+      input: testInput
+    });
+  }
+  async cloneFlow(flowId, newName) {
+    return this.apiClient.post(`/logic/flows/${flowId}/clone`, {
+      name: newName
+    });
+  }
+  // Variables management
+  async listVariables() {
+    const response = await this.apiClient.get("/logic/variables");
+    return response.variables;
+  }
+  async getVariable(variableId) {
+    return this.apiClient.get(`/logic/variables/${variableId}`);
+  }
+  async createVariable(data) {
+    return this.apiClient.post("/logic/variables", {
+      ...data,
+      tenantId: this.getTenantId()
+    });
+  }
+  async updateVariable(variableId, data) {
+    await this.apiClient.patch(`/logic/variables/${variableId}`, data);
+  }
+  async deleteVariable(variableId) {
+    await this.apiClient.delete(`/logic/variables/${variableId}`);
+  }
+  // Templates management
+  async listTemplates() {
+    const response = await this.apiClient.get("/logic/templates");
+    return response.templates;
+  }
+  async getTemplate(templateId) {
+    return this.apiClient.get(`/logic/templates/${templateId}`);
+  }
+  async createFlowFromTemplate(templateId, data) {
+    return this.apiClient.post(`/logic/templates/${templateId}/instantiate`, {
+      ...data,
+      tenantId: this.getTenantId()
+    });
+  }
+  // Webhooks management
+  async listWebhooks() {
+    const response = await this.apiClient.get("/logic/webhooks");
+    return response.webhooks;
+  }
+  async createWebhook(data) {
+    return this.apiClient.post("/logic/webhooks", {
+      ...data,
+      tenantId: this.getTenantId()
+    });
+  }
+  async deleteWebhook(webhookId) {
+    await this.apiClient.delete(`/logic/webhooks/${webhookId}`);
+  }
+  async rotateWebhookSecret(webhookId) {
+    return this.apiClient.post(`/logic/webhooks/${webhookId}/rotate-secret`, {});
+  }
+  // Approvals management
+  async listPendingApprovals() {
+    const response = await this.apiClient.get("/logic/approvals/pending");
+    return response.approvals;
+  }
+  async approveRequest(approvalId, comment) {
+    await this.apiClient.post(`/logic/approvals/${approvalId}/approve`, { comment });
+  }
+  async rejectRequest(approvalId, reason) {
+    await this.apiClient.post(`/logic/approvals/${approvalId}/reject`, { reason });
+  }
+  // Data Triggers management
+  async listDataTriggers() {
+    const response = await this.apiClient.get("/logic/data-triggers");
+    return response.triggers;
+  }
+  async createDataTrigger(data) {
+    return this.apiClient.post("/logic/data-triggers", {
+      ...data,
+      tenantId: this.getTenantId()
+    });
+  }
+  async deleteDataTrigger(triggerId) {
+    await this.apiClient.delete(`/logic/data-triggers/${triggerId}`);
+  }
+  async toggleDataTrigger(triggerId, isActive) {
+    await this.apiClient.patch(`/logic/data-triggers/${triggerId}`, { isActive });
+  }
+  // AI Assistant
+  async generateFlowFromPrompt(prompt) {
+    return this.apiClient.post("/logic/ai/generate", {
+      prompt,
+      tenantId: this.getTenantId()
+    });
+  }
+  async explainFlow(flowId) {
+    return this.apiClient.post(`/logic/flows/${flowId}/explain`, {});
+  }
+};
+
+// src/services/tenant.ts
+var MAKEMINDTenant = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+    this.onTenantCreated = config.onTenantCreated;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  // Create a new tenant via API Gateway
+  async createTenant(data) {
+    const requestBody = {
+      name: data.name,
+      displayName: data.settings?.displayName || data.name,
+      type: data.settings?.type || "company",
+      mode: data.mode,
+      settings: data.settings
+    };
+    const response = await this.apiClient.post("/tenants", requestBody);
+    if (this.onTenantCreated) {
+      await this.onTenantCreated(response.tenantId, response.customToken);
+    }
+    return {
+      id: response.tenantId,
+      name: data.name,
+      workspaceId: response.workspaceId,
+      status: response.status,
+      user: response.user,
+      customToken: response.customToken
+    };
+  }
+  // Get current tenant
+  async getCurrent() {
+    try {
+      const response = await this.apiClient.get(`/tenants/${this.tenantId}`);
+      return response;
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  // Get tenant by ID
+  async getTenant(tenantId) {
+    try {
+      const response = await this.apiClient.get(`/tenants/${tenantId}`);
+      return response;
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  // Stream tenant changes (polling-based for API)
+  onTenantSnapshot(callback) {
+    let isSubscribed = true;
+    const poll = async () => {
+      if (!isSubscribed) return;
+      try {
+        const tenant = await this.getCurrent();
+        callback(tenant);
+      } catch {
+      }
+      if (isSubscribed) {
+        setTimeout(poll, 1e4);
+      }
+    };
+    poll();
+    return () => {
+      isSubscribed = false;
+    };
+  }
+  // Update tenant settings.
+  // Backend allowedFields: displayName, settings, tags, metadata, canHostSubtenants, maxSubtenants.
+  // The field 'name' is NOT accepted by the backend PATCH /tenants/:tenantId handler.
+  async updateTenant(updates) {
+    await this.apiClient.patch(`/tenants/${this.tenantId}`, updates);
+  }
+  // Member operations
+  // List tenant members
+  async listMembers() {
+    const response = await this.apiClient.get(
+      `/tenants/${this.tenantId}/members`
+    );
+    return response.members;
+  }
+  // Invite a member.
+  // Backend body: { email, roles: string[] } — uses 'roles' array, not singular 'role'.
+  async inviteMember(data) {
+    await this.apiClient.post(`/tenants/${this.tenantId}/members/invite`, {
+      email: data.email,
+      roles: data.roles
+    });
+  }
+  // Update member roles.
+  // Backend body: { roles: string[] } — uses 'roles' array, not singular 'role'.
+  async updateMember(userId, updates) {
+    await this.apiClient.patch(`/tenants/${this.tenantId}/members/${userId}`, {
+      roles: updates.roles
+    });
+  }
+  // Remove a member
+  async removeMember(userId) {
+    await this.apiClient.delete(`/tenants/${this.tenantId}/members/${userId}`);
+  }
+  // Workspace operations
+  // List workspaces
+  async listWorkspaces() {
+    const response = await this.apiClient.dispatch(
+      "listWorkspaces",
+      {}
+    );
+    return response.workspaces;
+  }
+  // Create workspace via gateway dispatch (createWorkspace onCall).
+  // Backend data: { name, displayName, settings?, type? } → returns { workspaceId: string }.
+  async createWorkspace(data) {
+    return this.apiClient.dispatch("createWorkspace", {
+      name: data.name,
+      displayName: data.displayName,
+      settings: data.settings,
+      type: data.type
+    });
+  }
+  // Update workspace via gateway dispatch (updateWorkspace onCall).
+  // Backend data: { workspaceId, displayName?, settings? } → returns { success: boolean }.
+  async updateWorkspace(workspaceId, updates) {
+    return this.apiClient.dispatch("updateWorkspace", {
+      workspaceId,
+      displayName: updates.displayName,
+      settings: updates.settings
+    });
+  }
+  // Delete workspace via gateway dispatch (deleteWorkspace onCall).
+  // Backend data: { workspaceId } → returns { success: boolean }.
+  async deleteWorkspace(workspaceId) {
+    return this.apiClient.dispatch("deleteWorkspace", { workspaceId });
+  }
+};
+
+// src/services/messaging.ts
+var MAKEMINDMessaging = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.applicationId = config.applicationId;
+    this.getTenantId = config.tenantId;
+    this.getUserId = config.userId;
+    this.firebaseApp = config.firebaseApp;
+    this.vapidKey = config.vapidKey;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  get userId() {
+    const id = this.getUserId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No user context set");
+    }
+    return id;
+  }
+  async getMessaging() {
+    if (!this.messaging) {
+      if (!this.firebaseApp) {
+        throw new MAKEMINDError("CONFIGURATION_ERROR", "Firebase app not configured for push notifications");
+      }
+      const { getMessaging } = await import("firebase/messaging");
+      this.messaging = getMessaging(this.firebaseApp);
+    }
+    return this.messaging;
+  }
+  generateDeviceId() {
+    return `device_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+  }
+  /**
+   * Send a message using a template via the sendBatchMessages onCall.
+   * Maps SDK SendMessageOptions to the batch service: one call per channel.
+   */
+  async send(options) {
+    const channels = options.channels || ["push", "email"];
+    const recipients = options.recipients.map((userId) => ({ userId }));
+    let firstMessageId = "";
+    for (const channelType of channels) {
+      const response = await this.apiClient.dispatch(
+        "messaging-sendBatchMessages",
+        {
+          channelType,
+          templateId: options.template,
+          recipients,
+          params: options.data
+        }
+      );
+      if (!firstMessageId && response.results.length > 0) {
+        firstMessageId = response.results[0].messageId;
+      }
+    }
+    return { messageId: firstMessageId };
+  }
+  /**
+   * Send notification to specific users across channels.
+   * Uses sendBatchMessages onCall (one dispatch per channel).
+   */
+  async notify(userIds, notification) {
+    const channels = notification.channels || ["push"];
+    const recipients = userIds.map((userId) => ({ userId }));
+    let firstMessageId = "";
+    for (const channelType of channels) {
+      const response = await this.apiClient.dispatch(
+        "messaging-sendBatchMessages",
+        {
+          channelType,
+          recipients,
+          title: notification.title,
+          body: notification.body,
+          priority: "normal"
+        }
+      );
+      if (!firstMessageId && response.results.length > 0) {
+        firstMessageId = response.results[0].messageId;
+      }
+    }
+    return { messageId: firstMessageId };
+  }
+  /**
+   * Register device for push notifications.
+   * SDK internally handles token acquisition (Firebase FCM).
+   * Uses the REST /messaging/devices route (already correct).
+   */
+  async registerDevice(options) {
+    const { platform, deviceId } = options;
+    const finalDeviceId = deviceId || this.generateDeviceId();
+    const token = await this.acquirePushToken();
+    await this.apiClient.post("/messaging/devices", {
+      token,
+      platform
+    });
+    this.currentDeviceId = finalDeviceId;
+    return { deviceId: finalDeviceId };
+  }
+  /**
+   * Internal: Acquire push token from the platform's push service.
+   * Currently uses Firebase FCM, abstracted for future cloud-agnostic support.
+   */
+  async acquirePushToken() {
+    if (!this.vapidKey) {
+      throw new MAKEMINDError("CONFIGURATION_ERROR", "VAPID key not configured for push notifications");
+    }
+    try {
+      const messaging = await this.getMessaging();
+      const { getToken } = await import("firebase/messaging");
+      const token = await getToken(messaging, { vapidKey: this.vapidKey });
+      if (!token) {
+        throw new MAKEMINDError("MESSAGING_ERROR", "Failed to acquire push token");
+      }
+      return token;
+    } catch (error) {
+      if (error instanceof MAKEMINDError) throw error;
+      throw new MAKEMINDError("MESSAGING_ERROR", "Failed to acquire push token: " + (error instanceof Error ? error.message : "Unknown error"));
+    }
+  }
+  /**
+   * Unregister device from push notifications.
+   * Uses the REST DELETE /messaging/devices/:token route.
+   * The route key is the raw FCM token (server base64-encodes it to deviceId).
+   */
+  async unregisterDevice(deviceId) {
+    await this.apiClient.delete(`/messaging/devices/${deviceId}`);
+    if (this.currentDeviceId === deviceId) {
+      this.currentDeviceId = void 0;
+    }
+  }
+  /**
+   * Listen for foreground push messages.
+   */
+  onPushMessage(callback) {
+    let attached = null;
+    let cancelled = false;
+    void (async () => {
+      const messaging = await this.getMessaging();
+      const { onMessage } = await import("firebase/messaging");
+      if (cancelled) return;
+      attached = onMessage(messaging, (payload) => {
+        callback({
+          messageId: payload.messageId || "",
+          title: payload.notification?.title,
+          body: payload.notification?.body || "",
+          data: payload.data
+        });
+      });
+    })();
+    return () => {
+      cancelled = true;
+      attached?.();
+      attached = null;
+    };
+  }
+  /**
+   * Get in-app notifications for the current user.
+   * Dispatch op: messaging-getInAppNotifications
+   * Service contract: { userId?, unreadOnly?, limit?, cursor? }
+   * Response: { notifications, hasMore, nextCursor }
+   */
+  async getNotifications(options) {
+    const response = await this.apiClient.dispatch(
+      "messaging-getInAppNotifications",
+      {
+        unreadOnly: options?.unreadOnly ?? false,
+        limit: options?.limit ?? 50,
+        cursor: options?.cursor
+      }
+    );
+    return {
+      notifications: response.notifications,
+      nextCursor: response.nextCursor ?? void 0
+    };
+  }
+  /**
+   * Get in-app notifications stream (polling-based).
+   */
+  onNotifications(callback, options) {
+    let isSubscribed = true;
+    const poll = async () => {
+      if (!isSubscribed) return;
+      try {
+        const result = await this.getNotifications({
+          unreadOnly: options?.unreadOnly,
+          limit: options?.limitCount || 50
+        });
+        callback(result.notifications);
+      } catch {
+      }
+      if (isSubscribed) {
+        setTimeout(poll, 5e3);
+      }
+    };
+    poll();
+    return () => {
+      isSubscribed = false;
+    };
+  }
+  /**
+   * Get unread notification count.
+   * Dispatch op: messaging-getUnreadNotificationCount (the verified onCall service).
+   * Response: { userId, unreadCount }
+   */
+  async getUnreadCount() {
+    const response = await this.apiClient.dispatch(
+      "messaging-getUnreadNotificationCount",
+      {}
+    );
+    return response.unreadCount;
+  }
+  /**
+   * Get unread notification count stream (polling-based).
+   */
+  onUnreadCount(callback) {
+    let isSubscribed = true;
+    const poll = async () => {
+      if (!isSubscribed) return;
+      try {
+        const count = await this.getUnreadCount();
+        callback(count);
+      } catch {
+      }
+      if (isSubscribed) {
+        setTimeout(poll, 1e4);
+      }
+    };
+    poll();
+    return () => {
+      isSubscribed = false;
+    };
+  }
+  /**
+   * Mark a notification as read.
+   * Dispatch op: messaging-markNotificationRead
+   * Service contract: { notificationId } or { notificationIds }
+   */
+  async markAsRead(notificationId) {
+    await this.apiClient.dispatch(
+      "messaging-markNotificationRead",
+      { notificationId }
+    );
+  }
+  /**
+   * Mark all notifications as read for the current user.
+   * Dispatch op: messaging-markAllNotificationsRead (new onCall — no existing match).
+   * Implemented in backend send.ts + service/send.ts below.
+   */
+  async markAllAsRead() {
+    await this.apiClient.dispatch(
+      "messaging-markAllNotificationsRead",
+      {}
+    );
+  }
+  // PLM-specific notification helpers
+  /**
+   * Notify ECO reviewers.
+   */
+  async notifyEcoReviewers(eco, reviewerIds) {
+    return this.send({
+      template: "ecoReviewRequest",
+      recipients: reviewerIds,
+      data: {
+        ecoNumber: eco.requestNumber,
+        title: eco.title,
+        priority: eco.priority,
+        productCode: eco.productCode
+      },
+      channels: ["push", "email"]
+    });
+  }
+  /**
+   * Notify quality issue critical.
+   */
+  async notifyQualityCritical(issue, recipientIds) {
+    return this.send({
+      template: "qualityIssueCritical",
+      recipients: recipientIds,
+      data: {
+        issueNumber: issue.issueNumber,
+        title: issue.title,
+        severity: issue.severity
+      },
+      channels: ["push", "email", "sms"]
+    });
+  }
+  /**
+   * Notify bid received.
+   */
+  async notifyBidReceived(request, bidder, ownerId) {
+    return this.send({
+      template: "bidReceived",
+      recipients: [ownerId],
+      data: {
+        requestNumber: request.requestNumber,
+        title: request.title,
+        bidderName: bidder.name
+      },
+      channels: ["push", "email"]
+    });
+  }
+  // Template Management
+  /**
+   * List available message templates.
+   * Dispatch op: messaging-msgGetTemplates (the verified onCall service).
+   * Service contract: { channelType? }
+   * Response: { templates }
+   */
+  async listTemplates(options) {
+    const response = await this.apiClient.dispatch(
+      "messaging-msgGetTemplates",
+      options?.channel ? { channelType: options.channel } : {}
+    );
+    return response.templates;
+  }
+  /**
+   * Get a specific template by ID.
+   * Dispatch op: messaging-msgGetTemplate
+   * Service contract: { templateId }
+   * Response: template document (FirebaseFirestore.DocumentData)
+   */
+  async getTemplate(templateId) {
+    const response = await this.apiClient.dispatch(
+      "messaging-msgGetTemplate",
+      { templateId }
+    );
+    return response;
+  }
+  /**
+   * Create a new message template.
+   * Dispatch op: messaging-msgCreateTemplate
+   * Service contract: { name, channelType, subject?, body, bodyHtml?, language?, variables?, description? }
+   * Response: { templateId }
+   * Note: backend returns { templateId }; SDK surface returns full MessageTemplate.
+   * We re-fetch the created template to satisfy the return type.
+   */
+  async createTemplate(template) {
+    const response = await this.apiClient.dispatch(
+      "messaging-msgCreateTemplate",
+      {
+        name: template.name,
+        channelType: template.channel,
+        subject: template.subject,
+        body: template.body,
+        variables: template.variables,
+        language: template.language
+      }
+    );
+    return this.getTemplate(response.templateId);
+  }
+  /**
+   * Update an existing template.
+   * Dispatch op: messaging-msgUpdateTemplate
+   * Service contract: { templateId, subject?, body?, bodyHtml?, language?, variables?, description? }
+   * Response: { success }
+   * We re-fetch the updated template to satisfy the return type.
+   */
+  async updateTemplate(templateId, updates) {
+    await this.apiClient.dispatch(
+      "messaging-msgUpdateTemplate",
+      {
+        templateId,
+        subject: updates.subject,
+        body: updates.body,
+        language: updates.language,
+        variables: updates.variables
+      }
+    );
+    return this.getTemplate(templateId);
+  }
+  /**
+   * Delete a template.
+   * Dispatch op: messaging-msgDeleteTemplate
+   * Service contract: { templateId }
+   * Response: { success }
+   */
+  async deleteTemplate(templateId) {
+    await this.apiClient.dispatch(
+      "messaging-msgDeleteTemplate",
+      { templateId }
+    );
+  }
+  // Topic Subscription
+  /**
+   * Subscribe to a topic for push notifications.
+   * Dispatch op: messaging-subscribeToTopic
+   * Service contract: { token, topic, tenantId }
+   * Token is acquired from the current device registration.
+   * If no token is available, the subscription request is sent with userId context only.
+   */
+  async subscribeToTopic(topic) {
+    if (!this.vapidKey) {
+      throw new MAKEMINDError("CONFIGURATION_ERROR", "VAPID key required for topic subscriptions");
+    }
+    const token = await this.acquirePushToken();
+    await this.apiClient.dispatch(
+      "messaging-subscribeToTopic",
+      {
+        token,
+        topic,
+        tenantId: this.tenantId
+      }
+    );
+  }
+  /**
+   * Unsubscribe from a topic.
+   * Dispatch op: messaging-unsubscribeFromTopic
+   * Service contract: { token, topic, tenantId }
+   */
+  async unsubscribeFromTopic(topic) {
+    if (!this.vapidKey) {
+      throw new MAKEMINDError("CONFIGURATION_ERROR", "VAPID key required for topic subscriptions");
+    }
+    const token = await this.acquirePushToken();
+    await this.apiClient.dispatch(
+      "messaging-unsubscribeFromTopic",
+      {
+        token,
+        topic,
+        tenantId: this.tenantId
+      }
+    );
+  }
+  /**
+   * List subscribed topics for the current user.
+   * Dispatch op: messaging-getMyTopics
+   * Service contract: { tenantId? }
+   * Response: { topics: Array<{ topic, fullTopic, tenantId, subscribedAt }> }
+   */
+  async listSubscribedTopics() {
+    const response = await this.apiClient.dispatch(
+      "messaging-getMyTopics",
+      { tenantId: this.tenantId }
+    );
+    return response.topics.map((t) => t.topic);
+  }
+  /**
+   * Send message to a topic.
+   * Dispatch op: messaging-sendTopicMessage
+   * Service contract: { topic, subject?, body, imageUrl?, data? }
+   * Response: { messageId, fcmMessageId }
+   */
+  async sendToTopic(topic, message) {
+    const response = await this.apiClient.dispatch(
+      "messaging-sendTopicMessage",
+      {
+        topic,
+        subject: message.title,
+        body: message.body,
+        data: message.data
+      }
+    );
+    return { messageId: response.messageId };
+  }
+  // Message History
+  /**
+   * Get message history for this tenant.
+   * Dispatch op: messaging-getMessages
+   * Service contract: { channelType?, status?, limit? }
+   * Response: { messages }
+   */
+  async getMessageHistory(options) {
+    const response = await this.apiClient.dispatch(
+      "messaging-getMessages",
+      {
+        channelType: options?.channel,
+        status: options?.status,
+        limit: options?.limit ?? 50
+      }
+    );
+    return {
+      messages: response.messages
+    };
+  }
+  /**
+   * Get full details of a single message.
+   * Dispatch op: messaging-getMessage
+   * Service contract: { messageId }
+   * Response: full message document (FirebaseFirestore.DocumentData)
+   */
+  async getMessageDetails(messageId) {
+    const response = await this.apiClient.dispatch(
+      "messaging-getMessage",
+      { messageId }
+    );
+    return response;
+  }
+  /**
+   * Retry a failed message.
+   * No backend messaging onCall exists for retry (confirmed: two searches — grep
+   * across messaging/service/* and messaging/*.ts both returned no match).
+   * Dispatch op: messaging-retryFailedMessage (new onCall implemented below).
+   */
+  async retryMessage(messageId) {
+    const response = await this.apiClient.dispatch(
+      "messaging-retryFailedMessage",
+      { messageId }
+    );
+    return { messageId: response.messageId };
+  }
+};
+
+// src/services/settlement.ts
+var MAKEMINDSettlement = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  // Record a usage event
+  async recordUsage(options) {
+    await this.apiClient.dispatch("settlement-recordUsage", {
+      metric: options.eventType,
+      value: options.quantity ?? 1,
+      unit: "count",
+      sourceService: options.resourceId || "sdk",
+      metadata: options.metadata
+    });
+  }
+  /**
+   * Record a sale and distribute it to n recipients in one atomic posting.
+   *
+   * The revenue leg and every share leg commit together or not at all. Do not
+   * emulate this by recording the sale and then each share separately — that
+   * makes every partial-failure combination yours to recover, and a
+   * half-distributed sale cannot be repaired from outside the ledger.
+   *
+   * The split rule is the caller's: send the recipients and amounts you
+   * computed. Each cut is either a percentage or a fixed amount, and the two
+   * may be mixed; the combined claim may not exceed the sale. Recipients are settlement accounts, so the same call serves an
+   * End User seller, another party in the tenant, or a platform cut.
+   *
+   * Shares are floored to the currency's minor unit; the remainder stays with
+   * the receiving party. A share too small to express posts no leg and comes
+   * back as `0` / `null`.
+   */
+  async recordSaleWithShares(options) {
+    return this.apiClient.dispatch("settlement-recordSaleWithShares", options);
+  }
+  /**
+   * Reverse a split sale, clawing back each recipient's share in the same
+   * posting. Partial refunds claw back proportionally (floored, so a claw-back
+   * never exceeds what the recipient received; the difference is yours).
+   *
+   * Use this rather than a plain refund for anything recorded with
+   * `recordSaleWithShares` — otherwise the buyer is refunded while the shares
+   * stay paid out, and the ledger is short by exactly the shares.
+   */
+  async reverseSaleWithShares(options) {
+    return this.apiClient.dispatch("settlement-reverseSaleWithShares", options);
+  }
+  // Get usage statistics.
+  // Backend REST GET /settlement/usage/summary accepts startDate/endDate/metric
+  // query params (not a 'period' string). The response is
+  // { data: { summary: Record<metric, { total, count, unit }> } }.
+  // Mapped to UsageStats shape here.
+  async getUsageStats(options) {
+    const params = new URLSearchParams();
+    if (options?.startDate) params.append("startDate", options.startDate);
+    if (options?.endDate) params.append("endDate", options.endDate);
+    if (options?.metric) params.append("metric", options.metric);
+    const raw = await this.apiClient.get(`/settlement/usage/summary?${params.toString()}`);
+    const summary = (raw.data?.summary ?? raw.summary) || {};
+    const events = {};
+    let totalUsage = 0;
+    for (const [key, val] of Object.entries(summary)) {
+      events[key] = val.total;
+      totalUsage += val.total;
+    }
+    return {
+      period: options?.startDate && options?.endDate ? `${options.startDate}/${options.endDate}` : "all",
+      events,
+      totalUsage
+    };
+  }
+  // Get billing summary
+  // NOTE: No backend aggregate function exists. This assembles the summary from
+  // the current subscription (for plan name) and the main account balance (for
+  // current balance + pending charges) via two sequential REST calls. A
+  // dedicated settlement-getBillingSummary onCall is not yet deployed.
+  async getBillingSummary() {
+    const [subResult, accountResult] = await Promise.allSettled([
+      this.apiClient.get(
+        "/settlement/subscriptions/current"
+      ),
+      this.apiClient.get(
+        "/settlement/accounts/main/balance"
+      )
+    ]);
+    const sub = subResult.status === "fulfilled" ? subResult.value : null;
+    const account = accountResult.status === "fulfilled" ? accountResult.value : { balance: 0, pendingBalance: 0, currency: "USD" };
+    return {
+      currentBalance: account.balance ?? 0,
+      pendingCharges: account.pendingBalance ?? 0,
+      currency: account.currency ?? "USD",
+      plan: sub?.planName ?? "free"
+    };
+  }
+  // Get quota status
+  // TODO(gateway): no dedicated quota endpoint exists in the backend. A
+  // settlement-getQuotaStatus onCall or REST route that maps plan limits against
+  // live usage records has not yet been implemented. Requires new business logic
+  // (scope: plan limits table + usage aggregation per metric).
+  async getQuotaStatus(_resourceType) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "getQuotaStatus requires a backend quota endpoint that is not yet available"
+    );
+  }
+  // List invoices.
+  // Backend InvoiceStatus includes 'cancelled' and 'refunded' in addition to
+  // the four values the type/index.ts Invoice interface declares; the filter
+  // param remains the narrower set since the SDK contract targets tenant-portal
+  // display (admin-console can query all statuses directly).
+  async listInvoices(options) {
+    const params = new URLSearchParams();
+    if (options?.status) params.append("status", options.status);
+    if (options?.limit) params.append("limit", String(options.limit));
+    const response = await this.apiClient.get(
+      `/settlement/invoices?${params.toString()}`
+    );
+    return response.items.map((invoice) => ({
+      ...invoice,
+      periodStart: new Date(invoice.periodStart),
+      periodEnd: new Date(invoice.periodEnd),
+      createdAt: new Date(invoice.createdAt)
+    }));
+  }
+  // Get invoice by ID
+  async getInvoice(invoiceId) {
+    return this.apiClient.get(`/settlement/invoices/${invoiceId}`);
+  }
+  // Download invoice PDF
+  // TODO(gateway): invoice PDF generation (rendering, signing, storage) is not
+  // yet implemented in the backend. Requires a new Cloud Function and/or storage
+  // pipeline (scope: PDF renderer + signed GCS URL generation + optional caching).
+  async downloadInvoice(_invoiceId) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "downloadInvoice requires a PDF generation pipeline that is not yet available"
+    );
+  }
+  // Get current plan
+  // Resolves via two dispatch calls: (1) get the active subscription to learn the
+  // productId, then (2) fetch the product record for features/limits.
+  async getCurrentPlan() {
+    const sub = await this.apiClient.get(
+      "/settlement/subscriptions/current"
+    );
+    const productId = sub?.planId;
+    if (!productId) {
+      return { id: "free", name: "Free", features: [], limits: {} };
+    }
+    const product = await this.apiClient.dispatch("settlement-getProduct", { productId });
+    return {
+      id: product.id,
+      name: product.name,
+      features: product.features ?? [],
+      limits: product.includedUsage ?? {}
+    };
+  }
+  // List available plans
+  // Routes to settlement-listProducts filtering on productType='saasPlan'. The
+  // response shape is adapted to the SDK plan contract.
+  async listPlans() {
+    const result = await this.apiClient.dispatch("settlement-listProducts", {
+      productType: "saasPlan",
+      status: "active"
+    });
+    return (result.products ?? []).map((p) => ({
+      id: p.id,
+      name: p.name,
+      description: p.description ?? "",
+      price: p.price ?? 0,
+      currency: p.currency ?? "USD",
+      features: p.features ?? [],
+      limits: p.includedUsage ?? {}
+    }));
+  }
+  // Upgrade/change plan
+  // Routes to POST /settlement/subscriptions which cancels the existing active
+  // subscription and creates a new one for the target plan in a single batch.
+  async changePlan(planId) {
+    await this.apiClient.post("/settlement/subscriptions", { planId });
+  }
+  // ============================================================================
+  // Subscription Management
+  // ============================================================================
+  /**
+   * Get current subscription details
+   */
+  async getCurrentSubscription() {
+    try {
+      return await this.apiClient.get("/settlement/subscriptions/current");
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Subscribe to a plan
+   */
+  async subscribe(options) {
+    return this.apiClient.post("/settlement/subscriptions", {
+      planId: options.planId,
+      billingCycle: options.billingCycle || "monthly",
+      paymentMethod: options.paymentMethodId,
+      couponCode: options.couponCode,
+      startImmediately: options.startImmediately ?? true
+    });
+  }
+  /**
+   * Update current subscription (e.g., change plan, billing cycle).
+   * The backend has no in-place PATCH; a plan update is implemented by creating
+   * a new subscription (which cancels the current one server-side). billingCycle
+   * and prorate are forwarded as metadata but only planId is acted upon today.
+   */
+  async updateSubscription(options) {
+    if (!options.planId) {
+      throw new MAKEMINDError(
+        "VALIDATION_ERROR",
+        "planId is required for updateSubscription"
+      );
+    }
+    return this.apiClient.post("/settlement/subscriptions", {
+      planId: options.planId,
+      billingCycle: options.billingCycle
+    });
+  }
+  /**
+   * Cancel current subscription.
+   * Resolves the active subscriptionId first, then dispatches to
+   * settlement-cancelSubscription. Backend field is cancelImmediately (not
+   * cancelAtPeriodEnd); meaning is inverted — SDK default cancelAtPeriodEnd=true
+   * maps to cancelImmediately=false.
+   */
+  async cancelSubscription(options) {
+    const sub = await this.getCurrentSubscription();
+    if (!sub) {
+      throw new MAKEMINDError("NOT_FOUND", "No active subscription to cancel");
+    }
+    await this.apiClient.dispatch("settlement-cancelSubscription", {
+      subscriptionId: sub.id,
+      cancelImmediately: !(options?.cancelAtPeriodEnd ?? true),
+      reason: options?.reason
+    });
+  }
+  /**
+   * Pause subscription (if supported by plan).
+   * Backend accepts only { subscriptionId }; pauseUntil is not supported yet.
+   */
+  async pauseSubscription(_options) {
+    const sub = await this.getCurrentSubscription();
+    if (!sub) {
+      throw new MAKEMINDError("NOT_FOUND", "No active subscription to pause");
+    }
+    await this.apiClient.dispatch("settlement-pauseSubscription", {
+      subscriptionId: sub.id
+    });
+  }
+  /**
+   * Resume a paused subscription.
+   */
+  async resumeSubscription() {
+    const sub = await this.getCurrentSubscription();
+    if (!sub) {
+      throw new MAKEMINDError("NOT_FOUND", "No subscription found to resume");
+    }
+    return this.apiClient.dispatch("settlement-resumeSubscription", {
+      subscriptionId: sub.id
+    });
+  }
+  /**
+   * Reactivate a canceled subscription (before period end).
+   * Routes to settlement-resumeSubscription: fetches the most-recently-canceled
+   * subscription and resumes it. This is semantically equivalent for the
+   * cancel-at-period-end case where the subscription is still within its period.
+   */
+  async reactivateSubscription() {
+    const sub = await this.getCurrentSubscription();
+    if (!sub) {
+      throw new MAKEMINDError("NOT_FOUND", "No subscription found to reactivate");
+    }
+    return this.apiClient.dispatch("settlement-resumeSubscription", {
+      subscriptionId: sub.id
+    });
+  }
+  /**
+   * Get subscription history.
+   * TODO(gateway): no dedicated subscription history table/function exists in the
+   * backend. Requires a new settlement_subscription_events table or equivalent
+   * audit trail (scope: schema + backfill trigger + query function).
+   */
+  async getSubscriptionHistory(_options) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "getSubscriptionHistory requires a subscription audit trail that is not yet available"
+    );
+  }
+  /**
+   * Preview subscription change (get prorated amounts).
+   * TODO(gateway): proration calculation requires billing period overlap logic
+   * that is not yet implemented in the backend (scope: period credits, immediate
+   * charge delta, next-billing projection — needs a new onCall or REST endpoint).
+   */
+  async previewSubscriptionChange(_newPlanId) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "previewSubscriptionChange requires proration logic that is not yet available"
+    );
+  }
+  /**
+   * Apply a coupon to current subscription.
+   * TODO(gateway): coupon engine (validation, redemption ledger, discount
+   * application) is not yet implemented (scope: coupon collection + validation
+   * function + subscription discount field update).
+   */
+  async applyCoupon(_couponCode) {
+    throw new MAKEMINDError(
+      "NOT_IMPLEMENTED",
+      "applyCoupon requires a coupon engine that is not yet available"
+    );
+  }
+  // Get payment methods
+  // Gateway exposes no /settlement/payment-methods REST route; routed through the
+  // settlement dispatch operation instead.
+  async getPaymentMethods() {
+    const response = await this.apiClient.dispatch("settlement-listPaymentMethods", {});
+    return response.paymentMethods;
+  }
+  // Add payment method.
+  // Backend onCall expects { provider, stripe?, toss?, kakaoPay?, manual? }.
+  async addPaymentMethod(data) {
+    return this.apiClient.dispatch(
+      "settlement-addPaymentMethod",
+      data
+    );
+  }
+  // Remove payment method.
+  // Backend field name is paymentAccountId (not paymentMethodId).
+  async removePaymentMethod(paymentAccountId) {
+    await this.apiClient.dispatch("settlement-removePaymentMethod", { paymentAccountId });
+  }
+  // Set default payment method.
+  // Backend field name is paymentAccountId (not paymentMethodId).
+  async setDefaultPaymentMethod(paymentAccountId) {
+    await this.apiClient.dispatch("settlement-setDefaultPaymentMethod", { paymentAccountId });
+  }
+  // PLM-specific usage events
+  // Record product creation
+  async recordProductCreation(productId) {
+    return this.recordUsage({
+      eventType: "productCreated",
+      resourceId: productId
+    });
+  }
+  // Record document upload
+  async recordDocumentUpload(documentId, fileSizeMb) {
+    return this.recordUsage({
+      eventType: "documentUpload",
+      resourceId: documentId,
+      metadata: { fileSizeMb }
+    });
+  }
+  // Record ECO submission
+  async recordEcoSubmission(ecoId) {
+    return this.recordUsage({
+      eventType: "ecoSubmitted",
+      resourceId: ecoId
+    });
+  }
+  // Record marketplace bid
+  async recordMarketplaceBid(bidId, requestId) {
+    return this.recordUsage({
+      eventType: "marketplaceBidSubmitted",
+      resourceId: bidId,
+      metadata: { requestId }
+    });
+  }
+  // Record participant addition
+  async recordParticipantAdded(productId, participantTenantId) {
+    return this.recordUsage({
+      eventType: "participantAdded",
+      resourceId: productId,
+      metadata: { participantTenantId }
+    });
+  }
+};
+
+// src/services/partners.ts
+var MAKEMINDPartners = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+  }
+  // --- Partner self-service ---
+  /** Register the signed-in individual as a partner (requires a verified email). */
+  async registerSelf(displayName) {
+    return this.apiClient.dispatch("settlement-partnersRegisterSelf", displayName ? { displayName } : {});
+  }
+  /** Browse the open partner-program directory. */
+  async listPrograms() {
+    return this.apiClient.dispatch("settlement-partnersListPrograms", {});
+  }
+  /** Apply to a tenant's program (creates a pending registration). */
+  async apply(tenantId) {
+    return this.apiClient.dispatch("settlement-partnersApply", { tenantId });
+  }
+  // --- M2M: referral capture + derivation (product-site backend) ---
+  /** Auto-attribute a subject to a partner via a referral code (at checkout/entry). */
+  async registerReferral(input) {
+    return this.apiClient.dispatch("settlement-partnersRegisterReferral", input);
+  }
+  /** Derive commission for a settled sale for any partner that referred the subject. */
+  async deriveCommission(input) {
+    return this.apiClient.dispatch("settlement-partnersDeriveCommission", input);
+  }
+  /**
+   * Canonical settlement intake: report a revenue event; the engine derives the
+   * full line set (tax + commission + net waterfall) and records partner
+   * commissions when a saleId is given.
+   */
+  async deriveSettlementForEvent(input) {
+    return this.apiClient.dispatch("settlement-deriveSettlementForEvent", input);
+  }
+  // --- Tenant admin (also usable by platform admin with an explicit tenantId) ---
+  /** Publish/update the tenant's partner program (directory listing). */
+  async publishProgram(input) {
+    return this.apiClient.dispatch("settlement-partnersPublishProgram", input);
+  }
+  /** Approve a pending/invited registration (optionally overriding the rate). */
+  async approve(input) {
+    return this.apiClient.dispatch("settlement-partnersApprove", input);
+  }
+  /** Add an already-registered partner directly by id (arranged relationship). */
+  async addById(input) {
+    return this.apiClient.dispatch("settlement-partnersAddById", input);
+  }
+  /** Invite a partner by email (fallback for someone not yet self-registered). */
+  async invite(input) {
+    return this.apiClient.dispatch("settlement-partnersInvite", input);
+  }
+  /** List the partners registered in the current tenant. */
+  async list(tenantId) {
+    return this.apiClient.dispatch("settlement-partnersList", tenantId ? { tenantId } : {});
+  }
+  /** Update a registration's rate and/or status. */
+  async update(input) {
+    return this.apiClient.dispatch("settlement-partnersUpdateRegistration", input);
+  }
+  /** Record a commission accrual for the current tenant (idempotent on idempotencyKey). */
+  async recordCommission(input) {
+    return this.apiClient.dispatch("settlement-partnersRecordCommission", input);
+  }
+  /** Claw back a commission entry. */
+  async reverseCommission(entryId) {
+    return this.apiClient.dispatch("settlement-partnersReverseCommission", { entryId });
+  }
+  /** Record a manual payout against a partner's owed commission. */
+  async recordPayout(input) {
+    return this.apiClient.dispatch("settlement-partnersRecordPayout", input);
+  }
+  // --- Partner self-view ---
+  /** Accept an invitation, claiming the partner identity (requires a verified email). */
+  async acceptInvitation(partnerId, tenantId) {
+    return this.apiClient.dispatch("settlement-partnersAcceptInvitation", { partnerId, tenantId });
+  }
+  /** The signed-in partner's own cross-tenant commission statement (union). */
+  async myCommissions() {
+    return this.apiClient.dispatch("settlement-partnersMyCommissions", {});
+  }
+  // --- Platform admin (Guild) ---
+  /** Any partner's statement (platform admin only). */
+  async commissionsOf(partnerId) {
+    return this.apiClient.dispatch("settlement-partnersGetStatement", { partnerId });
+  }
+};
+
+// src/services/storage.ts
+var MAKEMINDStorage = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  /**
+   * Encode a storage object path for use as a path parameter, preserving the
+   * `/` separators (the gateway captures the full sub-path via a wildcard).
+   */
+  encodePath(path) {
+    return path.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+  }
+  /**
+   * Upload a file
+   */
+  async upload(options) {
+    const { uploadUrl } = await this.apiClient.post(
+      "/storage/upload",
+      {
+        path: options.path,
+        contentType: options.file.type || "application/octet-stream",
+        metadata: options.metadata
+      }
+    );
+    await this.uploadToSignedUrl(uploadUrl, options.file, options.onProgress);
+    return {
+      path: options.path,
+      url: await this.getDownloadUrl(options.path),
+      size: options.file.size,
+      contentType: options.file.type || "application/octet-stream",
+      metadata: options.metadata
+    };
+  }
+  async uploadToSignedUrl(url, file, onProgress) {
+    return new Promise((resolve, reject) => {
+      const xhr = new XMLHttpRequest();
+      if (onProgress) {
+        xhr.upload.addEventListener("progress", (event) => {
+          if (event.lengthComputable) {
+            const progress = event.loaded / event.total * 100;
+            onProgress(progress);
+          }
+        });
+      }
+      xhr.addEventListener("load", () => {
+        if (xhr.status >= 200 && xhr.status < 300) {
+          resolve();
+        } else {
+          reject(new MAKEMINDError("STORAGE_ERROR", `Upload failed with status ${xhr.status}`));
+        }
+      });
+      xhr.addEventListener("error", () => {
+        reject(new MAKEMINDError("STORAGE_ERROR", "Upload failed"));
+      });
+      xhr.open("PUT", url);
+      xhr.setRequestHeader("Content-Type", file.type || "application/octet-stream");
+      xhr.send(file);
+    });
+  }
+  /**
+   * Get download URL for a file
+   */
+  async getDownloadUrl(path) {
+    const response = await this.apiClient.get(
+      `/storage/download/${this.encodePath(path)}`
+    );
+    return response.downloadUrl;
+  }
+  /**
+   * Download a file directly
+   * Returns the file as a Blob
+   */
+  async download(path) {
+    const url = await this.getDownloadUrl(path);
+    const response = await fetch(url, {
+      method: "GET"
+    });
+    if (!response.ok) {
+      throw new MAKEMINDError("STORAGE_ERROR", `Download failed with status ${response.status}`);
+    }
+    return response.blob();
+  }
+  /**
+   * Download a file and trigger browser download
+   */
+  async downloadToFile(path, filename) {
+    const blob = await this.download(path);
+    const downloadFilename = filename || path.split("/").pop() || "download";
+    const link = document.createElement("a");
+    link.href = URL.createObjectURL(blob);
+    link.download = downloadFilename;
+    document.body.appendChild(link);
+    link.click();
+    document.body.removeChild(link);
+    URL.revokeObjectURL(link.href);
+  }
+  /**
+   * Get file metadata
+   */
+  async getMetadata(path) {
+    const response = await this.apiClient.get(`/storage/${this.encodePath(path)}/metadata`);
+    return {
+      name: response.path.split("/").pop() || response.path,
+      path: response.path,
+      size: response.size,
+      contentType: response.contentType,
+      createdAt: new Date(response.created),
+      updatedAt: new Date(response.updated),
+      metadata: response.metadata
+    };
+  }
+  /**
+   * Update file metadata
+   */
+  async updateMetadata(path, metadata) {
+    await this.apiClient.patch(`/storage/${this.encodePath(path)}/metadata`, {
+      metadata
+    });
+  }
+  /**
+   * List files in a directory
+   */
+  async listFiles(options) {
+    const params = new URLSearchParams();
+    if (options?.prefix) params.append("prefix", options.prefix);
+    if (options?.maxResults) params.append("limit", String(options.maxResults));
+    if (options?.pageToken) params.append("cursor", options.pageToken);
+    const items = await this.apiClient.get(`/storage/list?${params.toString()}`);
+    return {
+      files: items.map((file) => ({
+        name: file.path.split("/").pop() || file.path,
+        path: file.path,
+        size: file.size,
+        contentType: file.contentType,
+        createdAt: new Date(file.updated),
+        updatedAt: new Date(file.updated)
+      }))
+    };
+  }
+  /**
+   * Delete a file
+   */
+  async delete(path) {
+    await this.apiClient.delete(`/storage/${this.encodePath(path)}`);
+  }
+  /**
+   * Delete multiple files
+   */
+  // TODO(gateway): no matching route — no batch delete route nor dispatch operation;
+  // falls back to issuing individual DELETE /storage/:path requests.
+  async deleteMany(paths) {
+    await Promise.all(paths.map((path) => this.delete(path)));
+  }
+  /**
+   * Copy a file
+   */
+  async copy(sourcePath, destinationPath) {
+    return this.apiClient.post("/storage/copy", {
+      source: sourcePath,
+      destination: destinationPath
+    });
+  }
+  /**
+   * Move a file
+   */
+  async move(sourcePath, destinationPath) {
+    return this.apiClient.post("/storage/move", {
+      source: sourcePath,
+      destination: destinationPath
+    });
+  }
+  // PLM-specific helpers
+  /**
+   * Upload a document for a product
+   */
+  async uploadProductDocument(productId, file, options) {
+    const path = `products/${productId}/documents/${file.name}`;
+    return this.upload({
+      path,
+      file,
+      metadata: {
+        productId,
+        documentType: options?.documentType || "general",
+        version: options?.version || "1.0"
+      },
+      onProgress: options?.onProgress
+    });
+  }
+  /**
+   * Upload an ECO attachment
+   */
+  async uploadEcoAttachment(ecoId, file, onProgress) {
+    const path = `eco/${ecoId}/attachments/${file.name}`;
+    return this.upload({
+      path,
+      file,
+      metadata: {
+        ecoId
+      },
+      onProgress
+    });
+  }
+  /**
+   * Upload a quality issue attachment
+   */
+  async uploadQualityAttachment(issueId, file, onProgress) {
+    const path = `quality/${issueId}/attachments/${file.name}`;
+    return this.upload({
+      path,
+      file,
+      metadata: {
+        issueId
+      },
+      onProgress
+    });
+  }
+  /**
+   * Get all documents for a product
+   */
+  async getProductDocuments(productId) {
+    const result = await this.listFiles({
+      prefix: `products/${productId}/documents/`
+    });
+    return result.files;
+  }
+  // Bucket Management (05-data-platform-saas.md)
+  /**
+   * List all buckets for the tenant
+   */
+  async listBuckets() {
+    const response = await this.apiClient.get("/storage/buckets");
+    return response.buckets;
+  }
+  /**
+   * Create a new bucket.
+   *
+   * The REST route expects { name, settings } where settings carries the
+   * bucket policy fields. publicAccess, corsConfig, and lifecycleRules from
+   * CreateBucketOptions are folded into the settings envelope so the backend
+   * handler can read them from req.body.settings.
+   */
+  async createBucket(options) {
+    return this.apiClient.post("/storage/buckets", {
+      name: options.name,
+      settings: {
+        publicAccess: options.publicAccess ?? false,
+        corsConfig: options.corsConfig,
+        lifecycleRules: options.lifecycleRules
+      }
+    });
+  }
+  /**
+   * Get bucket info
+   */
+  async getBucket(bucketId) {
+    return this.apiClient.get(`/storage/buckets/${bucketId}`);
+  }
+  /**
+   * Update bucket settings.
+   *
+   * The REST route reads { settings } from req.body. Flatten the
+   * CreateBucketOptions partial into a settings envelope so the backend
+   * merges the diff correctly.
+   */
+  async updateBucket(bucketId, updates) {
+    const { name: _name, ...rest } = updates;
+    return this.apiClient.patch(`/storage/buckets/${bucketId}`, {
+      settings: rest
+    });
+  }
+  /**
+   * Delete a bucket (must be empty)
+   */
+  async deleteBucket(bucketId) {
+    await this.apiClient.delete(`/storage/buckets/${bucketId}`);
+  }
+  /**
+   * Get a pre-signed URL for direct upload (bypassing SDK)
+   */
+  async getUploadUrl(path, options) {
+    const segments = path.split("/").filter((segment) => segment.length > 0);
+    const fileName = segments.pop() ?? path;
+    const folder = segments.join("/");
+    const response = await this.apiClient.dispatch("dataGetUploadUrl", {
+      fileName,
+      contentType: options?.contentType || "application/octet-stream",
+      ...folder ? { folder } : {}
+    });
+    return { uploadUrl: response.uploadUrl, fileId: response.fileId };
+  }
+  /**
+   * Check if a file exists
+   */
+  async exists(path) {
+    try {
+      await this.getMetadata(path);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get storage usage statistics
+   */
+  async getUsageStats() {
+    return this.apiClient.get("/storage/stats");
+  }
+};
+
+// src/services/ai.ts
+var MAKEMINDAI = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  // Chat completion
+  async chat(messages, options) {
+    const requestMessages = options?.systemPrompt ? [{ role: "system", content: options.systemPrompt }, ...messages] : messages;
+    const response = await this.apiClient.dispatch("ai-aiChat", {
+      tenantId: this.getTenantId(),
+      messages: requestMessages,
+      model: options?.model,
+      temperature: options?.temperature,
+      maxTokens: options?.maxTokens
+    });
+    return {
+      message: { role: "assistant", content: response.content },
+      usage: {
+        promptTokens: response.usage.inputTokens,
+        completionTokens: response.usage.outputTokens,
+        totalTokens: response.usage.totalTokens
+      }
+    };
+  }
+  /**
+   * Stream chat completion via the aiStreamChat onCall backend.
+   *
+   * The backend writes chunks progressively to Firestore
+   * (aiStreamChunks/{streamId}/chunks). This method polls the stream
+   * document until the status reaches 'completed' or 'failed', invoking
+   * onChunk for each content chunk in order. Callers that need real-time
+   * granularity should subscribe to the Firestore collection directly using
+   * the returned streamId from aiStreamChat.
+   *
+   * @param messages - Chat messages
+   * @param onChunk - Callback for each streamed content chunk
+   * @param options - Chat options and optional onDone callback
+   * @returns Promise that resolves when streaming is complete
+   */
+  async chatStream(messages, onChunk, options) {
+    const requestMessages = options?.systemPrompt ? [{ role: "system", content: options.systemPrompt }, ...messages] : messages;
+    const startResult = await this.apiClient.dispatch("ai-aiStreamChat", {
+      tenantId: this.getTenantId(),
+      messages: requestMessages,
+      model: options?.model,
+      temperature: options?.temperature,
+      maxTokens: options?.maxTokens
+    });
+    const { streamId } = startResult;
+    const pollInterval = 500;
+    const maxWaitMs = 12e4;
+    const startAt = Date.now();
+    let lastContent = "";
+    while (Date.now() - startAt < maxWaitMs) {
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      const poll = await this.apiClient.dispatch("ai-aiGetStreamResult", { streamId });
+      if (poll.status === "failed") {
+        throw new Error(poll.error ?? "Stream failed");
+      }
+      if (poll.status === "completed") {
+        const fullContent = poll.content ?? "";
+        const delta2 = fullContent.slice(lastContent.length);
+        if (delta2) {
+          onChunk(delta2);
+        }
+        const rawUsage = poll.usage;
+        const finalResponse = {
+          message: { role: "assistant", content: fullContent },
+          usage: {
+            promptTokens: rawUsage?.inputTokens ?? 0,
+            completionTokens: rawUsage?.outputTokens ?? 0,
+            totalTokens: rawUsage?.totalTokens ?? 0
+          }
+        };
+        if (options?.onDone) {
+          options.onDone(finalResponse);
+        }
+        return finalResponse;
+      }
+      const currentContent = poll.content ?? "";
+      const delta = currentContent.slice(lastContent.length);
+      if (delta) {
+        onChunk(delta);
+        lastContent = currentContent;
+      }
+    }
+    throw new Error("Stream timed out");
+  }
+  /**
+   * Stream chat using async generator for easier consumption.
+   * Yields content deltas via polling on aiGetStreamResult.
+   */
+  async *streamChat(messages, options) {
+    const requestMessages = options?.systemPrompt ? [{ role: "system", content: options.systemPrompt }, ...messages] : messages;
+    const startResult = await this.apiClient.dispatch("ai-aiStreamChat", {
+      tenantId: this.getTenantId(),
+      messages: requestMessages,
+      model: options?.model,
+      temperature: options?.temperature,
+      maxTokens: options?.maxTokens
+    });
+    const { streamId } = startResult;
+    const pollInterval = 500;
+    const maxWaitMs = 12e4;
+    const startAt = Date.now();
+    let lastContent = "";
+    while (Date.now() - startAt < maxWaitMs) {
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      const poll = await this.apiClient.dispatch("ai-aiGetStreamResult", { streamId });
+      if (poll.status === "failed") {
+        throw new Error(poll.error ?? "Stream failed");
+      }
+      const currentContent = poll.content ?? "";
+      const delta = currentContent.slice(lastContent.length);
+      if (delta) {
+        yield delta;
+        lastContent = currentContent;
+      }
+      if (poll.status === "completed") {
+        const rawUsage = poll.usage;
+        return {
+          message: { role: "assistant", content: currentContent },
+          usage: {
+            promptTokens: rawUsage?.inputTokens ?? 0,
+            completionTokens: rawUsage?.outputTokens ?? 0,
+            totalTokens: rawUsage?.totalTokens ?? 0
+          }
+        };
+      }
+    }
+    throw new Error("Stream timed out");
+  }
+  // Embeddings
+  async createEmbedding(text, options) {
+    const texts = Array.isArray(text) ? text : [text];
+    const response = await this.apiClient.dispatch("ai-aiEmbeddings", {
+      tenantId: this.getTenantId(),
+      input: texts,
+      model: options?.model
+    });
+    return { embeddings: response.embeddings, usage: response.usage };
+  }
+  /**
+   * Vector search over a tenant knowledge collection.
+   * Routes to the knowledge domain dispatch (knowledge-knowledgeSearch),
+   * which performs semantic search with embeddings over indexed documents.
+   */
+  async vectorSearch(collection, query, options) {
+    const response = await this.apiClient.dispatch("knowledge-knowledgeSearch", {
+      tenantId: this.getTenantId(),
+      collectionId: collection,
+      query,
+      limit: options?.limit,
+      filter: options?.filter
+    });
+    return response.results;
+  }
+  /**
+   * Vision analysis for a publicly accessible image URL.
+   * Routes to ai-aiVision (aiVision onCall). The image is passed as a
+   * ChatCompletionRequest message using the imageUrl ContentPart type.
+   */
+  async analyzeImage(imageUrl, prompt, options) {
+    const response = await this.apiClient.dispatch("ai-aiVision", {
+      tenantId: this.getTenantId(),
+      model: options?.model,
+      maxTokens: options?.maxTokens,
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "imageUrl", imageUrl: { url: imageUrl, detail: "auto" } },
+            { type: "text", text: prompt }
+          ]
+        }
+      ]
+    });
+    return {
+      content: response.content,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+  /**
+   * Vision analysis for a base64-encoded image.
+   * The image is embedded as a data URI in the imageUrl ContentPart.
+   */
+  async analyzeImageBase64(base64Image, mimeType, prompt, options) {
+    const dataUri = `data:${mimeType};base64,${base64Image}`;
+    const response = await this.apiClient.dispatch("ai-aiVision", {
+      tenantId: this.getTenantId(),
+      model: options?.model,
+      maxTokens: options?.maxTokens,
+      messages: [
+        {
+          role: "user",
+          content: [
+            { type: "imageUrl", imageUrl: { url: dataUri, detail: "auto" } },
+            { type: "text", text: prompt }
+          ]
+        }
+      ]
+    });
+    return {
+      content: response.content,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+  /**
+   * Chat completion with tool definitions (function calling).
+   * Routes to ai-aiChat — the aiChat onCall natively supports the tools field
+   * in ChatCompletionRequest, no separate endpoint required.
+   */
+  async chatWithTools(messages, tools, options) {
+    const requestMessages = options?.systemPrompt ? [{ role: "system", content: options.systemPrompt }, ...messages] : messages;
+    const aiTools = tools.map((t) => ({
+      type: "function",
+      function: {
+        name: t.name,
+        description: t.description,
+        parameters: t.parameters
+      }
+    }));
+    const response = await this.apiClient.dispatch("ai-aiChat", {
+      tenantId: this.getTenantId(),
+      messages: requestMessages,
+      tools: aiTools,
+      model: options?.model,
+      temperature: options?.temperature,
+      maxTokens: options?.maxTokens
+    });
+    const toolCalls = response.toolCalls?.map((tc) => ({
+      name: tc.function.name,
+      arguments: (() => {
+        try {
+          return JSON.parse(tc.function.arguments);
+        } catch {
+          return {};
+        }
+      })()
+    }));
+    return {
+      message: { role: "assistant", content: response.content },
+      toolCalls,
+      usage: {
+        promptTokens: response.usage.inputTokens,
+        completionTokens: response.usage.outputTokens,
+        totalTokens: response.usage.totalTokens
+      }
+    };
+  }
+  /**
+   * Document analysis (summary, field extraction, or QA).
+   * No dedicated onCall exists in the ai domain; implemented via ai-aiChat
+   * with a structured system prompt that targets the requested analysis type.
+   * The document content must be fetched by the caller and passed as text —
+   * the backend has no URL-fetch / OCR pipeline for onCall yet.
+   */
+  async analyzeDocument(documentUrl, analysisType, options) {
+    const systemPromptMap = {
+      summary: "You are a document summarization assistant. Summarize the provided document concisely.",
+      extract: `You are a document extraction assistant. Extract the following fields from the document as JSON: ${(options?.extractFields ?? []).join(", ")}.`,
+      qa: `You are a document QA assistant. Answer the following question based on the document: ${options?.question ?? ""}`
+    };
+    const response = await this.apiClient.dispatch("ai-aiChat", {
+      tenantId: this.getTenantId(),
+      messages: [
+        { role: "system", content: systemPromptMap[analysisType] },
+        { role: "user", content: `Document URL: ${documentUrl}` }
+      ]
+    });
+    let result = response.content;
+    if (analysisType === "extract") {
+      try {
+        result = JSON.parse(response.content);
+      } catch {
+        result = response.content;
+      }
+    }
+    return {
+      result,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+  // Text generation
+  async generate(prompt, options) {
+    const response = await this.chat(
+      [{ role: "user", content: prompt }],
+      options
+    );
+    return {
+      text: response.message.content,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+  /**
+   * Text summarization via ai-aiChat.
+   * No dedicated onCall exists; implemented as a structured chat request
+   * with a summarization system prompt.
+   */
+  async summarize(text, options) {
+    const styleInstruction = options?.style === "bullet" ? "Use bullet points." : "Write in paragraph form.";
+    const lengthInstruction = options?.maxLength ? ` Keep the summary under ${options.maxLength} words.` : "";
+    const response = await this.apiClient.dispatch("ai-aiChat", {
+      tenantId: this.getTenantId(),
+      messages: [
+        {
+          role: "system",
+          content: `You are a summarization assistant. Summarize the text concisely. ${styleInstruction}${lengthInstruction}`
+        },
+        { role: "user", content: text }
+      ]
+    });
+    return {
+      summary: response.content,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+  /**
+   * Text translation via ai-aiChat.
+   * No dedicated onCall exists; implemented as a structured chat request
+   * with a translation system prompt.
+   */
+  async translate(text, targetLanguage, sourceLanguage) {
+    const sourceInstruction = sourceLanguage ? ` The source language is ${sourceLanguage}.` : " Detect the source language automatically.";
+    const response = await this.apiClient.dispatch("ai-aiChat", {
+      tenantId: this.getTenantId(),
+      messages: [
+        {
+          role: "system",
+          content: `You are a translation assistant.${sourceInstruction} Translate the user's text to ${targetLanguage}. Return only the translation, nothing else.`
+        },
+        { role: "user", content: text }
+      ]
+    });
+    return {
+      translation: response.content,
+      usage: { totalTokens: response.usage.totalTokens }
+    };
+  }
+};
+
+// src/services/search.ts
+var MAKEMINDSearch = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  async query(options) {
+    const params = new URLSearchParams();
+    params.set("q", options.q);
+    if (options.collections) params.set("collections", options.collections.join(","));
+    if (options.page) params.set("page", String(options.page));
+    if (options.perPage) params.set("perPage", String(options.perPage));
+    return this.apiClient.get(`/search?${params.toString()}`);
+  }
+  async advanced(options) {
+    return this.apiClient.post("/search/advanced", options);
+  }
+  async suggestions(options) {
+    const params = new URLSearchParams();
+    params.set("prefix", options.prefix);
+    params.set("collection", options.collection);
+    if (options.limit) params.set("limit", String(options.limit));
+    return this.apiClient.get(`/search/suggestions?${params.toString()}`);
+  }
+  async getAnalytics(options) {
+    const params = new URLSearchParams();
+    if (options?.startDate) params.set("startDate", options.startDate);
+    if (options?.endDate) params.set("endDate", options.endDate);
+    const queryString = params.toString();
+    return this.apiClient.get(`/search/analytics${queryString ? `?${queryString}` : ""}`);
+  }
+  async bulkReindex(options) {
+    return this.apiClient.post("/search/reindex", options || {});
+  }
+  async getBulkReindexStatus(options) {
+    return this.apiClient.get(`/search/reindex/${options.jobId}`);
+  }
+};
+
+// src/services/apps.ts
+var MAKEMINDApps = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  get tenantId() {
+    const id = this.getTenantId();
+    if (!id) {
+      throw new MAKEMINDError("UNAUTHENTICATED", "No tenant context set");
+    }
+    return id;
+  }
+  // ============================================
+  // App Management
+  // ============================================
+  async createApp(params) {
+    const response = await this.apiClient.post("/apps", { ...params });
+    return response;
+  }
+  async getApp(appId) {
+    try {
+      const response = await this.apiClient.get(`/apps/${appId}`);
+      return response.app;
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  async listApps(params = {}) {
+    const query = new URLSearchParams();
+    if (params.status) query.append("status", params.status);
+    if (params.limit) query.append("limit", String(params.limit));
+    if (params.startAfter) query.append("startAfter", params.startAfter);
+    const qs = query.toString();
+    const response = await this.apiClient.get(`/apps${qs ? `?${qs}` : ""}`);
+    return response;
+  }
+  async updateApp(appId, params) {
+    await this.apiClient.put(`/apps/${appId}`, params);
+  }
+  async deleteApp(appId, hardDelete = false) {
+    await this.apiClient.delete(`/apps/${appId}${hardDelete ? "?hardDelete=true" : ""}`);
+  }
+  async duplicateApp(appId, newName) {
+    const response = await this.apiClient.post(
+      `/apps/${appId}/duplicate`,
+      { name: newName }
+    );
+    return { appId: response.appId };
+  }
+  // Stream app changes (polling-based)
+  onAppSnapshot(appId, callback) {
+    let isSubscribed = true;
+    const poll = async () => {
+      if (!isSubscribed) return;
+      try {
+        const app = await this.getApp(appId);
+        callback(app);
+      } catch {
+      }
+      if (isSubscribed) {
+        setTimeout(poll, 5e3);
+      }
+    };
+    poll();
+    return () => {
+      isSubscribed = false;
+    };
+  }
+  // ============================================
+  // Page Management
+  // ============================================
+  async createPage(appId, params) {
+    const response = await this.apiClient.post(
+      `/apps/${appId}/pages`,
+      params
+    );
+    return response;
+  }
+  async getPage(appId, pageId) {
+    try {
+      const response = await this.apiClient.get(
+        `/apps/${appId}/pages/${pageId}`
+      );
+      return response.page;
+    } catch (error) {
+      if (error instanceof MAKEMINDError && error.code === "NOT_FOUND") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  async listPages(appId) {
+    const response = await this.apiClient.get(`/apps/${appId}/pages`);
+    return response.pages;
+  }
+  async updatePage(appId, pageId, params) {
+    await this.apiClient.put(`/apps/${appId}/pages/${pageId}`, params);
+  }
+  async deletePage(appId, pageId) {
+    await this.apiClient.delete(`/apps/${appId}/pages/${pageId}`);
+  }
+  async reorderPages(appId, order) {
+    await this.apiClient.put(`/apps/${appId}/pages/reorder`, { order });
+  }
+  async duplicatePage(appId, pageId, newName, newPath) {
+    const response = await this.apiClient.post(
+      `/apps/${appId}/pages/${pageId}/duplicate`,
+      { newName, newPath }
+    );
+    return response;
+  }
+  // ============================================
+  // Publishing & Versioning
+  // ============================================
+  async publish(appId, changelog) {
+    const response = await this.apiClient.post(`/apps/${appId}/publish`, { changelog });
+    return response;
+  }
+  async unpublish(appId) {
+    await this.apiClient.post(`/apps/${appId}/unpublish`, {});
+  }
+  async rollback(appId, targetVersion) {
+    const response = await this.apiClient.post(`/apps/${appId}/rollback`, { targetVersion });
+    return response;
+  }
+  async getVersions(appId, limit = 20) {
+    const response = await this.apiClient.get(
+      `/apps/${appId}/versions?limit=${limit}`
+    );
+    return response.versions;
+  }
+  async getVersionDetail(appId, versionId) {
+    const response = await this.apiClient.get(`/apps/${appId}/versions/${versionId}`);
+    return response.version;
+  }
+  async compareVersions(appId, version1, version2) {
+    const response = await this.apiClient.get(`/apps/${appId}/versions/compare?version1=${version1}&version2=${version2}`);
+    return response.comparison;
+  }
+  // ============================================
+  // Domain Management
+  // ============================================
+  /**
+   * Add a platform subdomain (`<subdomain>.<platform-host>`) for an app.
+   * `target` is an optional generic reverse-proxy routing target.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async addSubdomain(appId, subdomain, target) {
+    const response = await this.apiClient.post(`/apps/${appId}/domains/subdomain`, { subdomain, target });
+    return response;
+  }
+  /**
+   * Add a custom (BYO) domain for an app. Returns a verification token and
+   * DNS records the caller must publish before `verifyDomain` will pass.
+   * `target` is an optional generic reverse-proxy routing target.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async addCustomDomain(appId, domain, target) {
+    const response = await this.apiClient.post(`/apps/${appId}/domains/custom`, { domain, target });
+    return response;
+  }
+  async verifyDomain(appId, domain) {
+    const response = await this.apiClient.post(`/apps/${appId}/domains/${encodeURIComponent(domain)}/verify`, {});
+    return response;
+  }
+  async removeDomain(appId, domain) {
+    await this.apiClient.delete(`/apps/${appId}/domains/${encodeURIComponent(domain)}`);
+  }
+  async getDomainStatus(appId) {
+    const response = await this.apiClient.get(
+      `/apps/${appId}/domains`
+    );
+    return response.domains;
+  }
+  // ============================================
+  // Web Entries — an address that opens an MCP origin as a web app
+  //
+  // An entry gives an app a public address: visiting it serves the renderer
+  // and a per-host document that declares which origin to open. Dispatch ops
+  // under the `apps-` prefix, `domains:read` / `domains:write` — an entry IS a
+  // registry hostname, so splitting authority over one resource across a
+  // second scope name would only make it ambiguous.
+  // ============================================
+  /**
+   * Mint an address for an app.
+   *
+   * The caller proposes a **label**, not a hostname: the platform derives and
+   * reserves the host under its own uniqueness and reserved-name rules. A
+   * caller cannot claim a hostname it does not own, and the origin is derived
+   * from the app being bound rather than supplied — the whole capability rests
+   * on the issuer deciding the origin, and a free-text URL field is exactly how
+   * that property gets lost.
+   *
+   * `display` feeds both the share metadata (`og:*`) and the boot declaration,
+   * so a link preview and the running app cannot disagree.
+   */
+  async mintWebEntry(params) {
+    return this.apiClient.dispatch("apps-mintWebEntry", params);
+  }
+  /** Read one entry the caller owns. Requires `domains:read`. */
+  async getWebEntry(host) {
+    return this.apiClient.dispatch("apps-getWebEntry", { host });
+  }
+  /** List the caller's entries, optionally narrowed to one party. Requires `domains:read`. */
+  async listWebEntries(params = {}) {
+    return this.apiClient.dispatch("apps-listWebEntries", params);
+  }
+  /**
+   * Repoint an entry at a different (still proven) origin, or change how it
+   * appears when shared. The address itself is immutable — a different address
+   * is a different entry.
+   */
+  async updateWebEntry(params) {
+    return this.apiClient.dispatch("apps-updateWebEntry", params);
+  }
+  /** Retire an entry — the address stops serving immediately. Requires `domains:write`. */
+  async retireWebEntry(host) {
+    return this.apiClient.dispatch("apps-retireWebEntry", { host });
+  }
+  // ============================================
+  // Delegated (Sub-Tenant) Domains
+  //
+  // "Custom domains for your customers" — a tenant registers/verifies/lists/
+  // removes domains on behalf of its own sub-tenants (nested delegation).
+  // These are dispatch ops (no REST path); routed through the gateway RPC
+  // dispatch route under the `apps-` prefix. All four require an API key
+  // with the noted scope.
+  // ============================================
+  /**
+   * Register a custom domain on behalf of one of the caller tenant's
+   * sub-tenants ("custom domains for your customers"). `parentTenantId`,
+   * when provided, must equal the caller's own tenantId — the server never
+   * trusts a client-supplied parent tenant for cross-tenant registration.
+   * Requires API key scope `domains:write`.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async registerDomainForSubTenant(params) {
+    return this.apiClient.dispatch("apps-registerDomainForSubTenant", params);
+  }
+  /**
+   * Verify a delegated sub-tenant domain's DNS configuration.
+   * Requires API key scope `domains:write`.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async verifyDomainForSubTenant(domain) {
+    return this.apiClient.dispatch("apps-verifyDomainForSubTenant", { domain });
+  }
+  /**
+   * List the caller tenant's delegated sub-tenant domains, optionally
+   * filtered to one `subTenantId`. Requires API key scope `domains:read`.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async listSubTenantDomains(subTenantId) {
+    return this.apiClient.dispatch(
+      "apps-listSubTenantDomains",
+      { subTenantId }
+    );
+  }
+  /**
+   * Remove a delegated sub-tenant domain. Requires API key scope
+   * `domains:write`.
+   *
+   * Requires domain-service activation. The control-plane call is live, but
+   * a registered domain/target does not serve traffic until the
+   * domain-serving edge is provisioned (Phase 2). Custom and nested
+   * (sub-tenant) domains additionally require an active domain entitlement
+   * (paid SKU); pricing is not yet set. Subdomains are free.
+   */
+  async removeSubTenantDomain(domain) {
+    return this.apiClient.dispatch("apps-removeSubTenantDomain", {
+      domain
+    });
+  }
+  // ============================================
+  // Analytics
+  // ============================================
+  async getAnalytics(appId, params) {
+    const query = new URLSearchParams();
+    if (params?.startDate) query.append("startDate", params.startDate);
+    if (params?.endDate) query.append("endDate", params.endDate);
+    const qs = query.toString();
+    const response = await this.apiClient.get(
+      `/apps/${appId}/analytics${qs ? `?${qs}` : ""}`
+    );
+    return response.analytics;
+  }
+  // ============================================
+  // AI Features
+  // ============================================
+  async generateUI(prompt, context, appId) {
+    const response = await this.apiClient.post(
+      "/apps/ai/generate-ui",
+      { prompt, context, appId }
+    );
+    return { components: response.components };
+  }
+  async suggestActions(appId, componentType, context) {
+    const response = await this.apiClient.post(`/apps/${appId}/ai/suggest-actions`, { componentType, context });
+    return { actions: response.suggestions };
+  }
+  // ============================================
+  // Collaboration
+  // ============================================
+  async startSession(appId, pageId) {
+    const response = await this.apiClient.post(`/apps/${appId}/pages/${pageId}/sessions`, {});
+    return { sessionToken: response.sessionToken, wsEndpoint: response.wsEndpoint };
+  }
+  async addComment(appId, pageId, componentId, content, threadId) {
+    const response = await this.apiClient.post(
+      `/apps/${appId}/pages/${pageId}/comments`,
+      { componentId, content, threadId }
+    );
+    return response;
+  }
+  async resolveComment(appId, pageId, commentId) {
+    await this.apiClient.post(
+      `/apps/${appId}/pages/${pageId}/comments/${commentId}/resolve`,
+      {}
+    );
+  }
+};
+
+// src/services/marketplace.ts
+var MAKEMINDMarketplace = class {
+  constructor(config) {
+    this.apiClient = config.apiClient;
+    this.getTenantId = config.tenantId;
+  }
+  // ============================================
+  // Discovery
+  // ============================================
+  async search(options = {}) {
+    const params = new URLSearchParams();
+    if (options.query) params.set("query", options.query);
+    if (options.category) params.set("category", options.category);
+    if (options.tags) params.set("tags", options.tags.join(","));
+    if (options.pricingModel) params.set("pricingModel", options.pricingModel.join(","));
+    if (options.sortBy) params.set("sortBy", options.sortBy);
+    if (options.page) params.set("page", String(options.page));
+    if (options.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.apiClient.get(`/marketplace/listings${qs ? `?${qs}` : ""}`);
+  }
+  async getDetail(listingId) {
+    return this.apiClient.get(`/marketplace/listings/${listingId}`);
+  }
+  async browseCategory(categorySlug, options) {
+    const params = new URLSearchParams();
+    if (options?.sortBy) params.set("sortBy", options.sortBy);
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.apiClient.get(`/marketplace/categories/${categorySlug}/listings${qs ? `?${qs}` : ""}`);
+  }
+  async getFeatured() {
+    return this.apiClient.get("/marketplace/featured");
+  }
+  async getTrending() {
+    return this.apiClient.get("/marketplace/trending");
+  }
+  async getRecommendations() {
+    return this.apiClient.get("/marketplace/recommendations");
+  }
+  async listCategories() {
+    return this.apiClient.get("/marketplace/categories");
+  }
+  // ============================================
+  // Installation
+  // ============================================
+  async install(listingId) {
+    return this.apiClient.post("/marketplace/install", { listingId });
+  }
+  async uninstall(listingId, cleanupData = false) {
+    return this.apiClient.post("/marketplace/uninstall", { listingId, cleanupData });
+  }
+  async listInstalled(options) {
+    const params = new URLSearchParams();
+    if (options?.status) params.set("status", options.status);
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.apiClient.get(`/marketplace/installed${qs ? `?${qs}` : ""}`);
+  }
+  async updateApp(listingId) {
+    return this.apiClient.post(`/marketplace/installed/${listingId}/update`);
+  }
+  // ============================================
+  // App Runtime (proxy, config, credentials)
+  // ============================================
+  async proxy(bindingId, options) {
+    const queryStr = options.query ? `?${new URLSearchParams(options.query).toString()}` : "";
+    const path = `/marketplace/apps/${bindingId}/proxy/${options.path.replace(/^\//, "")}${queryStr}`;
+    return this.apiClient.request(path, { method: options.method, body: options.body });
+  }
+  async getApiSpec(bindingId) {
+    return this.apiClient.get(`/marketplace/apps/${bindingId}/spec`);
+  }
+  async getConfig(bindingId) {
+    return this.apiClient.get(`/marketplace/apps/${bindingId}/config`);
+  }
+  async updateConfig(bindingId, updates) {
+    return this.apiClient.put(`/marketplace/apps/${bindingId}/config`, updates);
+  }
+  async issueCredentials(bindingId) {
+    return this.apiClient.post(`/marketplace/apps/${bindingId}/credentials`);
+  }
+  async revokeCredentials(bindingId) {
+    return this.apiClient.delete(`/marketplace/apps/${bindingId}/credentials`);
+  }
+  // ============================================
+  // Reviews
+  // ============================================
+  async createReview(input) {
+    return this.apiClient.post("/marketplace/reviews", input);
+  }
+  async updateReview(reviewId, listingId, updates) {
+    return this.apiClient.put(`/marketplace/reviews/${reviewId}`, { listingId, ...updates });
+  }
+  async deleteReview(reviewId, listingId) {
+    return this.apiClient.delete(`/marketplace/reviews/${reviewId}`, { body: { listingId } });
+  }
+  async listReviews(listingId, options) {
+    const params = new URLSearchParams();
+    if (options?.sortBy) params.set("sortBy", options.sortBy);
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.apiClient.get(`/marketplace/listings/${listingId}/reviews${qs ? `?${qs}` : ""}`);
+  }
+  async replyToReview(reviewId, listingId, body) {
+    return this.apiClient.post(`/marketplace/reviews/${reviewId}/reply`, { listingId, body });
+  }
+  async reportReview(reviewId, listingId, reason) {
+    return this.apiClient.post(`/marketplace/reviews/${reviewId}/report`, { listingId, reason });
+  }
+  async voteHelpful(reviewId, listingId) {
+    return this.apiClient.post(`/marketplace/reviews/${reviewId}/helpful`, { listingId });
+  }
+  // ============================================
+  // Publishing
+  // ============================================
+  async createPublisherProfile(input) {
+    return this.apiClient.post("/marketplace/publisher", input);
+  }
+  async updatePublisherProfile(updates) {
+    return this.apiClient.put("/marketplace/publisher", updates);
+  }
+  async getDashboard() {
+    return this.apiClient.get("/marketplace/publisher/dashboard");
+  }
+  async createListing(input) {
+    return this.apiClient.post("/marketplace/publisher/listings", input);
+  }
+  async updateListing(listingId, updates) {
+    return this.apiClient.put(`/marketplace/publisher/listings/${listingId}`, updates);
+  }
+  async submitForReview(listingId) {
+    return this.apiClient.post(`/marketplace/publisher/listings/${listingId}/submit`);
+  }
+  async publishListing(listingId) {
+    return this.apiClient.post(`/marketplace/publisher/listings/${listingId}/publish`);
+  }
+  async archiveListing(listingId) {
+    return this.apiClient.post(`/marketplace/publisher/listings/${listingId}/archive`);
+  }
+  async reactivateListing(listingId) {
+    return this.apiClient.post(`/marketplace/publisher/listings/${listingId}/reactivate`);
+  }
+  async createVersion(listingId, version, changelog, appVersionId, breakingChanges = false) {
+    return this.apiClient.post(`/marketplace/publisher/listings/${listingId}/versions`, { version, changelog, appVersionId, breakingChanges });
+  }
+  // ============================================
+  // Admin (Platform Admin only)
+  // ============================================
+  async approveListing(listingId) {
+    return this.apiClient.post(`/marketplace/admin/listings/${listingId}/approve`);
+  }
+  async rejectListing(listingId, reason) {
+    return this.apiClient.post(`/marketplace/admin/listings/${listingId}/reject`, { reason });
+  }
+  async suspendListing(listingId, reason) {
+    return this.apiClient.post(`/marketplace/admin/listings/${listingId}/suspend`, { reason });
+  }
+  async approveVersion(listingId, versionId) {
+    return this.apiClient.post(`/marketplace/admin/listings/${listingId}/versions/${versionId}/approve`);
+  }
+  async verifyPublisher(tenantId) {
+    return this.apiClient.post(`/marketplace/admin/publishers/${tenantId}/verify`);
+  }
+  async suspendPublisher(tenantId, reason) {
+    return this.apiClient.post(`/marketplace/admin/publishers/${tenantId}/suspend`, { reason });
+  }
+  async reactivatePublisher(tenantId) {
+    return this.apiClient.post(`/marketplace/admin/publishers/${tenantId}/reactivate`);
+  }
+  async adminCreateCategory(data) {
+    return this.apiClient.post("/marketplace/admin/categories", data);
+  }
+  async adminUpdateCategory(categoryId, data) {
+    return this.apiClient.put(`/marketplace/admin/categories/${categoryId}`, data);
+  }
+  async adminDeleteCategory(categoryId) {
+    return this.apiClient.delete(`/marketplace/admin/categories/${categoryId}`);
+  }
+  async getAnalytics(params) {
+    const qs = new URLSearchParams();
+    if (params?.startDate) qs.set("startDate", params.startDate);
+    if (params?.endDate) qs.set("endDate", params.endDate);
+    if (params?.granularity) qs.set("granularity", params.granularity);
+    const queryStr = qs.toString();
+    return this.apiClient.get(`/marketplace/admin/analytics${queryStr ? `?${queryStr}` : ""}`);
+  }
+  async getPendingListings(params) {
+    const qs = new URLSearchParams();
+    if (params?.status) qs.set("status", params.status);
+    if (params?.page) qs.set("page", String(params.page));
+    if (params?.limit) qs.set("limit", String(params.limit));
+    const queryStr = qs.toString();
+    return this.apiClient.get(`/marketplace/admin/pending-listings${queryStr ? `?${queryStr}` : ""}`);
+  }
+  async listPublishers(params) {
+    const qs = new URLSearchParams();
+    if (params?.status) qs.set("status", params.status);
+    if (params?.page) qs.set("page", String(params.page));
+    if (params?.limit) qs.set("limit", String(params.limit));
+    const queryStr = qs.toString();
+    return this.apiClient.get(`/marketplace/admin/publishers${queryStr ? `?${queryStr}` : ""}`);
+  }
+};
+
+// src/utils/api-client.ts
+var ApiClient = class {
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "").replace(/\/api\/v\d+$/, "");
+    this.apiVersion = config.apiVersion || "v1";
+    this.apiKey = config.apiKey;
+    this.applicationId = config.applicationId;
+    this.getAuthToken = config.getAuthToken;
+    this.getTenantId = config.getTenantId;
+    this.getAppCheckToken = config.getAppCheckToken;
+  }
+  async request(endpoint, options = {}) {
+    const { method = "GET", body, headers = {}, skipAuth = false } = options;
+    const url = `${this.baseUrl}/api/${this.apiVersion}${endpoint}`;
+    const requestHeaders = {
+      "Content-Type": "application/json",
+      "X-API-Key": this.apiKey,
+      "X-Application-ID": this.applicationId,
+      ...headers
+    };
+    const authToken = this.getAuthToken();
+    if (authToken && !skipAuth) {
+      requestHeaders["Authorization"] = `Bearer ${authToken}`;
+    }
+    const tenantId = this.getTenantId();
+    if (tenantId) {
+      requestHeaders["X-Tenant-ID"] = tenantId;
+    }
+    if (this.getAppCheckToken) {
+      const appCheckToken = await this.getAppCheckToken();
+      if (appCheckToken) {
+        requestHeaders["X-Firebase-AppCheck"] = appCheckToken;
+      }
+    }
+    const csrf = readCsrfToken();
+    if (csrf) requestHeaders["X-MM-CSRF"] = csrf;
+    const response = await fetch(url, {
+      method,
+      headers: requestHeaders,
+      credentials: "include",
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (!response.ok) {
+      await this.handleErrorResponse(response);
+    }
+    const contentType = response.headers.get("content-type");
+    if (contentType?.includes("application/json")) {
+      const json = await response.json();
+      return json.data !== void 0 ? json.data : json;
+    }
+    return {};
+  }
+  async handleErrorResponse(response) {
+    let body = {};
+    try {
+      body = await response.json();
+    } catch {
+    }
+    const errorData = body.error ?? body;
+    const code = errorData.code || this.mapStatusToCode(response.status);
+    const message = errorData.message || response.statusText || `Request failed (HTTP ${response.status})`;
+    const details = errorData.requestId ? { ...errorData.details ?? {}, requestId: errorData.requestId } : errorData.details;
+    throw new MAKEMINDError(code, message, details);
+  }
+  mapStatusToCode(status) {
+    switch (status) {
+      case 400:
+        return ErrorCodes.VALIDATION_ERROR;
+      case 401:
+        return ErrorCodes.UNAUTHENTICATED;
+      case 403:
+        return ErrorCodes.PERMISSION_DENIED;
+      case 404:
+        return ErrorCodes.NOT_FOUND;
+      case 409:
+        return ErrorCodes.ALREADY_EXISTS;
+      case 429:
+        return ErrorCodes.QUOTA_EXCEEDED;
+      case 500:
+        return ErrorCodes.INTERNAL_ERROR;
+      case 503:
+        return ErrorCodes.SERVICE_UNAVAILABLE;
+      default:
+        return ErrorCodes.UNKNOWN_ERROR;
+    }
+  }
+  // Convenience methods
+  async get(endpoint, options) {
+    return this.request(endpoint, { ...options, method: "GET" });
+  }
+  async post(endpoint, body, options) {
+    return this.request(endpoint, { ...options, method: "POST", body });
+  }
+  async put(endpoint, body, options) {
+    return this.request(endpoint, { ...options, method: "PUT", body });
+  }
+  async patch(endpoint, body, options) {
+    return this.request(endpoint, { ...options, method: "PATCH", body });
+  }
+  async delete(endpoint, options) {
+    return this.request(endpoint, { ...options, method: "DELETE" });
+  }
+  /**
+   * Execute a tenant-defined logic function by name via the logic service.
+   * This is NOT the gateway RPC dispatch — use `dispatch()` for Callable operations.
+   */
+  async call(functionName, data) {
+    return this.post("/logic/call", { functionName, input: data });
+  }
+  /**
+   * Invoke a platform Callable operation through the gateway RPC dispatch route
+   * (`POST /api/v<version>/call/:operation`). The operation key is the deployed
+   * Callable name (`<domain>-<name>` for namespaced groups, bare name for flat
+   * exports). The gateway expects the payload under a `data` envelope.
+   */
+  async dispatch(operation, payload) {
+    return this.post(`/call/${operation}`, { data: payload ?? {} });
+  }
+  /**
+   * Get the version-qualified base URL for direct API calls (e.g. streaming),
+   * including the `/api/<version>` segment.
+   */
+  getBaseUrl() {
+    return `${this.baseUrl}/api/${this.apiVersion}`;
+  }
+  /**
+   * Get auth headers for direct API calls (e.g., streaming)
+   */
+  getAuthHeaders() {
+    const headers = {
+      "X-API-Key": this.apiKey,
+      "X-Application-ID": this.applicationId
+    };
+    const authToken = this.getAuthToken();
+    if (authToken) {
+      headers["Authorization"] = `Bearer ${authToken}`;
+    }
+    const tenantId = this.getTenantId();
+    if (tenantId) {
+      headers["X-Tenant-ID"] = tenantId;
+    }
+    return headers;
+  }
+};
+function readCsrfToken() {
+  if (typeof document === "undefined") return void 0;
+  for (const part of document.cookie.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    if (part.slice(0, eq).trim() === "mm_csrf") {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    }
+  }
+  return void 0;
+}
+
+// src/client.ts
+var MAKEMINDClient = class {
+  constructor(config) {
+    this._auth = null;
+    this._data = null;
+    this._logic = null;
+    this._tenant = null;
+    this._messaging = null;
+    this._settlement = null;
+    this._partners = null;
+    this._storage = null;
+    this._ai = null;
+    this._search = null;
+    this._apps = null;
+    this._marketplace = null;
+    this.currentTenantId = null;
+    this.currentUserId = null;
+    this.authToken = null;
+    this.applicationId = config.applicationId;
+    this.environment = config.environment || "production";
+    this.apiClient = new ApiClient({
+      baseUrl: config.baseUrl || "https://api.makemind.app",
+      apiVersion: config.apiVersion,
+      apiKey: config.apiKey,
+      applicationId: config.applicationId,
+      getAuthToken: () => this.authToken,
+      getTenantId: () => this.currentTenantId,
+      getAppCheckToken: config.getAppCheckToken
+    });
+    this._auth = new MAKEMINDAuth({
+      apiClient: this.apiClient,
+      applicationId: this.applicationId,
+      onAuthStateChange: (user) => {
+        if (user) {
+          this.currentUserId = user.uid;
+          this.currentTenantId = user.tenantId;
+        } else {
+          this.currentUserId = null;
+          this.currentTenantId = null;
+          this.authToken = null;
+        }
+      },
+      setAuthToken: (token) => {
+        this.authToken = token;
+      }
+    });
+  }
+  // Internal: Set auth token after login
+  setAuthToken(token) {
+    this.authToken = token;
+  }
+  // Internal: Set user context after login
+  setUserContext(userId, tenantId) {
+    this.currentUserId = userId;
+    this.currentTenantId = tenantId;
+  }
+  // Getters for context
+  get tenantId() {
+    return this.currentTenantId;
+  }
+  get userId() {
+    return this.currentUserId;
+  }
+  // Set tenant context manually (for switching tenants)
+  setTenantContext(tenantId) {
+    this.currentTenantId = tenantId;
+  }
+  // Get API client for direct access
+  getApiClient() {
+    return this.apiClient;
+  }
+  /**
+   * Invoke a platform Callable operation through the gateway RPC dispatch
+   * (`POST /api/v1/call/:operation`). The operation name matches the deployed
+   * Callable key (namespaced groups use `<prefix>-<name>`, e.g.
+   * `settlement-getMRR`; flat exports use the bare name, e.g. `createTenant`).
+   *
+   * This is the platform-operation channel, distinct from `logic.call()` which
+   * runs a tenant-defined logic function. Each operation enforces its own
+   * authorization server-side (platform roles / tenant scopes), so exposing
+   * this method does not bypass access control. Returns the operation's result
+   * value directly (the `{ data }` envelope is already unwrapped).
+   */
+  call(operation, input) {
+    return this.apiClient.dispatch(operation, input);
+  }
+  // Service accessors
+  get auth() {
+    return this._auth;
+  }
+  get data() {
+    if (!this._data) {
+      this._data = new MAKEMINDData({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._data;
+  }
+  get logic() {
+    if (!this._logic) {
+      this._logic = new MAKEMINDLogic({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._logic;
+  }
+  get tenant() {
+    if (!this._tenant) {
+      this._tenant = new MAKEMINDTenant({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId,
+        onTenantCreated: async (tenantId) => {
+          this.currentTenantId = tenantId;
+          try {
+            await this.auth.refreshAuthToken();
+          } catch {
+          }
+          this.currentTenantId = tenantId;
+        }
+      });
+    }
+    return this._tenant;
+  }
+  get messaging() {
+    if (!this._messaging) {
+      this._messaging = new MAKEMINDMessaging({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId,
+        userId: () => this.currentUserId
+      });
+    }
+    return this._messaging;
+  }
+  get settlement() {
+    if (!this._settlement) {
+      this._settlement = new MAKEMINDSettlement({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._settlement;
+  }
+  get partners() {
+    if (!this._partners) {
+      this._partners = new MAKEMINDPartners({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._partners;
+  }
+  get storage() {
+    if (!this._storage) {
+      this._storage = new MAKEMINDStorage({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._storage;
+  }
+  get ai() {
+    if (!this._ai) {
+      this._ai = new MAKEMINDAI({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._ai;
+  }
+  get search() {
+    if (!this._search) {
+      this._search = new MAKEMINDSearch({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._search;
+  }
+  get apps() {
+    if (!this._apps) {
+      this._apps = new MAKEMINDApps({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._apps;
+  }
+  get marketplace() {
+    if (!this._marketplace) {
+      this._marketplace = new MAKEMINDMarketplace({
+        apiClient: this.apiClient,
+        applicationId: this.applicationId,
+        tenantId: () => this.currentTenantId
+      });
+    }
+    return this._marketplace;
+  }
+};
+var defaultClient = null;
+function initializeMAKEMIND(config) {
+  defaultClient = new MAKEMINDClient(config);
+  return defaultClient;
+}
+function getMAKEMIND() {
+  if (!defaultClient) {
+    throw new Error("MAKEMIND SDK not initialized. Call initializeMAKEMIND() first.");
+  }
+  return defaultClient;
+}
+
+// src/services/experts.ts
+var ExpertDoorError = class extends Error {
+  constructor(code, message, status) {
+    super(message);
+    this.name = "ExpertDoorError";
+    this.code = code;
+    this.status = status;
+  }
+};
+var MAKEMINDExperts = class {
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.tenantId = config.tenantId;
+    this.appCheck = config.appCheck;
+    this.fetchImpl = config.fetchImpl ?? ((...a) => fetch(...a));
+  }
+  async post(path, body) {
+    const headers = { "Content-Type": "application/json" };
+    if (this.appCheck) {
+      const token = await this.appCheck();
+      if (token) headers["X-Firebase-AppCheck"] = token;
+    }
+    const res = await this.fetchImpl(`${this.baseUrl}/api/v1/public/experts/${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ tenantId: this.tenantId, ...body })
+    });
+    const payload = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const err = payload.error;
+      throw new ExpertDoorError(err?.code ?? "UNKNOWN", err?.message ?? `HTTP ${res.status}`, res.status);
+    }
+    return payload.data;
+  }
+  /** One question, one answer, and the capability to read it back. */
+  async consult(options) {
+    return this.post("consult", {
+      expertId: options.expertId,
+      question: options.question,
+      ...options.facts !== void 0 ? { facts: options.facts } : {}
+    });
+  }
+  /**
+   * Open a conversation, or resume one whose capability the caller kept.
+   * @param {Object} options The expert to open, or a thread to resume.
+   * @return {ExpertChat} A thread that carries its own capability.
+   */
+  chat(options) {
+    return new ExpertChat(this, options);
+  }
+  /** @internal */
+  async converse(body) {
+    return this.post("converse", body);
+  }
+  async getConsultation(options) {
+    return this.post("consultation", options);
+  }
+  async getSession(options) {
+    return this.post("session", options);
+  }
+};
+var ExpertChat = class {
+  constructor(api, options) {
+    this.turns = [];
+    this.api = api;
+    this.expertId = options.expertId;
+    this.session = options.sessionId;
+    this.token = options.accessToken;
+  }
+  get sessionId() {
+    return this.session;
+  }
+  get accessToken() {
+    return this.token;
+  }
+  get history() {
+    return [...this.turns];
+  }
+  /**
+   * Ask, and keep whatever the thread needs to be continued.
+   * @param {string} question What the visitor asked.
+   * @param {Object} [facts] Structured facts the rules read.
+   * @return {Promise<ExpertConsultation>} The turn's record. A refusal comes
+   *   back as an answer with `refusal` set; only a closed door throws.
+   */
+  async ask(question, facts) {
+    const result = await this.api.converse({
+      // A thread names its performer once. Sending the expert again on a later
+      // turn is refused by the platform as renaming it.
+      ...this.session ? { sessionId: this.session } : { expertId: this.expertId },
+      ...this.token ? { accessToken: this.token } : {},
+      question,
+      ...facts !== void 0 ? { facts } : {}
+    });
+    this.session = result.sessionId;
+    if (result.access?.token) this.token = result.access.token;
+    this.turns.push({
+      question,
+      consultationId: result.consultation.id,
+      ...result.consultation.synthesis?.answer !== void 0 ? { answer: result.consultation.synthesis.answer } : {}
+    });
+    return result.consultation;
+  }
+};
+
+// src/services/expert-chat-widget.ts
+var DEFAULT_NOTICE = "This conversation lives in this browser only. Lose the link and the thread is gone \u2014 there is no account to recover it into.";
+function defaultStorage() {
+  try {
+    return typeof localStorage === "undefined" ? null : localStorage;
+  } catch {
+    return null;
+  }
+}
+function mountExpertChat(el, options) {
+  const doc = el.ownerDocument;
+  const api = new MAKEMINDExperts(options);
+  const store = options.storage === void 0 ? defaultStorage() : options.storage;
+  const key = `makemind.expert.${options.tenantId}.${options.expertId}`;
+  let saved = {};
+  try {
+    const raw = store?.getItem(key);
+    if (raw) saved = JSON.parse(raw);
+  } catch {
+    saved = {};
+  }
+  const chat = api.chat({ expertId: options.expertId, ...saved });
+  const root = doc.createElement("div");
+  root.className = "mm-expert-chat";
+  const heading = doc.createElement("div");
+  heading.className = "mm-expert-chat__title";
+  heading.textContent = options.title ?? "Ask the expert";
+  const thread = doc.createElement("div");
+  thread.className = "mm-expert-chat__thread";
+  const form = doc.createElement("form");
+  form.className = "mm-expert-chat__form";
+  const input = doc.createElement("input");
+  input.type = "text";
+  input.placeholder = options.placeholder ?? "Type your question";
+  const button = doc.createElement("button");
+  button.type = "submit";
+  button.textContent = "Ask";
+  const notice = doc.createElement("p");
+  notice.className = "mm-expert-chat__notice";
+  notice.textContent = options.bearerNotice ?? DEFAULT_NOTICE;
+  form.append(input, button);
+  root.append(heading, thread, form, notice);
+  el.textContent = "";
+  el.append(root);
+  function line(role, text) {
+    const p = doc.createElement("p");
+    p.className = `mm-expert-chat__${role}`;
+    p.textContent = text;
+    thread.append(p);
+    return p;
+  }
+  for (const turn of chat.history) {
+    line("question", turn.question);
+    if (turn.answer) line("answer", turn.answer);
+  }
+  function remember() {
+    try {
+      store?.setItem(key, JSON.stringify({ sessionId: chat.sessionId, accessToken: chat.accessToken }));
+    } catch {
+    }
+  }
+  function render(turn) {
+    if (turn.refusal) line("refusal", turn.synthesis?.answer || turn.refusal);
+    else line("answer", turn.synthesis?.answer ?? "");
+  }
+  let asking = false;
+  async function ask(question) {
+    const text = question.trim();
+    if (!text || asking) return;
+    asking = true;
+    button.disabled = true;
+    line("question", text);
+    try {
+      render(await chat.ask(text));
+      remember();
+    } catch (e) {
+      line("error", e instanceof ExpertDoorError ? e.message : "The expert could not be reached.");
+    } finally {
+      asking = false;
+      button.disabled = false;
+    }
+  }
+  const onSubmit = (event) => {
+    event.preventDefault();
+    const question = input.value;
+    input.value = "";
+    void ask(question);
+  };
+  form.addEventListener("submit", onSubmit);
+  return {
+    ask,
+    destroy() {
+      form.removeEventListener("submit", onSubmit);
+      root.remove();
+    },
+    get thread() {
+      return { sessionId: chat.sessionId, accessToken: chat.accessToken };
+    }
+  };
+}
+export {
+  ApiClient,
+  ErrorCodes,
+  ExpertChat,
+  ExpertDoorError,
+  MAKEMINDAI,
+  MAKEMINDApps,
+  MAKEMINDAuth,
+  MAKEMINDClient,
+  MAKEMINDData,
+  MAKEMINDError,
+  MAKEMINDExperts,
+  MAKEMINDLogic,
+  MAKEMINDMarketplace,
+  MAKEMINDMessaging,
+  MAKEMINDSearch,
+  MAKEMINDSettlement,
+  MAKEMINDStorage,
+  MAKEMINDTenant,
+  getMAKEMIND,
+  initializeMAKEMIND,
+  mountExpertChat
+};