@sequenceholdings/orm 2.6.2 → 2.7.1

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/constants.ts","../src/client/errors.ts","../src/client/transport.ts","../src/client/query-builder.ts","../src/client/response.ts","../src/client/sql.ts","../src/client/operations.ts","../src/client/transport-executor.ts","../src/client/index.ts"],"names":[],"mappings":";AAIO,IAAM,iBAAA,GAAoB;AAG1B,IAAM,qBAAA,GAAwB;AAG9B,IAAM,6BAAA,GAAgC;AAwGtC,IAAM,iBAAA,GAAoB,iBAAA;AACM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAK,iBAAA,EAAmB,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,EAAC,EAAG,YAAA,EAAc,IAAI;;;ACnHjH,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAGxC,WAAA,CAAY,OAAA,EAA0B,MAAA,GAAwB,IAAA,EAAM;AAClE,IAAA,KAAA,CAAM,OAAO,CAAA;AADuB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAEtC;AAAA,EAJkB,IAAA,GAAe,gBAAA;AAKnC;AAOO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EAGpD,YACE,OAAA,EACA,MAAA,EACS,IAAA,EACA,MAAA,GAAyC,EAAC,EACnD;AACA,IAAA,KAAA,CAAM,SAAS,MAAM,CAAA;AAHZ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAGX;AAAA,EATkB,IAAA,GAAO,mBAAA;AAU3B;;;ACTO,SAAS,oBAAA,CAAqB;AAAA,EACnC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAOiB;AACf,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAc,IAAA,KAAyD;AAC5F,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAE7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,MAAM,WAAW,MAAM,SAAA,CAAU,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACjD,GAAG,IAAA;AAAA,MACH,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA;AAAmB,KACxD,CAAA;AACD,IAAA,MAAM,UAAmB,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/D,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAA,GACJ,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,QAAA,IAAY,OAAA,GAClD,MAAA,CAAQ,OAAA,CAAgC,MAAM,CAAA,GAC9C,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,CAAA;AAC7B,MAAA,MAAM,IAAI,cAAA,CAAe,MAAA,EAAQ,QAAA,CAAS,MAAM,CAAA;AAAA,IAClD;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,IAAA,EAAM,MAAA,KAAW;AAGrB,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,EAAS;AACnC,MAAA,OAAO,OAAA,CAAQ,UAAA,KAAe,EAAA,GAAK,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,IACvE,CAAA;AAAA,IACA,MAAM,CAAC,IAAA,EAAM,IAAA,KAAS,OAAA,CAAQ,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAK,SAAA,CAAU,IAAA,IAAQ,EAAE,GAAG;AAAA,GAC1F;AACF;;;AC5CA,IAAM,uBAAA,GAA0B,OAAA;AAUhC,IAAM,WAAA,GAA0B;AAAA,EAC9B,SAAS,EAAC;AAAA,EACV,WAAW,EAAC;AAAA,EACZ,SAAA,EAAW,IAAA;AAAA,EACX,UAAA,EAAY,IAAA;AAAA,EACZ,WAAA,EAAa;AACf,CAAA;AAOO,IAAM,UAAA,GAAN,MAAM,WAAA,CAA8D;AAAA,EACzE,WAAA,CACmB,SAAA,EACA,SAAA,EACA,KAAA,EACA,QAAoB,WAAA,EACrC;AAJiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAChB;AAAA,EAEK,KAAK,KAAA,EAAqD;AAChE,IAAA,OAAO,IAAI,WAAA,CAAW,IAAA,CAAK,SAAA,EAAW,KAAK,SAAA,EAAW,IAAA,CAAK,KAAA,EAAO,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,OAAO,CAAA;AAAA,EAC/F;AAAA,EAEA,UAAwC,OAAA,EAAqD;AAC3F,IAAA,OAAO,IAAI,WAAA,CAA8B,IAAA,CAAK,WAAW,IAAA,CAAK,SAAA,EAAW,KAAK,KAAA,EAAO;AAAA,MACnF,GAAG,IAAA,CAAK,KAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,GAAA,CAAkC,QAAW,KAAA,EAA6C;AACxF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACzC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,GAAA,CAAkC,QAAW,KAAA,EAA6C;AACxF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACzC;AAAA,EAEA,IAAA,CAAmC,QAAW,OAAA,EAA0C;AACtF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5C;AAAA,EAEA,KAAA,CAAoC,QAAW,OAAA,EAA0C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,EAC7C;AAAA,EAEA,EAAA,CAAiC,QAAW,MAAA,EAAyD;AAOnG,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,KAAU;AACrC,MAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,MAAA,IAAI,wBAAwB,IAAA,CAAK,IAAI,KAAK,IAAA,KAAS,IAAA,CAAK,MAAK,EAAG;AAC9D,QAAA,MAAM,IAAI,cAAA,CAAe,CAAA,YAAA,EAAe,IAAI,CAAA,+DAAA,CAA4D,CAAA;AAAA,MAC1G;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAC,CAAA;AACD,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,IAAK,QAAA,CAAS,CAAC,MAAM,EAAA,EAAI;AAC/C,MAAA,MAAM,IAAI,eAAe,kFAA6E,CAAA;AAAA,IACxG;AACA,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,SAAS,CAAC,GAAG,KAAK,KAAA,CAAM,OAAA,EAAS,CAAC,MAAA,EAAQ,CAAA,IAAA,EAAO,SAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAG,CAAC,GAAG,CAAA;AAAA,EAC/F;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAAgD;AAC1F,IAAA,OAAO,KAAK,IAAA,CAAK;AAAA,MACf,OAAA,EAAS,CAAC,GAAG,IAAA,CAAK,MAAM,OAAA,EAAS,CAAC,MAAA,EAAQ,CAAA,GAAA,EAAM,KAAA,KAAU,IAAA,GAAO,MAAA,GAAS,KAAK,EAAE,CAAC;AAAA,KACnF,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CAAoC,MAAA,EAAW,SAAA,GAA4B,KAAA,EAAgC;AACzG,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,SAAA,EAAW,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,GAAG,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,GAAG,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,KAAA,EAAwC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,UAAA,EAAY,OAAO,CAAA;AAAA,EACxC;AAAA,EAEA,OAAO,KAAA,EAAwC;AAC7C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,WAAA,EAAa,OAAO,CAAA;AAAA,EACzC;AAAA;AAAA,EAGA,YAAA,GAAgC;AAC9B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,IAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,UAAU,CAAA,IAAK,IAAA,CAAK,MAAM,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,MAAA,EAAQ,UAAU,CAAA;AACvF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA;AACvF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA;AAC7E,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,UAAA,KAAe,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,CAAA;AACrF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,WAAA,KAAgB,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,WAAW,CAAC,CAAA;AACxF,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,GAA0B;AAC9B,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MACnC,CAAA,UAAA,EAAa,IAAA,CAAK,SAAS,CAAA,CAAA,EAAI,KAAK,KAAK,CAAA,CAAA;AAAA,MACzC,KAAK,YAAA;AAAa,KACpB;AACA,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACnG,MAAA,MAAM,IAAI,eAAe,8DAAyD,CAAA;AAAA,IACpF;AACA,IAAA,OAAQ,OAAA,CAA+B,IAAA;AAAA,EACzC;AAAA,EAEQ,MAAA,CAAO,MAAA,EAAgB,EAAA,EAAY,KAAA,EAA6C;AACtF,IAAA,OAAO,IAAA,CAAK,KAAK,EAAE,OAAA,EAAS,CAAC,GAAG,IAAA,CAAK,MAAM,OAAA,EAAS,CAAC,QAAQ,CAAA,EAAG,EAAE,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAC,GAAG,CAAA;AAAA,EAC3F;AACF;;;AC7JO,SAAS,SAAS,KAAA,EAAkD;AACzE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,iBAAiB,KAAA,EAA8C;AACtE,EAAA,IAAI,CAAC,SAAS,KAAK,CAAA,IAAK,OAAO,KAAA,CAAM,OAAA,KAAY,UAAU,OAAO,KAAA;AAClE,EAAA,IAAI,KAAA,CAAM,UAAA,KAAe,MAAA,EAAW,OAAO,IAAA;AAC3C,EAAA,OAAO,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,KAAM,KAAA,CAAM,UAAA,CAAW,IAAA,KAAS,MAAA,IAAa,OAAO,KAAA,CAAM,UAAA,CAAW,IAAA,KAAS,QAAA,CAAA;AAChH;AAEO,SAAS,qBAAA,CAA6B;AAAA,EAC3C,EAAA;AAAA,EAAI,MAAA;AAAA,EAAQ;AACd,CAAA,EAA0D;AACxD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,IAAI,CAAA,GAAI,IAAA,GAAO,IAAA;AACxC,EAAA,MAAM,YAAY,OAAA,EAAS,MAAA;AAC3B,EAAA,IAAI,SAAA,KAAc,MAAA,KAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA,CAAA,EAAI;AAChG,IAAA,MAAM,IAAI,iBAAA,CAAkB,oCAAA,EAAsC,MAAA,EAAQ,IAAI,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,MAAA,GAAgC,aAAa,EAAC;AACpD,EAAA,IAAI,CAAC,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC5B,IAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,KAAA,EAAO,OAAA,IAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAY,IAAA,IAAQ,IAAA,EAAM,MAAM,CAAA;AAAA,EACjH;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,SAAS,MAAA,IAAa,OAAA,CAAQ,SAAS,IAAA,EAAM;AACnE,IAAA,MAAM,IAAI,iBAAA,CAAkB,kCAAA,EAAoC,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,iBAAA,CAAkB,4CAAA,EAA8C,MAAA,EAAQ,IAAI,CAAA;AAAA,EACxF;AAGA,EAAA,OAAO,OAAA,CAAQ,IAAA;AACjB;AAGO,SAAS,gCAAA,CAAwC;AAAA,EACtD,EAAA;AAAA,EAAI,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM;AACpB,CAAA,EAAiI;AAC/H,EAAA,MAAM,OAAO,qBAAA,CAA6B,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,IAAI,CAAA,IAAK,SAAS,IAAA,CAAK,UAAU,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa,IAAA;AACnF,EAAA,MAAM,mBAAmB,UAAA,EAAY,gBAAA;AACrC,EAAA,IAAI,OAAO,gBAAA,KAAqB,QAAA,IAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,gBAAgB,CAAA,IAC7E,wBAAA,KAA6B,MAAA,IAAa,wBAAA,KAA6B,gBAAA,EAAmB;AAE9F,IAAA,MAAM,IAAI,iBAAA,CAAkB,+BAAA,EAAiC,MAAA,EAAQ,oBAAoB,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,MAAM,gBAAA,EAAiB;AAClC;;;AC9CO,IAAM,qBAAA,GAAwB;;;AC4C9B,SAAS,uBAAuB,GAAA,EAA+B;AACpE,EAAA,IAAI,QAAQ,MAAA,IAAa,CAAC,0BAAA,CAA2B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,eAAe,yFAAoF,CAAA;AAAA,EAC/G;AACF;AAEO,SAAS,iCAAiC,KAAA,EAAiC;AAChF,EAAA,IAAI,KAAA,KAAU,WAAc,OAAO,KAAA,KAAU,YAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI;AACvF,IAAA,MAAM,IAAI,eAAe,+EAA+E,CAAA;AAAA,EAC1G;AACF;AAkDA,IAAM,aAAA,GAAgB,CAAC,SAAA,KAA8B,CAAA,UAAA,EAAa,SAAS,CAAA,CAAA;AAU3E,SAAS,aAAA,CAAc,UAA8B,EAAA,EAAoB;AACvE,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,EAAE,CAAA;AACpC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,EAAE,IAAA,EAAK;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,EAAE,CAAA,8BAAA,EAA4B,KAAA,CAAM,MAAM,CAAA,4EAAA;AAAA,KAElE;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA;AACf;AAGO,SAAS,kCAAA,CAAmC,EAAE,UAAA,EAAW,EAEI;AAClE,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAoB;AAC7C,EAAA,MAAM,UAAA,mBAAa,IAAI,GAAA,CAAI,CAAC,qBAAqB,CAAC,CAAA;AAClD,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,UAAA,EAAY;AACtC,IAAA,YAAA,CAAa,GAAA,CAAI,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AACjC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,OAAA,IAAW,uBAAA,CAAwB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AACjG,IAAA,IAAI,MAAM,IAAA,KAAS,UAAA,EAAY,cAAA,CAAe,GAAA,CAAI,MAAM,IAAI,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,CAAC,EAAE,QAAA,EAAU,QAAA,GAAW,OAAM,KAAM;AACzC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,UAAA,CAAW,SAAS,CAAA,GAAI,WAAW,QAAA,GAAW,MAAA,GAAY,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AACzG,IAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,IAAK,cAAA,CAAe,GAAA,CAAI,IAAI,CAAA,EAAG;AAC9D,MAAA,MAAM,IAAI,eAAe,mEAAmE,CAAA;AAAA,IAC9F;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAEO,SAAS,uBAAA,CAAwB;AAAA,EACtC,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAW,EAAE,UAAA,EAAY,SAAA,EAAW,UAAA,EAAY,EAAC,EAAE;AAAA,EACnD,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAAkE;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,uBAAA,GAA0B,mCAAmC,EAAE,UAAA,EAAY,OAAO,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,CAAA;AAEtH,EAAA,eAAe,QAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,kBAAA,GAAqB,OAAM,EAKhB;AAC1D,IAAA,sBAAA,CAAuB,QAAQ,cAAc,CAAA;AAC7C,IAAA,gCAAA,CAAiC,QAAQ,wBAAwB,CAAA;AACjE,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,CAAG,cAAc,SAAA,EAAW,MAAM,IAAI,cAAA,CAAe,4CAA4C,CAAA;AAC/H,IAAA,MAAM,IAAA,GAAO,kBAAA,GACT,uBAAA,CAAwB,EAAE,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,EAAA,CAAG,IAAA,EAAM,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,EAAU,CAAA,GAC7G,OAAO,EAAA,KAAO,WAAW,aAAA,CAAc,QAAA,EAAU,EAAE,CAAA,GAAI,EAAA,CAAG,IAAA;AAC9D,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAC7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,EAAG,aAAA,CAAc,SAAS,CAAC,CAAA,CAAA,EAAI;AAAA,MACrE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA,EAAmB;AAAA,MACvD,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QAAE,EAAA,EAAI,IAAA;AAAA,QAAM,SAAA;AAAA,QAAW,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QAClE,0BAA0B,OAAA,CAAQ;AAAA,OAA0B;AAAA,KAC/D,CAAA;AACD,IAAA,OAAO;AAAA,MACL,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,MAAM,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI;AAAA,KAC9C;AAAA,EACF;AAIA,EAAA,eAAe,QAAyC,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAmB;AACzN,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,IAAI,SAAA,EAAW,OAAA,EAAS,kBAAkB,CAAA;AAC3E,IAAA,OAAO,gBAAA,CAAiB,wBAAA,KAA6B,MAAA,GACjD,qBAAA,CAA6B,QAAQ,CAAA,GACrC,gCAAA,CAAwC,EAAE,GAAG,QAAA,EAAU,wBAAA,EAA0B,gBAAA,CAAiB,wBAAA,EAA0B,CAAA,CAAE,IAAA;AAAA,EACpI;AAIA,EAAA,eAAe,uBAAwD,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAyC;AAC9P,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,gBAAA,EAAkB,kBAAA,EAAoB,IAAA,EAAM,CAAA;AACrG,IAAA,OAAO,iCAAwC,EAAE,GAAG,UAAU,wBAAA,EAA0B,gBAAA,CAAiB,0BAA0B,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,EAAE,SAAS,sBAAA,EAAwB,GAAA,EAAK,eAAa,OAAA,CAAwB,qBAAA,EAAuB,SAAS,CAAA,EAAE;AACxH;AAMA,IAAI,UAAA,GAAuC,IAAA;AAOpC,SAAS,uBAAuB,MAAA,EAAoD;AACzF,EAAA,UAAA,GAAa,wBAAwB,MAAM,CAAA;AAC3C,EAAA,OAAO,UAAA;AACT;AAGA,eAAsB,gBAAA,CAAkD;AAAA,EACtE,EAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAImB;AACjB,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,cAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAe,EAAA,EAAI,SAAA,EAAW,cAAA,KAAmB,SAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,CAAA;AACxG;AAcO,SAAS,cAAA,CAAe;AAAA,EAC7B,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAAqD;AACnD,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,eAAe,gDAAgD,CAAA;AACxF,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,MAAM,CAAA,EAAG,IAAI,CAAA,EAAG,aAAA,CAAc,SAAS,CAAC,CAAA,CAAA;AAM9C,EAAA,OAAO,OAAO,QAAgD,IAAA,KAA0C;AACtG,IAAA,MAAM,MAAM,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,IAAA;AACzD,IAAA,MAAM,SAAS,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,GAAG,IACf,EAAC;AACL,IAAA,MAAM,OAAO,MAAA,CAAO,aAAA;AACpB,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,cAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,aAAA,CAAc,QAAA,EAAU,IAAI,CAAA;AACzC,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAA,IAAK,MAAA;AAC5E,IAAA,sBAAA,CAAuB,cAAc,CAAA;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAC7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,OAAO,UAAU,GAAA,EAAK;AAAA,MACpB,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA,EAAmB;AAAA,MACvD,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAC,EAAG,cAAA,EAAgB,CAAA;AAAA,MACpF,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KAC/C,CAAA;AAAA,EACH,CAAA;AACF;;;AC5RA,IAAM,aAAA,GAAgB,uBAAA;AAEtB,SAAS,mBAAmB,QAAA,EAAkF;AAC5G,EAAA,IAAI,CAAC,QAAA,CAAS,QAAQ,CAAA,IAAK,OAAO,QAAA,CAAS,UAAA,KAAe,QAAA,IAAY,CAAC,SAAS,UAAA,IAAc,CAAC,QAAA,CAAS,QAAA,CAAS,UAAU,CAAA,EAAG;AAC5H,IAAA,MAAM,IAAI,eAAe,8FAAyF,CAAA;AAAA,EACpH;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAsD;AACzE,EAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAC/D,IAAA,IAAI,CAAC,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,IAAK,CAAC,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,KAAA,CAAM,IAAA,KAAS,YAAY,CAAC,aAAA,CAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,IAC5H,MAAM,IAAA,KAAS,OAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,EAAa;AAC1D,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,mCAAA,EAAsC,IAAI,CAAA,gCAAA,CAA6B,CAAA;AAAA,IAClG;AACA,IAAA,MAAA,CAAO,GAAA,CAAI,MAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,oCAAA,CAAqC,EAAE,SAAA,EAAW,QAAA,EAAU,WAAU,EAK7C;AACvC,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,CAAC,iBAAA,CAAkB,IAAA,CAAK,SAAS,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,uFAAkF,CAAA;AACpL,EAAA,MAAM,SAAS,QAAA,KAAa,MAAA,uBAAgB,GAAA,EAAsD,GAAI,mBAAmB,QAAQ,CAAA;AACjI,EAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,CAAA,KAAA,KAAS,KAAA,CAAM,IAAI,CAAC,CAAA;AACzE,EAAA,MAAM,uBAAA,GAA0B,kCAAA,CAAmC,EAAE,UAAA,EAAY,QAAQ,CAAA;AACzF,EAAA,eAAe,QAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,kBAAA,GAAqB,OAAM,EAKpC;AACtC,IAAA,sBAAA,CAAuB,QAAQ,cAAc,CAAA;AAC7C,IAAA,gCAAA,CAAiC,QAAQ,wBAAwB,CAAA;AACjE,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,CAAG,cAAc,SAAA,EAAW,MAAM,IAAI,cAAA,CAAe,4CAA4C,CAAA;AAC/H,IAAA,MAAM,QAAA,GAAW,OAAO,EAAA,KAAO,QAAA,GAAW,KAAK,EAAA,CAAG,IAAA;AAClD,IAAA,MAAM,IAAA,GAAO,qBACT,uBAAA,CAAwB,EAAE,UAAU,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,EAAU,CAAA,GACtE,aAAa,qBAAA,GAAwB,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,SAAS,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,GAAI,QAAA,GAAW,MAAA,CAAA;AAC1H,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,sBAAsB,EAAE,CAAA,8BAAA,EAA4B,MAAA,CAAO,IAAI,CAAA,wCAAA,CAA0C,CAAA;AAC7I,IAAA,IAAI,CAAC,QAAA,CAAS,SAAS,GAAG,MAAM,IAAI,eAAe,uCAAuC,CAAA;AAC1F,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU;AAAA,MAAE,SAAA;AAAA,MAAW,EAAA,EAAI,IAAA;AAAA,MAAM,SAAA;AAAA,MACtD,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,MACzF,GAAI,QAAQ,wBAAA,KAA6B,MAAA,GAAY,EAAC,GAAI,EAAE,wBAAA,EAA0B,OAAA,CAAQ,wBAAA;AAAyB,KACxH,CAAA;AACD,IAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,EAAA,KAAO,aAAa,CAAC,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,IAAK,SAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,MAAA,GAAS,GAAA,IACjI,QAAA,CAAS,EAAA,MAAQ,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,MAAA,GAAS,GAAA,CAAA,EAAM;AACtE,MAAA,MAAM,IAAI,iBAAA,CAAkB,8BAAA,EAAgC,IAAA,EAAM,IAAI,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAIA,EAAA,eAAe,QAAyC,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAmB;AACzN,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,IAAI,SAAA,EAAW,OAAA,EAAS,kBAAkB,CAAA;AAC3E,IAAA,OAAO,gBAAA,CAAiB,wBAAA,KAA6B,MAAA,GACjD,qBAAA,CAA6B,QAAQ,CAAA,GACrC,gCAAA,CAAwC,EAAE,GAAG,QAAA,EAAU,wBAAA,EAA0B,gBAAA,CAAiB,wBAAA,EAA0B,CAAA,CAAE,IAAA;AAAA,EACpI;AAIA,EAAA,eAAe,uBAAwD,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAyC;AAC9P,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,gBAAA,EAAkB,kBAAA,EAAoB,IAAA,EAAM,CAAA;AACrG,IAAA,OAAO,iCAAwC,EAAE,GAAG,UAAU,wBAAA,EAA0B,gBAAA,CAAiB,0BAA0B,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,EAAE,SAAS,sBAAA,EAAwB,GAAA,EAAK,eAAa,OAAA,CAAwB,qBAAA,EAAuB,SAAS,CAAA,EAAE;AACxH;;;ACnCO,SAAS,eAAA,CAGd;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAc+B;AAC7B,EAAA,MAAM,QAAA,GACJ,aACA,oBAAA,CAAqB;AAAA,IACnB,OAAA,EAAS,aAAA,CAAc,OAAA,EAAS,SAAS,CAAA;AAAA,IACzC,GAAI,SAAA,KAAc,MAAA,GACd,EAAE,YAAA,EAAc,OAAO,SAAA,KAAc,UAAA,GAAa,SAAA,GAAY,MAAM,WAAU,GAC9E,EAAE,UAAU,aAAA,CAAc,QAAA,EAAU,UAAU,CAAA,EAAE;AAAA,IACpD;AAAA,GACD,CAAA;AAEH,EAAA,OAAO,cAAA,CAAgC,UAAU,SAAS,CAAA;AAC5D;AAwBO,SAAS,sBAAA,CAGd;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAQ+B;AAC7B,EAAA,MAAM,QAAA,GACJ,aACA,oBAAA,CAAqB;AAAA,IACnB,OAAA,EAAS,aAAA,CAAc,OAAA,EAAS,SAAS,CAAA;AAAA,IACzC,YAAA,EACE,OAAO,gBAAA,KAAqB,UAAA,GACxB,mBACA,MAAM,aAAA,CAAc,kBAAkB,kBAAkB,CAAA;AAAA,IAC9D;AAAA,GACD,CAAA;AAEH,EAAA,OAAO,cAAA,CAAgC,UAAU,SAAS,CAAA;AAC5D;AAGA,SAAS,cAAA,CAGP,UAAwB,SAAA,EAA+C;AACvE,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,EAAM;AACV,MAAA,OAAO,IAAI,UAAA,CAAW,QAAA,EAAU,SAAA,EAAW,IAAI,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,MAAM,KAAA,CAAM,GAAA,EAAK,MAAA,EAAQ;AACvB,MAAA,MAAM,UAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAA,UAAA,EAAa,SAAS,CAAA,MAAA,CAAA,EAAU;AAAA,QAClE,GAAA;AAAA,QACA,GAAI,SAAS,EAAE,MAAA,EAAQ,CAAC,GAAG,MAAM,CAAA,EAAE,GAAI;AAAC,OACzC,CAAA;AACD,MAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACnG,QAAA,MAAM,IAAI,eAAe,8DAAyD,CAAA;AAAA,MACpF;AACA,MAAA,OAAQ,OAAA,CAA8B,IAAA;AAAA,IACxC,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,IAAA,EAAA,GAAS,IAAA,EAAM;AAC1B,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAA,UAAA,EAAa,SAAS,CAAA,SAAA,EAAY,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,IAAK,EAAE,CAAA;AAC3F,MAAA,IAAI,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAG1C,QAAA,IAAI,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACvD,UAAA,OAAO,EAAE,IAAA,EAAO,OAAA,CAAgC,IAAA,EAAK;AAAA,QACvD;AACA,QAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,UAAA,MAAM,YAAA,GAAe,MAAA,CAAQ,OAAA,CAAuC,aAAa,CAAA;AACjF,UAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA,EAAG;AAC/B,YAAA,OAAO,EAAE,YAAA,EAAa;AAAA,UACxB;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,IAAI,eAAe,wEAAmE,CAAA;AAAA,IAC9F;AAAA,GACF;AACF;AAEA,SAAS,aAAA,CAAiB,OAAsB,IAAA,EAAiB;AAC/D,EAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,8BAAA,CAAgC,CAAA;AACzG,EAAA,OAAO,KAAA;AACT","file":"client.js","sourcesContent":["/** Shared grammar for namespace identifiers; never interpolate arbitrary paths.\n * orm_events and orm_native_sources are migration-owned control-plane schemas,\n * not builder namespaces. Exclude their suffixes at every API/authoring entry.\n */\nexport const NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/\n\n/** Caller-scoped delegated data credential, supplied by an authenticated host. */\nexport const ORM_DATA_TOKEN_HEADER = 'x-sequence-data-token'\n\n/** Separate service-identity credential; never used as an implicit fallback. */\nexport const ORM_SERVICE_DATA_TOKEN_HEADER = 'x-sequence-data-token-service'\n\nexport const IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/\n/** Native source columns may have one leading underscore; relation names may not. */\nexport const COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/\nexport const MAX_IDENTIFIER_LENGTH = 63\n\n/**\n * Custom Roles & Capabilities claim keys as policies reference them: a\n * host-scoped registry key, an org pin's `org/<key>`, or an Application\n * capability pin's `app/<application-id>/<key>`. Matches the registry\n * key grammar EXACTLY (`[a-z0-9-]`, 1–64 chars, no `_` — the FGA object-id\n * delimiter) so any capability that's declarable/attachable in namespace.yaml\n * can also be referenced here — a stricter pattern would let a valid key\n * register yet fail at apply (e.g. `org/2fa`, a one-char or digit-led key).\n */\nexport const CAPABILITY_KEY_PATTERN = /^(?:org\\/|app\\/[a-z][a-z0-9-]{0,63}\\/)?[a-z0-9-]{1,64}$/\n\n/** Hard ceiling for an explicitly authored flat persisted GraphQL read. */\nexport const MAX_PERSISTED_READ_ROWS = 50_001\n\nexport const CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/\n\n/** Qualified reference to a table outside the defining file: `<schema>.<table>`. */\nexport const QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\\.[a-z][a-z0-9_]{0,62}$/\n\n/** Qualified source syntax only; the serving installation controls authorized backing. */\nexport const SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN\n\nexport const ORM_SCHEMA_PREFIX = 'orm_'\nexport const CONSUMER_ROLE_SUFFIX = '_consumer'\n\nexport const ormSchemaName = (namespace: string): string => {\n  if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`)\n  return `${ORM_SCHEMA_PREFIX}${namespace}`\n}\nexport const consumerRoleName = (namespace: string): string =>\n  `${ormSchemaName(namespace)}${CONSUMER_ROLE_SUFFIX}`\n\nexport const DEFINITION_FILE_EXTENSIONS = ['.yml', '.yaml'] as const\n\n/** Reserved basenames for the namespace-level config file (description, org capability pins). */\nexport const NAMESPACE_CONFIG_FILENAMES = new Set(['namespace.yaml', 'namespace.yml'])\n\nexport const HASH_DOMAIN = 'sequence-orm-definitions\\0'\n\n/**\n * A per-file byte cap where the loader reads untrusted YAML into memory — a real failure mode, not a product\n * limit. Counts of tables/indexes/params and policy/SQL lengths are\n * deliberately uncapped; Postgres enforces its own limits loudly at apply.\n */\nexport const MAX_DEFINITION_FILE_BYTES = 1024 * 1024\n\n/** Generated SDL aggregates every table/view; it is not an individual source file. */\nexport const MAX_GENERATED_SDL_BYTES = 16 * 1024 * 1024\n\n/** Registration and reviewed exports carry SDL, canonical metadata, snapshots and migrations. */\nexport const ORM_REGISTRATION_MAX_BYTES = 64 * 1024 * 1024\n\n/** `/api/data/<ns>/actions/…` and `/api/data/<ns>/query` share the table path segment. */\nexport const RESERVED_TABLE_NAMES = new Set(['actions', 'query'])\n\n/**\n * The Data API's query-string grammar owns these parameter names — a column\n * with one of them could never be filtered over the wire, so definitions\n * refuse it up front (\"validate rejects only what can never work\").\n */\nexport const RESERVED_COLUMN_NAMES = new Set(['select', 'order', 'limit', 'offset'])\n\n/**\n * Per-cell metadata (`cellMetadata: true`, and every resolved-table source) is\n * stored as typed system columns beside each tracked column `c`:\n *\n *  - `c__at`  timestamptz — when the cell was last written (NULL: never / no opinion)\n *  - `c__by`  text        — who wrote it\n *  - `c__rev` uuid        — a resolved table's manual source only: the edit's\n *                           identity, so an async writeback confirmation clears\n *                           only the exact edit it delivered\n *\n * A resolved view additionally exposes, per resolved column, the winner's\n * `c__src` (source name) and `c__lost` (newer candidates that lost, jsonb).\n * None of these are GraphQL columns: they surface through the typed `cells`\n * object and are never client-writable.\n */\nexport const CELL_PARTS = ['at', 'by', 'rev', 'source', 'conflicts'] as const\nexport type CellPart = (typeof CELL_PARTS)[number]\nexport const CELL_PART_SUFFIX: Readonly<Record<CellPart, string>> = {\n  at: '__at', by: '__by', rev: '__rev', source: '__src', conflicts: '__lost',\n}\n/** Longest physical column name that can carry cell parts (63 minus the longest suffix). */\nexport const MAX_TRACKED_COLUMN_NAME = MAX_IDENTIFIER_LENGTH - 6\n/** GraphQL field carrying a row's per-cell metadata object. */\nexport const CELLS_FIELD = 'cells'\n\n/** Physical (and logical) name of one cell part of a column. */\nexport function cellColumnName(column: string, part: CellPart): string {\n  return `${column}${CELL_PART_SUFFIX[part]}`\n}\n\n/**\n * Actor recorded when the data plane computes a materialized resolved table's\n * rows for every caller. Its claims are what the compute view's synced\n * sources see (materialized ETL sources must be readable by anyone).\n */\nexport const MATERIALIZE_ACTOR = 'orm:materialize'\nexport const MATERIALIZE_CLAIMS_JSON = JSON.stringify({ sub: MATERIALIZE_ACTOR, org: null, roles: [], capabilities: [] })\n\n/**\n * Apply-generated function that reconciles a materialized resolved table with\n * its compute view: `SELECT * FROM orm_<ns>.\"<table>__refresh\"(wait)` returns\n * `(upserted, deleted, locked)`; without `wait` it skips when another refresh\n * holds the table's lock. The one refresh implementation — the Atlas\n * reconcile, the post-ETL hook, and an operator in psql all call it.\n */\nexport function materializedRefreshFunctionName(table: string): string {\n  return `${table}__refresh`\n}\n\n/**\n * Advisory-lock key serializing a materialized table's refreshes (hashed with\n * `hashtext`). A full refresh holds it exclusively and every ORM write's\n * per-row refresh holds it shared, both before reading the compute view — so\n * a full refresh never reads a snapshot older than a write it then overwrites.\n */\nexport function materializeLockKey(schema: string, table: string): string {\n  return `orm:materialize:${schema}.${table}`\n}\n","export class OrmClientError extends Error {\n  override readonly name: string = 'OrmClientError'\n\n  constructor(message: string, readonly status: number | null = null) {\n    super(message)\n  }\n}\n\nexport interface OperationErrorEntry {\n  readonly message: string\n  readonly extensions?: { readonly code?: string }\n}\n\nexport class OrmOperationError extends OrmClientError {\n  override readonly name = 'OrmOperationError'\n\n  constructor(\n    message: string,\n    status: number | null,\n    readonly code: string | null,\n    readonly errors: readonly OperationErrorEntry[] = [],\n  ) {\n    super(message, status)\n  }\n}\n","/**\n * Fetch-based transport for the Data API. Deliberately free of node builtins\n * so the client runs anywhere a `fetch` exists — browsers, artifact bridges,\n * Cloud Functions, `node:vm` sandboxes.\n */\nimport { ORM_DATA_TOKEN_HEADER } from '../constants.js'\n\nimport { OrmClientError } from './errors.js'\nexport { OrmClientError } from './errors.js'\n\nexport interface OrmTransport {\n  get(path: string, params: URLSearchParams): Promise<unknown>\n  post(path: string, body: unknown): Promise<unknown>\n}\n\nexport function createFetchTransport({\n  baseUrl,\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: {\n  baseUrl: string\n  /** App-user / session bearer → `Authorization: Bearer`. */\n  getToken?: () => Promise<string | null> | string | null\n  /** Delegated, attenuated function token → the `ORM_DATA_TOKEN_HEADER`. */\n  getDataToken?: () => Promise<string | null> | string | null\n  fetchImpl?: typeof globalThis.fetch\n}): OrmTransport {\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n\n  const request = async (path: string, init: Omit<RequestInit, 'headers'>): Promise<unknown> => {\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    // The delegated token rides its own header; the app-user bearer rides Authorization.\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    const response = await fetchImpl(`${root}${path}`, {\n      ...init,\n      headers: { ...auth, 'Content-Type': 'application/json' },\n    })\n    const payload: unknown = await response.json().catch(() => null)\n    if (!response.ok) {\n      const detail =\n        payload && typeof payload === 'object' && 'detail' in payload\n          ? String((payload as { detail: unknown }).detail)\n          : `HTTP ${response.status}`\n      throw new OrmClientError(detail, response.status)\n    }\n    return payload\n  }\n\n  return {\n    get: (path, params) => {\n      // Not params.size — that's Node 19.8+/2023-browser surface, newer than\n      // the fetch this module documents as its only requirement.\n      const serialized = params.toString()\n      return request(serialized === '' ? path : `${path}?${serialized}`, {})\n    },\n    post: (path, body) => request(path, { method: 'POST', body: JSON.stringify(body ?? {}) }),\n  }\n}\n","import { OrmClientError, type OrmTransport } from './transport.js'\n\n/**\n * Fluent read query over one table. Serializes to exactly the PostgREST\n * subset the Data API's query parser accepts — the round-trip contract is\n * asserted server-side (builder output → parseReadQuery) so the two ends\n * can't drift apart silently.\n *\n * IMMUTABLE: every method returns a new query, so narrowing `select()` can\n * never leave an alias holding a stale wider row type, and a base query can\n * be safely forked into variants.\n */\n\nexport type FilterValue = string | number | boolean\n\nexport interface ReadResponse<Row> {\n  readonly rows: readonly Row[]\n  readonly limit: number\n  readonly offset: number\n}\n\n/** Characters the in-list grammar cannot carry — there is no escaping, so the builder hard-fails. */\nconst IN_LIST_UNREPRESENTABLE = /[,()]/\n\ninterface QueryState {\n  readonly filters: ReadonlyArray<[column: string, expression: string]>\n  readonly orderings: readonly string[]\n  readonly selection: readonly string[] | null\n  readonly limitValue: number | null\n  readonly offsetValue: number | null\n}\n\nconst EMPTY_STATE: QueryState = {\n  filters: [],\n  orderings: [],\n  selection: null,\n  limitValue: null,\n  offsetValue: null,\n}\n\n/**\n * `Row` is the TABLE's row (filters and order always accept every column);\n * `Result` is what rows() yields — narrowed by select(), re-widenable by a\n * later select() since keys always come from Row.\n */\nexport class TableQuery<Row extends Record<string, unknown>, Result = Row> {\n  constructor(\n    private readonly transport: OrmTransport,\n    private readonly namespace: string,\n    private readonly table: string,\n    private readonly state: QueryState = EMPTY_STATE,\n  ) {}\n\n  private with(patch: Partial<QueryState>): TableQuery<Row, Result> {\n    return new TableQuery(this.transport, this.namespace, this.table, { ...this.state, ...patch })\n  }\n\n  select<K extends keyof Row & string>(...columns: [K, ...K[]]): TableQuery<Row, Pick<Row, K>> {\n    return new TableQuery<Row, Pick<Row, K>>(this.transport, this.namespace, this.table, {\n      ...this.state,\n      selection: columns,\n    })\n  }\n\n  eq<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'eq', value)\n  }\n\n  ne<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'ne', value)\n  }\n\n  gt<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'gt', value)\n  }\n\n  gte<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'gte', value)\n  }\n\n  lt<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'lt', value)\n  }\n\n  lte<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'lte', value)\n  }\n\n  like<K extends keyof Row & string>(column: K, pattern: string): TableQuery<Row, Result> {\n    return this.filter(column, 'like', pattern)\n  }\n\n  ilike<K extends keyof Row & string>(column: K, pattern: string): TableQuery<Row, Result> {\n    return this.filter(column, 'ilike', pattern)\n  }\n\n  in<K extends keyof Row & string>(column: K, values: readonly FilterValue[]): TableQuery<Row, Result> {\n    // An empty list is representable — `in.()` matches nothing, the same\n    // semantics the server executes. Blank entries are legitimate values in\n    // multi-entry lists (`in.(a,)` carries ['a','']), but a LONE '' renders\n    // as `in.()` and silently becomes the empty list — unrepresentable.\n    // Beyond that only characters the grammar can't escape, and whitespace\n    // padding the server-side split would silently swallow, are refused.\n    const rendered = values.map((value) => {\n      const text = String(value)\n      if (IN_LIST_UNREPRESENTABLE.test(text) || text !== text.trim()) {\n        throw new OrmClientError(`in() value '${text}' cannot be represented — the list grammar has no escaping`)\n      }\n      return text\n    })\n    if (rendered.length === 1 && rendered[0] === '') {\n      throw new OrmClientError(\"in() with a lone '' cannot be represented — it would read as the empty list\")\n    }\n    return this.with({ filters: [...this.state.filters, [column, `in.(${rendered.join(',')})`]] })\n  }\n\n  is<K extends keyof Row & string>(column: K, value: null | boolean): TableQuery<Row, Result> {\n    return this.with({\n      filters: [...this.state.filters, [column, `is.${value === null ? 'null' : value}`]],\n    })\n  }\n\n  order<K extends keyof Row & string>(column: K, direction: 'asc' | 'desc' = 'asc'): TableQuery<Row, Result> {\n    return this.with({ orderings: [...this.state.orderings, `${column}.${direction}`] })\n  }\n\n  limit(value: number): TableQuery<Row, Result> {\n    return this.with({ limitValue: value })\n  }\n\n  offset(value: number): TableQuery<Row, Result> {\n    return this.with({ offsetValue: value })\n  }\n\n  /** The exact query string sent to the Data API — exposed for debugging and the grammar contract test. */\n  searchParams(): URLSearchParams {\n    const params = new URLSearchParams()\n    for (const [column, expression] of this.state.filters) params.append(column, expression)\n    if (this.state.orderings.length > 0) params.set('order', this.state.orderings.join(','))\n    if (this.state.selection) params.set('select', this.state.selection.join(','))\n    if (this.state.limitValue !== null) params.set('limit', String(this.state.limitValue))\n    if (this.state.offsetValue !== null) params.set('offset', String(this.state.offsetValue))\n    return params\n  }\n\n  async rows(): Promise<Result[]> {\n    const payload = await this.transport.get(\n      `/api/data/${this.namespace}/${this.table}`,\n      this.searchParams(),\n    )\n    if (!payload || typeof payload !== 'object' || !Array.isArray((payload as { rows?: unknown }).rows)) {\n      throw new OrmClientError('unexpected Data API response shape — missing rows array')\n    }\n    return (payload as { rows: Result[] }).rows\n  }\n\n  private filter(column: string, op: string, value: FilterValue): TableQuery<Row, Result> {\n    return this.with({ filters: [...this.state.filters, [column, `${op}.${String(value)}`]] })\n  }\n}\n","import { OrmOperationError, type OperationErrorEntry } from './errors.js'\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction isOperationError(value: unknown): value is OperationErrorEntry {\n  if (!isRecord(value) || typeof value.message !== 'string') return false\n  if (value.extensions === undefined) return true\n  return isRecord(value.extensions) && (value.extensions.code === undefined || typeof value.extensions.code === 'string')\n}\n\nexport function readOperationResponse<TData>({\n  ok, status, body,\n}: { ok: boolean; status: number; body: unknown }): TData {\n  const payload = isRecord(body) ? body : null\n  const rawErrors = payload?.errors\n  if (rawErrors !== undefined && (!Array.isArray(rawErrors) || !rawErrors.every(isOperationError))) {\n    throw new OrmOperationError('malformed response: invalid errors', status, null)\n  }\n  const errors: OperationErrorEntry[] = rawErrors ?? []\n  if (!ok || errors.length > 0) {\n    const first = errors[0]\n    throw new OrmOperationError(first?.message ?? `HTTP ${status}`, status, first?.extensions?.code ?? null, errors)\n  }\n  if (!payload || payload.data === undefined || payload.data === null) {\n    throw new OrmOperationError('malformed response: missing data', status, null)\n  }\n  if (!isRecord(payload.data)) {\n    throw new OrmOperationError('malformed response: data must be an object', status, null)\n  }\n  // Generated consumer types describe operation data; envelope validation\n  // cannot prove an application's selection-specific TData at runtime.\n  return payload.data as TData\n}\n\n/** Only expose data together with a validated, opaque source receipt. */\nexport function readOperationResponseWithReceipt<TData>({\n  ok, status, body, expectedSourceGeneration,\n}: { ok: boolean; status: number; body: unknown; expectedSourceGeneration?: string }): { data: TData; sourceGeneration: string } {\n  const data = readOperationResponse<TData>({ ok, status, body })\n  const extensions = isRecord(body) && isRecord(body.extensions) ? body.extensions : null\n  const sourceGeneration = extensions?.sourceGeneration\n  if (typeof sourceGeneration !== 'string' || !/^[a-f0-9]{64}$/.test(sourceGeneration)\n    || (expectedSourceGeneration !== undefined && expectedSourceGeneration !== sourceGeneration)) {\n    // Missing and changed receipts are indistinguishable; do not expose either token.\n    throw new OrmOperationError('Source generation unavailable', status, 'OBJECT_UNAVAILABLE')\n  }\n  return { data, sourceGeneration }\n}\n","/** Runtime SQL inputs are values, never interpolated into the submitted SQL. */\n// SHA-256 of \"sequence-orm-builtin-sql-read-v1\". This identifies server-owned\n// behavior, independent of a namespace's authored operation manifest.\nexport const BUILTIN_SQL_READ_HASH = 'sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258'\n\nexport type SqlQueryParameter =\n  | { type: 'text' | 'uuid' | 'date' | 'timestamptz' | 'numeric' | 'bigint'; value: string | null }\n  | { type: 'integer' | 'double'; value: number | null }\n  | { type: 'boolean'; value: boolean | null }\n\nexport type SqlQueryVariables = {\n  sql: string\n  parameters?: Record<string, SqlQueryParameter>\n}\n\nexport interface SqlQueryResult {\n  columns: Array<{ name: string; type: string; nullable: boolean }>\n  rows: Array<Array<string | number | boolean | null>>\n  truncated: boolean\n}\n","/**\n * Persisted-operation client for the v2 data plane. The wire carries only\n * `{ op: <hash>, variables, idempotencyKey?, expectedSourceGeneration? }`. Runtime SQL contracts accept SQL in variables;\n * GraphQL and fixed SQL operations keep their documents server-side. This runtime\n * is deliberately free of node builtins and third-\n * party deps (no @apollo/client import): Apollo integration happens through a\n * fetch-compatible shim (`createOrmFetch`) handed to `HttpLink({ fetch })`.\n */\nimport { OrmClientError } from './errors.js'\nimport { readOperationResponse, readOperationResponseWithReceipt } from './response.js'\nimport { ORM_DATA_TOKEN_HEADER } from '../constants.js'\nimport { BUILTIN_SQL_READ_HASH, type SqlQueryVariables, type SqlQueryResult } from './sql.js'\n\nexport { OrmOperationError, type OperationErrorEntry } from './errors.js'\n\n/** One entry of `operations.manifest.json` (generated by `orm generate`). */\nexport interface ManifestOperation {\n  readonly hash: string\n  readonly kind: 'query' | 'mutation'\n  readonly requires: { readonly capability?: string; readonly role?: string } | null\n}\n\nexport interface OperationsManifest {\n  readonly schemaHash: string\n  readonly opsHash?: string\n  readonly operations: Readonly<Record<string, ManifestOperation>>\n}\n\nexport interface OperationExecutorConfig {\n  /** Deployment host root, e.g. `https://atlas.seqholdings.com`. */\n  baseUrl: string\n  namespace: string\n  manifest?: OperationsManifest\n  /** App-user / session bearer → `Authorization: Bearer`. */\n  getToken?: () => Promise<string | null> | string | null\n  /** Delegated, attenuated function token → the `ORM_DATA_TOKEN_HEADER`. */\n  getDataToken?: () => Promise<string | null> | string | null\n  fetchImpl?: typeof globalThis.fetch\n}\n\nexport interface OperationExecutionOptions {\n  /** Reuse only when retrying the same logical mutation. */\n  idempotencyKey?: string\n  /** Require the same source publication as an earlier read receipt. */\n  expectedSourceGeneration?: string\n}\n\nexport function validateIdempotencyKey(key: string | undefined): void {\n  if (key !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(key)) {\n    throw new OrmClientError('idempotencyKey must be 1–128 letters, digits, dots, underscores, colons or hyphens')\n  }\n}\n\nexport function validateExpectedSourceGeneration(value: string | undefined): void {\n  if (value !== undefined && (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value))) {\n    throw new OrmClientError('expectedSourceGeneration must be a lowercase 64-character hexadecimal receipt')\n  }\n}\n\nexport interface OperationExecutor {\n  /** Execute a manifest operation by name (or a raw `sha256:` hash). */\n  execute<TData = Record<string, unknown>>(\n    op: string,\n    variables?: Record<string, unknown>,\n    options?: OperationExecutionOptions,\n  ): Promise<TData>\n}\n\n/** Additive factory result; existing host wrappers implementing OperationExecutor remain valid. */\nexport interface SqlOperationExecutor extends OperationExecutor {\n  /** Default read-only ontology SQL; no authored operation or manifest needed. */\n  sql(variables: SqlQueryVariables): Promise<SqlQueryResult>\n}\n\nexport interface TypedOperationExecutor extends OperationExecutor {\n  execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n}\n\n/** Factory result adds SQL without requiring it on existing typed host wrappers. */\nexport type TypedSqlOperationExecutor = TypedOperationExecutor & SqlOperationExecutor\n\nexport interface OperationReadReceipt<TData> {\n  readonly data: TData\n  /** Opaque source-publication identity; never an authorization credential. */\n  readonly sourceGeneration: string\n}\n\nexport interface ReadReceiptOperationExecutor extends OperationExecutor {\n  /** Execute a registered query or built-in SQL read; fail closed without a receipt. */\n  executeWithReadReceipt<TData = Record<string, unknown>>(\n    op: string,\n    variables?: Record<string, unknown>,\n    options?: OperationExecutionOptions,\n  ): Promise<OperationReadReceipt<TData>>\n}\n\n/** Additive factories preserve existing host wrappers without receipt support. */\nexport type ReadReceiptSqlOperationExecutor = SqlOperationExecutor & ReadReceiptOperationExecutor\n\nexport interface TypedReadReceiptOperationExecutor extends TypedOperationExecutor {\n  executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n}\n\nexport type TypedReadReceiptSqlOperationExecutor = TypedReadReceiptOperationExecutor & ReadReceiptSqlOperationExecutor\n\nconst dataPlanePath = (namespace: string): string => `/_data/v2/${namespace}`\n\n/** Generated handle identifies the registered contract; optional types are phantom. */\nexport interface OperationReference<TVariables extends Record<string, unknown>, TData> {\n  readonly namespace: string\n  readonly hash: string\n  readonly variables?: TVariables\n  readonly result?: TData\n}\n\nfunction resolveOpHash(manifest: OperationsManifest, op: string): string {\n  if (op.startsWith('sha256:')) return op\n  const entry = manifest.operations[op]\n  if (!entry) {\n    const known = Object.keys(manifest.operations).sort()\n    throw new OrmClientError(\n      `unknown operation \"${op}\" — not in the manifest (${known.length} known). ` +\n        'Re-run `seq-studio orm generate` after editing graphql documents.',\n    )\n  }\n  return entry.hash\n}\n\n/** Snapshot classification and name resolution before any receipt request can dispatch. */\nexport function createReadReceiptOperationResolver({ operations }: {\n  operations: Iterable<readonly [string, Pick<ManifestOperation, 'hash' | 'kind'>]>\n}): (selection: { selector: string; hashOnly?: boolean }) => string {\n  const hashesByName = new Map<string, string>()\n  const readHashes = new Set([BUILTIN_SQL_READ_HASH])\n  const mutationHashes = new Set<string>()\n  for (const [name, entry] of operations) {\n    hashesByName.set(name, entry.hash)\n    if (entry.kind === 'query' && /^sha256:[a-f0-9]{64}$/.test(entry.hash)) readHashes.add(entry.hash)\n    if (entry.kind === 'mutation') mutationHashes.add(entry.hash)\n  }\n  return ({ selector, hashOnly = false }) => {\n    const hash = selector.startsWith('sha256:') ? selector : hashOnly ? undefined : hashesByName.get(selector)\n    if (!hash || !readHashes.has(hash) || mutationHashes.has(hash)) {\n      throw new OrmClientError('read receipts require a registered query or the built-in SQL read')\n    }\n    return hash\n  }\n}\n\nexport function createOperationExecutor({\n  baseUrl,\n  namespace,\n  manifest = { schemaHash: 'builtin', operations: {} },\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: OperationExecutorConfig): TypedReadReceiptSqlOperationExecutor {\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n  const resolveReceiptOperation = createReadReceiptOperationResolver({ operations: Object.entries(manifest.operations) })\n\n  async function request({ op, variables, options, requireReadReceipt = false }: {\n    op: string | OperationReference<Record<string, unknown>, unknown>\n    variables: Record<string, unknown>\n    options: OperationExecutionOptions\n    requireReadReceipt?: boolean\n  }): Promise<{ ok: boolean; status: number; body: unknown }> {\n    validateIdempotencyKey(options.idempotencyKey)\n    validateExpectedSourceGeneration(options.expectedSourceGeneration)\n    if (typeof op !== 'string' && op.namespace !== namespace) throw new OrmClientError('operation belongs to a different namespace')\n    const hash = requireReadReceipt\n      ? resolveReceiptOperation({ selector: typeof op === 'string' ? op : op.hash, hashOnly: typeof op !== 'string' })\n      : typeof op === 'string' ? resolveOpHash(manifest, op) : op.hash\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    const response = await fetchImpl(`${root}${dataPlanePath(namespace)}`, {\n      method: 'POST',\n      headers: { ...auth, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ op: hash, variables, idempotencyKey: options.idempotencyKey,\n        expectedSourceGeneration: options.expectedSourceGeneration }),\n    })\n    return {\n      ok: response.ok,\n      status: response.status,\n      body: await response.json().catch(() => null),\n    }\n  }\n\n  function execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  function execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n  async function execute<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<TData> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions })\n    return executionOptions.expectedSourceGeneration === undefined\n      ? readOperationResponse<TData>(response)\n      : readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration }).data\n  }\n\n  function executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  function executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  async function executeWithReadReceipt<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<OperationReadReceipt<TData>> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions, requireReadReceipt: true })\n    return readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration })\n  }\n  return { execute, executeWithReadReceipt, sql: variables => execute<SqlQueryResult>(BUILTIN_SQL_READ_HASH, variables) }\n}\n\n// ---------------------------------------------------------------------------\n// Module-level convenience for generated server functions (`db<Name>`)\n// ---------------------------------------------------------------------------\n\nlet configured: OperationExecutor | null = null\n\n/**\n * Configure the process-wide executor the generated `db<Name>` server\n * functions call through. Call once at startup (server-side); browser apps\n * should prefer Apollo + `createOrmFetch` or an explicit executor.\n */\nexport function configureOrmOperations(config: OperationExecutorConfig): OperationExecutor {\n  configured = createOperationExecutor(config)\n  return configured\n}\n\n/** Used by generated code: `executeOperation({ op: 'getOpenDeals', variables })`. */\nexport async function executeOperation<TData = Record<string, unknown>>({\n  op,\n  variables,\n  idempotencyKey,\n}: {\n  op: string\n  variables?: Record<string, unknown>\n  idempotencyKey?: string\n}): Promise<TData> {\n  if (!configured) {\n    throw new OrmClientError(\n      'ORM operations client not configured — call configureOrmOperations({ baseUrl, namespace, manifest, getToken }) at startup',\n    )\n  }\n  return configured.execute<TData>(op, variables, idempotencyKey === undefined ? {} : { idempotencyKey })\n}\n\n// ---------------------------------------------------------------------------\n// Apollo integration without an @apollo/client dependency\n// ---------------------------------------------------------------------------\n\n/**\n * A fetch-compatible function for `new HttpLink({ uri: '/unused', fetch: createOrmFetch(...) })`.\n * Intercepts Apollo's GraphQL POST, swaps the body for the persisted-op\n * envelope (`{ op: <hash>, variables }`) resolved via the manifest's\n * operationName, rewrites the URL to the data plane, and attaches auth.\n * The GraphQL-spec response body passes through untouched, so InMemoryCache\n * and error links behave exactly as they do against a GraphQL server.\n */\nexport function createOrmFetch({\n  baseUrl,\n  namespace,\n  manifest,\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: OperationExecutorConfig): typeof globalThis.fetch {\n  if (!manifest) throw new OrmClientError('createOrmFetch requires an operations manifest')\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n  const url = `${root}${dataPlanePath(namespace)}`\n\n  // Derived from `globalThis.fetch` rather than naming `RequestInfo` (a DOM-lib\n  // global this module compiles without). The input is ignored — Apollo's\n  // HttpLink calls the injected fetch with a string URI, and the real target\n  // URL is fixed at `url` above.\n  return async (_input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit): Promise<Response> => {\n    const raw = typeof init?.body === 'string' ? init.body : null\n    const parsed = raw\n      ? (JSON.parse(raw) as { operationName?: string; variables?: Record<string, unknown> })\n      : {}\n    const name = parsed.operationName\n    if (!name) {\n      throw new OrmClientError(\n        'createOrmFetch requires named operations (Apollo sends operationName for named documents)',\n      )\n    }\n    const hash = resolveOpHash(manifest, name)\n    const idempotencyKey = new Headers(init?.headers).get('Idempotency-Key') ?? undefined\n    validateIdempotencyKey(idempotencyKey)\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    return fetchImpl(url, {\n      method: 'POST',\n      headers: { ...auth, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ op: hash, variables: parsed.variables ?? {}, idempotencyKey }),\n      ...(init?.signal ? { signal: init.signal } : {}),\n    })\n  }\n}\n","import { NAMESPACE_PATTERN } from '../constants.js'\nimport { OrmClientError, OrmOperationError } from './errors.js'\nimport {\n  validateIdempotencyKey, validateExpectedSourceGeneration, createReadReceiptOperationResolver,\n  type ManifestOperation,\n  type TypedReadReceiptSqlOperationExecutor, type OperationReadReceipt, type OperationReference, type OperationExecutionOptions,\n} from './operations.js'\nimport { isRecord, readOperationResponse, readOperationResponseWithReceipt } from './response.js'\nimport { BUILTIN_SQL_READ_HASH, type SqlQueryResult } from './sql.js'\n\nexport interface OperationTransportRequest {\n  namespace: string\n  op: string\n  variables: Record<string, unknown>\n  idempotencyKey?: string\n  expectedSourceGeneration?: string\n}\n\nexport interface OperationTransportResponse {\n  ok: boolean\n  status: number\n  body: unknown\n}\n\nexport type OperationTransport = (request: OperationTransportRequest) => Promise<OperationTransportResponse>\n\nconst operationHash = /^sha256:[a-f0-9]{64}$/\n\nfunction readManifestHashes(manifest: unknown): ReadonlyMap<string, Pick<ManifestOperation, 'hash' | 'kind'>> {\n  if (!isRecord(manifest) || typeof manifest.schemaHash !== 'string' || !manifest.schemaHash || !isRecord(manifest.operations)) {\n    throw new OrmClientError('invalid operations manifest — use operations.manifest.json from seq-studio orm generate')\n  }\n  const hashes = new Map<string, Pick<ManifestOperation, 'hash' | 'kind'>>()\n  for (const [name, entry] of Object.entries(manifest.operations)) {\n    if (!/^[_A-Za-z][_0-9A-Za-z]*$/.test(name) || !isRecord(entry) || typeof entry.hash !== 'string' || !operationHash.test(entry.hash)\n      || (entry.kind !== 'query' && entry.kind !== 'mutation')) {\n      throw new OrmClientError(`invalid operations manifest entry \"${name}\" — regenerate the manifest`)\n    }\n    hashes.set(name, { hash: entry.hash, kind: entry.kind })\n  }\n  return hashes\n}\n\n/**\n * Execute generated operations through a host-owned authenticated transport.\n * No credential handling, retries, or global configuration. The manifest is\n * validated once and copied, so later caller mutation cannot alter the target.\n */\nexport function createOperationExecutorWithTransport({ namespace, manifest, transport }: {\n  namespace: string\n  /** Accept generated JSON imports directly; validate them at construction. */\n  manifest?: unknown\n  transport: OperationTransport\n}): TypedReadReceiptSqlOperationExecutor {\n  if (typeof namespace !== 'string' || !NAMESPACE_PATTERN.test(namespace)) throw new OrmClientError('invalid ORM namespace — expected a lowercase identifier of at most 41 characters')\n  const hashes = manifest === undefined ? new Map<string, Pick<ManifestOperation, 'hash' | 'kind'>>() : readManifestHashes(manifest)\n  const knownHashes = new Set([...hashes.values()].map(entry => entry.hash))\n  const resolveReceiptOperation = createReadReceiptOperationResolver({ operations: hashes })\n  async function request({ op, variables, options, requireReadReceipt = false }: {\n    op: string | OperationReference<Record<string, unknown>, unknown>\n    variables: Record<string, unknown>\n    options: OperationExecutionOptions\n    requireReadReceipt?: boolean\n  }): Promise<OperationTransportResponse> {\n    validateIdempotencyKey(options.idempotencyKey)\n    validateExpectedSourceGeneration(options.expectedSourceGeneration)\n    if (typeof op !== 'string' && op.namespace !== namespace) throw new OrmClientError('operation belongs to a different namespace')\n    const selector = typeof op === 'string' ? op : op.hash\n    const hash = requireReadReceipt\n      ? resolveReceiptOperation({ selector, hashOnly: typeof op !== 'string' })\n      : selector === BUILTIN_SQL_READ_HASH ? selector : hashes.get(selector)?.hash ?? (knownHashes.has(selector) ? selector : undefined)\n    if (!hash) throw new OrmClientError(`unknown operation \"${op}\" — not in the manifest (${hashes.size} known). Re-run seq-studio orm generate.`)\n    if (!isRecord(variables)) throw new OrmClientError('operation variables must be an object')\n    const response = await transport({ namespace, op: hash, variables,\n      ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),\n      ...(options.expectedSourceGeneration === undefined ? {} : { expectedSourceGeneration: options.expectedSourceGeneration }),\n    })\n    if (!response || typeof response.ok !== 'boolean' || !Number.isInteger(response.status) || response.status < 100 || response.status > 599\n      || response.ok !== (response.status >= 200 && response.status < 300)) {\n      throw new OrmOperationError('malformed transport response', null, null)\n    }\n    return response\n  }\n\n  function execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  function execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n  async function execute<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<TData> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions })\n    return executionOptions.expectedSourceGeneration === undefined\n      ? readOperationResponse<TData>(response)\n      : readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration }).data\n  }\n\n  function executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  function executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  async function executeWithReadReceipt<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<OperationReadReceipt<TData>> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions, requireReadReceipt: true })\n    return readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration })\n  }\n  return { execute, executeWithReadReceipt, sql: variables => execute<SqlQueryResult>(BUILTIN_SQL_READ_HASH, variables) }\n}\n","import { OrmClientError, createFetchTransport, type OrmTransport } from './transport.js'\nimport { TableQuery } from './query-builder.js'\n\n/** Bindable scalar for `query()` placeholders ($1, $2, …). */\nexport type QueryParam = string | number | boolean | null\n\n/** Shape of one action in the generated `<Ns>Actions` map — params in, result out. */\nexport interface OrmActionShape {\n  readonly params?: Record<string, unknown>\n  readonly result: unknown\n}\n\n/** The generated `<Ns>Actions` map: action name → its param and result shapes. */\nexport type OrmActions = Record<string, OrmActionShape>\n\n/**\n * `action()`'s argument list: `params` is required when the action declares a\n * required field, optional otherwise. The empty-object type is assignable to\n * the params shape only when every field is optional, so that assignability is\n * the discriminant.\n */\ntype ActionArgs<Action extends OrmActionShape> =\n  Record<string, never> extends NonNullable<Action['params']>\n    ? [params?: NonNullable<Action['params']>]\n    : [params: NonNullable<Action['params']>]\n\n/**\n * Typed read client for one namespace's Data API. `Tables` comes from\n * `types.gen.ts` (wire types the apply refreshes from the YAML definitions),\n * so column names and row shapes are checked at compile time; the server\n * re-validates everything and Postgres RLS decides row visibility.\n *\n * ```ts\n * const client = createOrmClient<LendingTables>({ namespace: 'lending', baseUrl, getToken })\n * const rows = await client.table('loans').select('id', 'balance').gte('balance', 1000).rows()\n * const top = await client.query<{ officer: string; total: string }>(\n *   'select officer, sum(balance) as total from loans group by officer order by total desc limit $1',\n *   [5],\n * )\n * ```\n */\nexport interface OrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n> {\n  table<Name extends keyof Tables & string>(name: Name): TableQuery<Tables[Name]>\n  /**\n   * Raw read-only SQL for everything the filter grammar can't say —\n   * aggregates, joins, OR, expressions, CTEs. The same sandbox as every\n   * read: the namespace consumer role (grants stop at the namespace schema),\n   * Postgres RLS over the caller's claims, and a READ ONLY transaction —\n   * Postgres itself rejects writes, which stay on declared actions. Values\n   * bind as $1, $2, … placeholders; never interpolate them into the string.\n   */\n  query<Row = Record<string, unknown>>(sql: string, params?: readonly QueryParam[]): Promise<Row[]>\n  /**\n   * Invoke a declared action — the only write path the Data API exposes. The\n   * params and result are typed from the namespace's `<Ns>Actions`: an action\n   * with `returns:` resolves to `{ rows: Row[] }`, a count action to\n   * `{ rowsAffected: number }`.\n   */\n  action<Name extends keyof Actions & string>(\n    name: Name,\n    ...args: ActionArgs<Actions[Name]>\n  ): Promise<Actions[Name]['result']>\n}\n\nexport function createOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>({\n  namespace,\n  baseUrl,\n  getToken,\n  fetchImpl,\n  transport,\n  dataToken,\n}: {\n  namespace: string\n  baseUrl?: string\n  /** App-user / session bearer (CLI, browser). Mutually exclusive with dataToken. */\n  getToken?: () => Promise<string | null> | string | null\n  /**\n   * Delegated function data token — the inbound `ORM_DATA_TOKEN_HEADER` value a\n   * managed function receives. Pass it and the client authenticates as the\n   * invoking user, scoped to the function's declared refs; no manual transport.\n   */\n  dataToken?: string | (() => Promise<string | null> | string | null)\n  fetchImpl?: typeof globalThis.fetch\n  /** Injected transport (tests, bridges); overrides baseUrl/getToken/dataToken. */\n  transport?: OrmTransport\n}): OrmClient<Tables, Actions> {\n  const resolved =\n    transport ??\n    createFetchTransport({\n      baseUrl: requireOption(baseUrl, 'baseUrl'),\n      ...(dataToken !== undefined\n        ? { getDataToken: typeof dataToken === 'function' ? dataToken : () => dataToken }\n        : { getToken: requireOption(getToken, 'getToken') }),\n      fetchImpl,\n    })\n\n  return buildOrmClient<Tables, Actions>(resolved, namespace)\n}\n\n/**\n * The ESCALATION path — use only deliberately. A managed function receives a\n * separate *service* data token on `ORM_SERVICE_DATA_TOKEN_HEADER`; pass that\n * value here and the client authenticates as the function's SERVICE IDENTITY,\n * not the invoking user. Reads run with the service identity's grants (clamped\n * to the function's declared refs), NOT the caller's — so the caller's own row\n * visibility does not apply. The invoking user is still recorded for audit.\n *\n * Default to `createOrmClient` (acts as the invoking user, full per-user RLS).\n * Reach for this only when the function must intentionally act beyond the\n * caller — e.g. enforcing per-user rules in code over a coarse upstream that\n * has no granular permissions of its own. The distinct name is the guardrail:\n * choosing the service identity is always explicit and greppable.\n *\n * ```ts\n * const client = createServiceOrmClient<LendingTables>({\n *   namespace: 'lending',\n *   baseUrl,\n *   serviceDataToken: req.headers['x-sequence-data-token-service'],\n * })\n * ```\n */\nexport function createServiceOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>({\n  namespace,\n  baseUrl,\n  serviceDataToken,\n  fetchImpl,\n  transport,\n}: {\n  namespace: string\n  baseUrl?: string\n  /** The inbound `ORM_SERVICE_DATA_TOKEN_HEADER` value — the function's service token. */\n  serviceDataToken?: string | (() => Promise<string | null> | string | null)\n  fetchImpl?: typeof globalThis.fetch\n  /** Injected transport (tests, bridges); overrides baseUrl/serviceDataToken. */\n  transport?: OrmTransport\n}): OrmClient<Tables, Actions> {\n  const resolved =\n    transport ??\n    createFetchTransport({\n      baseUrl: requireOption(baseUrl, 'baseUrl'),\n      getDataToken:\n        typeof serviceDataToken === 'function'\n          ? serviceDataToken\n          : () => requireOption(serviceDataToken, 'serviceDataToken'),\n      fetchImpl,\n    })\n\n  return buildOrmClient<Tables, Actions>(resolved, namespace)\n}\n\n/** Shared client surface over a resolved transport — the token/identity choice is made by the factory above. */\nfunction buildOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>(resolved: OrmTransport, namespace: string): OrmClient<Tables, Actions> {\n  return {\n    table(name) {\n      return new TableQuery(resolved, namespace, name)\n    },\n    async query(sql, params) {\n      const payload = await resolved.post(`/api/data/${namespace}/query`, {\n        sql,\n        ...(params ? { params: [...params] } : {}),\n      })\n      if (!payload || typeof payload !== 'object' || !Array.isArray((payload as { rows?: unknown }).rows)) {\n        throw new OrmClientError('unexpected Data API response shape — missing rows array')\n      }\n      return (payload as { rows: never[] }).rows\n    },\n    async action(name, ...args) {\n      const payload = await resolved.post(`/api/data/${namespace}/actions/${name}`, args[0] ?? {})\n      if (payload && typeof payload === 'object') {\n        // A returns action responds with `rows`; a count action with\n        // `rows_affected` (mapped to `rowsAffected` for the client).\n        if (Array.isArray((payload as { rows?: unknown }).rows)) {\n          return { rows: (payload as { rows: unknown[] }).rows } as Awaited<ReturnType<OrmClient<Tables, Actions>['action']>>\n        }\n        if ('rows_affected' in payload) {\n          const rowsAffected = Number((payload as { rows_affected: unknown }).rows_affected)\n          if (!Number.isNaN(rowsAffected)) {\n            return { rowsAffected } as Awaited<ReturnType<OrmClient<Tables, Actions>['action']>>\n          }\n        }\n      }\n      throw new OrmClientError('unexpected action response shape — expected rows or rows_affected')\n    },\n  }\n}\n\nfunction requireOption<T>(value: T | undefined, name: string): T {\n  if (value === undefined) throw new Error(`createOrmClient requires ${name} when no transport is injected`)\n  return value\n}\n\nexport { TableQuery, type FilterValue, type ReadResponse } from './query-builder.js'\nexport { createFetchTransport, OrmClientError, type OrmTransport } from './transport.js'\n\nexport {\n  OrmOperationError,\n  configureOrmOperations,\n  createOperationExecutor,\n  createOrmFetch,\n  executeOperation,\n} from './operations.js'\nexport type {\n  ManifestOperation,\n  OperationErrorEntry,\n  OperationExecutor,\n  SqlOperationExecutor,\n  OperationReference,\n  TypedOperationExecutor,\n  TypedSqlOperationExecutor,\n  ReadReceiptOperationExecutor,\n  ReadReceiptSqlOperationExecutor,\n  TypedReadReceiptOperationExecutor,\n  TypedReadReceiptSqlOperationExecutor,\n  OperationReadReceipt,\n  OperationExecutionOptions,\n  OperationExecutorConfig,\n  OperationsManifest,\n} from './operations.js'\n\nexport { NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SERVICE_DATA_TOKEN_HEADER } from '../constants.js'\nexport type { SqlQueryParameter, SqlQueryVariables, SqlQueryResult } from './sql.js'\nexport { BUILTIN_SQL_READ_HASH } from './sql.js'\nexport {\n  createOperationExecutorWithTransport,\n  type OperationTransport, type OperationTransportRequest, type OperationTransportResponse,\n} from './transport-executor.js'\n"]}
+{"version":3,"sources":["../src/constants.ts","../src/client/errors.ts","../src/client/transport.ts","../src/client/query-builder.ts","../src/client/response.ts","../src/client/sql.ts","../src/client/operations.ts","../src/client/transport-executor.ts","../src/client/index.ts"],"names":[],"mappings":";AAIO,IAAM,iBAAA,GAAoB;AAG1B,IAAM,qBAAA,GAAwB;AAG9B,IAAM,6BAAA,GAAgC;AAwGtC,IAAM,iBAAA,GAAoB,iBAAA;AACM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAK,iBAAA,EAAmB,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,EAAC,EAAG,YAAA,EAAc,IAAI;;;ACnHjH,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAGxC,WAAA,CAAY,OAAA,EAA0B,MAAA,GAAwB,IAAA,EAAM;AAClE,IAAA,KAAA,CAAM,OAAO,CAAA;AADuB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAEtC;AAAA,EAJkB,IAAA,GAAe,gBAAA;AAKnC;AAOO,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EAGpD,YACE,OAAA,EACA,MAAA,EACS,IAAA,EACA,MAAA,GAAyC,EAAC,EACnD;AACA,IAAA,KAAA,CAAM,SAAS,MAAM,CAAA;AAHZ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAGX;AAAA,EATkB,IAAA,GAAO,mBAAA;AAU3B;;;ACTO,SAAS,oBAAA,CAAqB;AAAA,EACnC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAOiB;AACf,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAc,IAAA,KAAyD;AAC5F,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAE7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,MAAM,WAAW,MAAM,SAAA,CAAU,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACjD,GAAG,IAAA;AAAA,MACH,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA;AAAmB,KACxD,CAAA;AACD,IAAA,MAAM,UAAmB,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/D,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAA,GACJ,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,QAAA,IAAY,OAAA,GAClD,MAAA,CAAQ,OAAA,CAAgC,MAAM,CAAA,GAC9C,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,CAAA;AAC7B,MAAA,MAAM,IAAI,cAAA,CAAe,MAAA,EAAQ,QAAA,CAAS,MAAM,CAAA;AAAA,IAClD;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,IAAA,EAAM,MAAA,KAAW;AAGrB,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,EAAS;AACnC,MAAA,OAAO,OAAA,CAAQ,UAAA,KAAe,EAAA,GAAK,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,IACvE,CAAA;AAAA,IACA,MAAM,CAAC,IAAA,EAAM,IAAA,KAAS,OAAA,CAAQ,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,KAAK,SAAA,CAAU,IAAA,IAAQ,EAAE,GAAG;AAAA,GAC1F;AACF;;;AC5CA,IAAM,uBAAA,GAA0B,OAAA;AAUhC,IAAM,WAAA,GAA0B;AAAA,EAC9B,SAAS,EAAC;AAAA,EACV,WAAW,EAAC;AAAA,EACZ,SAAA,EAAW,IAAA;AAAA,EACX,UAAA,EAAY,IAAA;AAAA,EACZ,WAAA,EAAa;AACf,CAAA;AAOO,IAAM,UAAA,GAAN,MAAM,WAAA,CAA8D;AAAA,EACzE,WAAA,CACmB,SAAA,EACA,SAAA,EACA,KAAA,EACA,QAAoB,WAAA,EACrC;AAJiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAChB;AAAA,EAEK,KAAK,KAAA,EAAqD;AAChE,IAAA,OAAO,IAAI,WAAA,CAAW,IAAA,CAAK,SAAA,EAAW,KAAK,SAAA,EAAW,IAAA,CAAK,KAAA,EAAO,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,OAAO,CAAA;AAAA,EAC/F;AAAA,EAEA,UAAwC,OAAA,EAAqD;AAC3F,IAAA,OAAO,IAAI,WAAA,CAA8B,IAAA,CAAK,WAAW,IAAA,CAAK,SAAA,EAAW,KAAK,KAAA,EAAO;AAAA,MACnF,GAAG,IAAA,CAAK,KAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,GAAA,CAAkC,QAAW,KAAA,EAA6C;AACxF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACzC;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAA6C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,KAAK,CAAA;AAAA,EACxC;AAAA,EAEA,GAAA,CAAkC,QAAW,KAAA,EAA6C;AACxF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACzC;AAAA,EAEA,IAAA,CAAmC,QAAW,OAAA,EAA0C;AACtF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5C;AAAA,EAEA,KAAA,CAAoC,QAAW,OAAA,EAA0C;AACvF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,OAAA,EAAS,OAAO,CAAA;AAAA,EAC7C;AAAA,EAEA,EAAA,CAAiC,QAAW,MAAA,EAAyD;AAOnG,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,KAAU;AACrC,MAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,MAAA,IAAI,wBAAwB,IAAA,CAAK,IAAI,KAAK,IAAA,KAAS,IAAA,CAAK,MAAK,EAAG;AAC9D,QAAA,MAAM,IAAI,cAAA,CAAe,CAAA,YAAA,EAAe,IAAI,CAAA,+DAAA,CAA4D,CAAA;AAAA,MAC1G;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAC,CAAA;AACD,IAAA,IAAI,SAAS,MAAA,KAAW,CAAA,IAAK,QAAA,CAAS,CAAC,MAAM,EAAA,EAAI;AAC/C,MAAA,MAAM,IAAI,eAAe,kFAA6E,CAAA;AAAA,IACxG;AACA,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,SAAS,CAAC,GAAG,KAAK,KAAA,CAAM,OAAA,EAAS,CAAC,MAAA,EAAQ,CAAA,IAAA,EAAO,SAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAG,CAAC,GAAG,CAAA;AAAA,EAC/F;AAAA,EAEA,EAAA,CAAiC,QAAW,KAAA,EAAgD;AAC1F,IAAA,OAAO,KAAK,IAAA,CAAK;AAAA,MACf,OAAA,EAAS,CAAC,GAAG,IAAA,CAAK,MAAM,OAAA,EAAS,CAAC,MAAA,EAAQ,CAAA,GAAA,EAAM,KAAA,KAAU,IAAA,GAAO,MAAA,GAAS,KAAK,EAAE,CAAC;AAAA,KACnF,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CAAoC,MAAA,EAAW,SAAA,GAA4B,KAAA,EAAgC;AACzG,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,SAAA,EAAW,CAAC,GAAG,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,GAAG,MAAM,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,GAAG,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,KAAA,EAAwC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,UAAA,EAAY,OAAO,CAAA;AAAA,EACxC;AAAA,EAEA,OAAO,KAAA,EAAwC;AAC7C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,EAAE,WAAA,EAAa,OAAO,CAAA;AAAA,EACzC;AAAA;AAAA,EAGA,YAAA,GAAgC;AAC9B,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,IAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,UAAU,CAAA,IAAK,IAAA,CAAK,MAAM,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,MAAA,EAAQ,UAAU,CAAA;AACvF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA;AACvF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC,CAAA;AAC7E,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,UAAA,KAAe,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,CAAA;AACrF,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,WAAA,KAAgB,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,WAAW,CAAC,CAAA;AACxF,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,GAA0B;AAC9B,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MACnC,CAAA,UAAA,EAAa,IAAA,CAAK,SAAS,CAAA,CAAA,EAAI,KAAK,KAAK,CAAA,CAAA;AAAA,MACzC,KAAK,YAAA;AAAa,KACpB;AACA,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACnG,MAAA,MAAM,IAAI,eAAe,8DAAyD,CAAA;AAAA,IACpF;AACA,IAAA,OAAQ,OAAA,CAA+B,IAAA;AAAA,EACzC;AAAA,EAEQ,MAAA,CAAO,MAAA,EAAgB,EAAA,EAAY,KAAA,EAA6C;AACtF,IAAA,OAAO,IAAA,CAAK,KAAK,EAAE,OAAA,EAAS,CAAC,GAAG,IAAA,CAAK,MAAM,OAAA,EAAS,CAAC,QAAQ,CAAA,EAAG,EAAE,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAC,GAAG,CAAA;AAAA,EAC3F;AACF;;;AC7JO,SAAS,SAAS,KAAA,EAAkD;AACzE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,iBAAiB,KAAA,EAA8C;AACtE,EAAA,IAAI,CAAC,SAAS,KAAK,CAAA,IAAK,OAAO,KAAA,CAAM,OAAA,KAAY,UAAU,OAAO,KAAA;AAClE,EAAA,IAAI,KAAA,CAAM,UAAA,KAAe,MAAA,EAAW,OAAO,IAAA;AAC3C,EAAA,OAAO,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,KAAM,KAAA,CAAM,UAAA,CAAW,IAAA,KAAS,MAAA,IAAa,OAAO,KAAA,CAAM,UAAA,CAAW,IAAA,KAAS,QAAA,CAAA;AAChH;AAEO,SAAS,qBAAA,CAA6B;AAAA,EAC3C,EAAA;AAAA,EAAI,MAAA;AAAA,EAAQ;AACd,CAAA,EAA0D;AACxD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,IAAI,CAAA,GAAI,IAAA,GAAO,IAAA;AACxC,EAAA,MAAM,YAAY,OAAA,EAAS,MAAA;AAC3B,EAAA,IAAI,SAAA,KAAc,MAAA,KAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA,CAAA,EAAI;AAChG,IAAA,MAAM,IAAI,iBAAA,CAAkB,oCAAA,EAAsC,MAAA,EAAQ,IAAI,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,MAAA,GAAgC,aAAa,EAAC;AACpD,EAAA,IAAI,CAAC,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC5B,IAAA,MAAM,KAAA,GAAQ,OAAO,CAAC,CAAA;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,KAAA,EAAO,OAAA,IAAW,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,UAAA,EAAY,IAAA,IAAQ,IAAA,EAAM,MAAM,CAAA;AAAA,EACjH;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,SAAS,MAAA,IAAa,OAAA,CAAQ,SAAS,IAAA,EAAM;AACnE,IAAA,MAAM,IAAI,iBAAA,CAAkB,kCAAA,EAAoC,MAAA,EAAQ,IAAI,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,iBAAA,CAAkB,4CAAA,EAA8C,MAAA,EAAQ,IAAI,CAAA;AAAA,EACxF;AAGA,EAAA,OAAO,OAAA,CAAQ,IAAA;AACjB;AAGO,SAAS,gCAAA,CAAwC;AAAA,EACtD,EAAA;AAAA,EAAI,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM;AACpB,CAAA,EAAiI;AAC/H,EAAA,MAAM,OAAO,qBAAA,CAA6B,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,SAAS,IAAI,CAAA,IAAK,SAAS,IAAA,CAAK,UAAU,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa,IAAA;AACnF,EAAA,MAAM,mBAAmB,UAAA,EAAY,gBAAA;AACrC,EAAA,IAAI,OAAO,gBAAA,KAAqB,QAAA,IAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,gBAAgB,CAAA,IAC7E,wBAAA,KAA6B,MAAA,IAAa,wBAAA,KAA6B,gBAAA,EAAmB;AAE9F,IAAA,MAAM,IAAI,iBAAA,CAAkB,+BAAA,EAAiC,MAAA,EAAQ,oBAAoB,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,MAAM,gBAAA,EAAiB;AAClC;;;AC9CO,IAAM,qBAAA,GAAwB;;;AC4C9B,SAAS,uBAAuB,GAAA,EAA+B;AACpE,EAAA,IAAI,QAAQ,MAAA,IAAa,CAAC,0BAAA,CAA2B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,eAAe,yFAAoF,CAAA;AAAA,EAC/G;AACF;AAEO,SAAS,iCAAiC,KAAA,EAAiC;AAChF,EAAA,IAAI,KAAA,KAAU,WAAc,OAAO,KAAA,KAAU,YAAY,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI;AACvF,IAAA,MAAM,IAAI,eAAe,+EAA+E,CAAA;AAAA,EAC1G;AACF;AAkDA,IAAM,aAAA,GAAgB,CAAC,SAAA,KAA8B,CAAA,UAAA,EAAa,SAAS,CAAA,CAAA;AAU3E,SAAS,aAAA,CAAc,UAA8B,EAAA,EAAoB;AACvE,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,EAAE,CAAA;AACpC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,EAAE,IAAA,EAAK;AACpD,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,EAAE,CAAA,8BAAA,EAA4B,KAAA,CAAM,MAAM,CAAA,4EAAA;AAAA,KAElE;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA;AACf;AAGO,SAAS,kCAAA,CAAmC,EAAE,UAAA,EAAW,EAEI;AAClE,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAoB;AAC7C,EAAA,MAAM,UAAA,mBAAa,IAAI,GAAA,CAAI,CAAC,qBAAqB,CAAC,CAAA;AAClD,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,UAAA,EAAY;AACtC,IAAA,YAAA,CAAa,GAAA,CAAI,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AACjC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,OAAA,IAAW,uBAAA,CAAwB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AACjG,IAAA,IAAI,MAAM,IAAA,KAAS,UAAA,EAAY,cAAA,CAAe,GAAA,CAAI,MAAM,IAAI,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,CAAC,EAAE,QAAA,EAAU,QAAA,GAAW,OAAM,KAAM;AACzC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,UAAA,CAAW,SAAS,CAAA,GAAI,WAAW,QAAA,GAAW,MAAA,GAAY,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AACzG,IAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,IAAK,cAAA,CAAe,GAAA,CAAI,IAAI,CAAA,EAAG;AAC9D,MAAA,MAAM,IAAI,eAAe,mEAAmE,CAAA;AAAA,IAC9F;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAEO,SAAS,uBAAA,CAAwB;AAAA,EACtC,OAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAW,EAAE,UAAA,EAAY,SAAA,EAAW,UAAA,EAAY,EAAC,EAAE;AAAA,EACnD,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAAkE;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,uBAAA,GAA0B,mCAAmC,EAAE,UAAA,EAAY,OAAO,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,CAAA;AAEtH,EAAA,eAAe,QAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,kBAAA,GAAqB,OAAM,EAKhB;AAC1D,IAAA,sBAAA,CAAuB,QAAQ,cAAc,CAAA;AAC7C,IAAA,gCAAA,CAAiC,QAAQ,wBAAwB,CAAA;AACjE,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,CAAG,cAAc,SAAA,EAAW,MAAM,IAAI,cAAA,CAAe,4CAA4C,CAAA;AAC/H,IAAA,MAAM,IAAA,GAAO,kBAAA,GACT,uBAAA,CAAwB,EAAE,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,GAAW,EAAA,GAAK,EAAA,CAAG,IAAA,EAAM,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,EAAU,CAAA,GAC7G,OAAO,EAAA,KAAO,WAAW,aAAA,CAAc,QAAA,EAAU,EAAE,CAAA,GAAI,EAAA,CAAG,IAAA;AAC9D,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAC7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,EAAG,aAAA,CAAc,SAAS,CAAC,CAAA,CAAA,EAAI;AAAA,MACrE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA,EAAmB;AAAA,MACvD,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QAAE,EAAA,EAAI,IAAA;AAAA,QAAM,SAAA;AAAA,QAAW,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QAClE,0BAA0B,OAAA,CAAQ;AAAA,OAA0B;AAAA,KAC/D,CAAA;AACD,IAAA,OAAO;AAAA,MACL,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,MAAM,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI;AAAA,KAC9C;AAAA,EACF;AAIA,EAAA,eAAe,QAAyC,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAmB;AACzN,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,IAAI,SAAA,EAAW,OAAA,EAAS,kBAAkB,CAAA;AAC3E,IAAA,OAAO,gBAAA,CAAiB,wBAAA,KAA6B,MAAA,GACjD,qBAAA,CAA6B,QAAQ,CAAA,GACrC,gCAAA,CAAwC,EAAE,GAAG,QAAA,EAAU,wBAAA,EAA0B,gBAAA,CAAiB,wBAAA,EAA0B,CAAA,CAAE,IAAA;AAAA,EACpI;AAIA,EAAA,eAAe,uBAAwD,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAyC;AAC9P,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,gBAAA,EAAkB,kBAAA,EAAoB,IAAA,EAAM,CAAA;AACrG,IAAA,OAAO,iCAAwC,EAAE,GAAG,UAAU,wBAAA,EAA0B,gBAAA,CAAiB,0BAA0B,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,EAAE,SAAS,sBAAA,EAAwB,GAAA,EAAK,eAAa,OAAA,CAAwB,qBAAA,EAAuB,SAAS,CAAA,EAAE;AACxH;AAMA,IAAI,UAAA,GAAuC,IAAA;AAOpC,SAAS,uBAAuB,MAAA,EAAoD;AACzF,EAAA,UAAA,GAAa,wBAAwB,MAAM,CAAA;AAC3C,EAAA,OAAO,UAAA;AACT;AAGA,eAAsB,gBAAA,CAAkD;AAAA,EACtE,EAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAImB;AACjB,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,cAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAe,EAAA,EAAI,SAAA,EAAW,cAAA,KAAmB,SAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,CAAA;AACxG;AAcO,SAAS,cAAA,CAAe;AAAA,EAC7B,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAY,UAAA,CAAW;AACzB,CAAA,EAAqD;AACnD,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,eAAe,gDAAgD,CAAA;AACxF,EAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,eAAe,mCAAmC,CAAA;AAC5E,EAAA,IAAA,CAAK,WAAW,CAAA,GAAI,CAAA,KAAM,YAAA,GAAe,CAAA,GAAI,OAAO,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,eAAe,sEAAsE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,MAAM,CAAA,EAAG,IAAI,CAAA,EAAG,aAAA,CAAc,SAAS,CAAC,CAAA,CAAA;AAM9C,EAAA,OAAO,OAAO,QAAgD,IAAA,KAA0C;AACtG,IAAA,MAAM,MAAM,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,IAAA;AACzD,IAAA,MAAM,SAAS,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,GAAG,IACf,EAAC;AACL,IAAA,MAAM,OAAO,MAAA,CAAO,aAAA;AACpB,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,cAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,aAAA,CAAc,QAAA,EAAU,IAAI,CAAA;AACzC,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAA,IAAK,MAAA;AAC5E,IAAA,sBAAA,CAAuB,cAAc,CAAA;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,IAAgB,QAAA,GAAW;AAChD,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,eAAe,6CAAwC,CAAA;AAC7E,IAAA,MAAM,IAAA,GAA+B,YAAA,GACjC,EAAE,CAAC,qBAAqB,GAAG,KAAA,EAAM,GACjC,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAEvC,IAAA,OAAO,UAAU,GAAA,EAAK;AAAA,MACpB,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,kBAAA,EAAmB;AAAA,MACvD,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAC,EAAG,cAAA,EAAgB,CAAA;AAAA,MACpF,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KAC/C,CAAA;AAAA,EACH,CAAA;AACF;;;AC5RA,IAAM,aAAA,GAAgB,uBAAA;AAEtB,SAAS,mBAAmB,QAAA,EAAkF;AAC5G,EAAA,IAAI,CAAC,QAAA,CAAS,QAAQ,CAAA,IAAK,OAAO,QAAA,CAAS,UAAA,KAAe,QAAA,IAAY,CAAC,SAAS,UAAA,IAAc,CAAC,QAAA,CAAS,QAAA,CAAS,UAAU,CAAA,EAAG;AAC5H,IAAA,MAAM,IAAI,eAAe,8FAAyF,CAAA;AAAA,EACpH;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAsD;AACzE,EAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAC/D,IAAA,IAAI,CAAC,0BAAA,CAA2B,IAAA,CAAK,IAAI,CAAA,IAAK,CAAC,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,KAAA,CAAM,IAAA,KAAS,YAAY,CAAC,aAAA,CAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,IAC5H,MAAM,IAAA,KAAS,OAAA,IAAW,KAAA,CAAM,IAAA,KAAS,UAAA,EAAa;AAC1D,MAAA,MAAM,IAAI,cAAA,CAAe,CAAA,mCAAA,EAAsC,IAAI,CAAA,gCAAA,CAA6B,CAAA;AAAA,IAClG;AACA,IAAA,MAAA,CAAO,GAAA,CAAI,MAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,oCAAA,CAAqC,EAAE,SAAA,EAAW,QAAA,EAAU,WAAU,EAK7C;AACvC,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,CAAC,iBAAA,CAAkB,IAAA,CAAK,SAAS,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,uFAAkF,CAAA;AACpL,EAAA,MAAM,SAAS,QAAA,KAAa,MAAA,uBAAgB,GAAA,EAAsD,GAAI,mBAAmB,QAAQ,CAAA;AACjI,EAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,CAAA,KAAA,KAAS,KAAA,CAAM,IAAI,CAAC,CAAA;AACzE,EAAA,MAAM,uBAAA,GAA0B,kCAAA,CAAmC,EAAE,UAAA,EAAY,QAAQ,CAAA;AACzF,EAAA,eAAe,QAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,kBAAA,GAAqB,OAAM,EAKpC;AACtC,IAAA,sBAAA,CAAuB,QAAQ,cAAc,CAAA;AAC7C,IAAA,gCAAA,CAAiC,QAAQ,wBAAwB,CAAA;AACjE,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,CAAG,cAAc,SAAA,EAAW,MAAM,IAAI,cAAA,CAAe,4CAA4C,CAAA;AAC/H,IAAA,MAAM,QAAA,GAAW,OAAO,EAAA,KAAO,QAAA,GAAW,KAAK,EAAA,CAAG,IAAA;AAClD,IAAA,MAAM,IAAA,GAAO,qBACT,uBAAA,CAAwB,EAAE,UAAU,QAAA,EAAU,OAAO,EAAA,KAAO,QAAA,EAAU,CAAA,GACtE,aAAa,qBAAA,GAAwB,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,EAAG,SAAS,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,GAAI,QAAA,GAAW,MAAA,CAAA;AAC1H,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,cAAA,CAAe,sBAAsB,EAAE,CAAA,8BAAA,EAA4B,MAAA,CAAO,IAAI,CAAA,wCAAA,CAA0C,CAAA;AAC7I,IAAA,IAAI,CAAC,QAAA,CAAS,SAAS,GAAG,MAAM,IAAI,eAAe,uCAAuC,CAAA;AAC1F,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU;AAAA,MAAE,SAAA;AAAA,MAAW,EAAA,EAAI,IAAA;AAAA,MAAM,SAAA;AAAA,MACtD,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAC,GAAI,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe;AAAA,MACzF,GAAI,QAAQ,wBAAA,KAA6B,MAAA,GAAY,EAAC,GAAI,EAAE,wBAAA,EAA0B,OAAA,CAAQ,wBAAA;AAAyB,KACxH,CAAA;AACD,IAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,EAAA,KAAO,aAAa,CAAC,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,IAAK,SAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,MAAA,GAAS,GAAA,IACjI,QAAA,CAAS,EAAA,MAAQ,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,MAAA,GAAS,GAAA,CAAA,EAAM;AACtE,MAAA,MAAM,IAAI,iBAAA,CAAkB,8BAAA,EAAgC,IAAA,EAAM,IAAI,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAIA,EAAA,eAAe,QAAyC,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAmB;AACzN,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,IAAI,SAAA,EAAW,OAAA,EAAS,kBAAkB,CAAA;AAC3E,IAAA,OAAO,gBAAA,CAAiB,wBAAA,KAA6B,MAAA,GACjD,qBAAA,CAA6B,QAAQ,CAAA,GACrC,gCAAA,CAAwC,EAAE,GAAG,QAAA,EAAU,wBAAA,EAA0B,gBAAA,CAAiB,wBAAA,EAA0B,CAAA,CAAE,IAAA;AAAA,EACpI;AAIA,EAAA,eAAe,uBAAwD,EAAA,EAAiE,SAAA,GAAqC,EAAC,EAAG,OAAA,GAAqC,EAAC,EAAyC;AAC9P,IAAA,MAAM,gBAAA,GAAmB,EAAE,GAAG,OAAA,EAAQ;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,EAAE,EAAA,EAAI,WAAW,OAAA,EAAS,gBAAA,EAAkB,kBAAA,EAAoB,IAAA,EAAM,CAAA;AACrG,IAAA,OAAO,iCAAwC,EAAE,GAAG,UAAU,wBAAA,EAA0B,gBAAA,CAAiB,0BAA0B,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,EAAE,SAAS,sBAAA,EAAwB,GAAA,EAAK,eAAa,OAAA,CAAwB,qBAAA,EAAuB,SAAS,CAAA,EAAE;AACxH;;;ACnCO,SAAS,eAAA,CAGd;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAc+B;AAC7B,EAAA,MAAM,QAAA,GACJ,aACA,oBAAA,CAAqB;AAAA,IACnB,OAAA,EAAS,aAAA,CAAc,OAAA,EAAS,SAAS,CAAA;AAAA,IACzC,GAAI,SAAA,KAAc,MAAA,GACd,EAAE,YAAA,EAAc,OAAO,SAAA,KAAc,UAAA,GAAa,SAAA,GAAY,MAAM,WAAU,GAC9E,EAAE,UAAU,aAAA,CAAc,QAAA,EAAU,UAAU,CAAA,EAAE;AAAA,IACpD;AAAA,GACD,CAAA;AAEH,EAAA,OAAO,cAAA,CAAgC,UAAU,SAAS,CAAA;AAC5D;AAwBO,SAAS,sBAAA,CAGd;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAA,EAQ+B;AAC7B,EAAA,MAAM,QAAA,GACJ,aACA,oBAAA,CAAqB;AAAA,IACnB,OAAA,EAAS,aAAA,CAAc,OAAA,EAAS,SAAS,CAAA;AAAA,IACzC,YAAA,EACE,OAAO,gBAAA,KAAqB,UAAA,GACxB,mBACA,MAAM,aAAA,CAAc,kBAAkB,kBAAkB,CAAA;AAAA,IAC9D;AAAA,GACD,CAAA;AAEH,EAAA,OAAO,cAAA,CAAgC,UAAU,SAAS,CAAA;AAC5D;AAGA,SAAS,cAAA,CAGP,UAAwB,SAAA,EAA+C;AACvE,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,EAAM;AACV,MAAA,OAAO,IAAI,UAAA,CAAW,QAAA,EAAU,SAAA,EAAW,IAAI,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,MAAM,KAAA,CAAM,GAAA,EAAK,MAAA,EAAQ;AACvB,MAAA,MAAM,UAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAA,UAAA,EAAa,SAAS,CAAA,MAAA,CAAA,EAAU;AAAA,QAClE,GAAA;AAAA,QACA,GAAI,SAAS,EAAE,MAAA,EAAQ,CAAC,GAAG,MAAM,CAAA,EAAE,GAAI;AAAC,OACzC,CAAA;AACD,MAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACnG,QAAA,MAAM,IAAI,eAAe,8DAAyD,CAAA;AAAA,MACpF;AACA,MAAA,OAAQ,OAAA,CAA8B,IAAA;AAAA,IACxC,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,IAAA,EAAA,GAAS,IAAA,EAAM;AAC1B,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAA,UAAA,EAAa,SAAS,CAAA,SAAA,EAAY,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,IAAK,EAAE,CAAA;AAC3F,MAAA,IAAI,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAG1C,QAAA,IAAI,KAAA,CAAM,OAAA,CAAS,OAAA,CAA+B,IAAI,CAAA,EAAG;AACvD,UAAA,OAAO,EAAE,IAAA,EAAO,OAAA,CAAgC,IAAA,EAAK;AAAA,QACvD;AACA,QAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,UAAA,MAAM,YAAA,GAAe,MAAA,CAAQ,OAAA,CAAuC,aAAa,CAAA;AACjF,UAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA,EAAG;AAC/B,YAAA,OAAO,EAAE,YAAA,EAAa;AAAA,UACxB;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,IAAI,eAAe,wEAAmE,CAAA;AAAA,IAC9F;AAAA,GACF;AACF;AAEA,SAAS,aAAA,CAAiB,OAAsB,IAAA,EAAiB;AAC/D,EAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,8BAAA,CAAgC,CAAA;AACzG,EAAA,OAAO,KAAA;AACT","file":"client.js","sourcesContent":["/** Shared grammar for namespace identifiers; never interpolate arbitrary paths.\n * orm_events and orm_native_sources are migration-owned control-plane schemas,\n * not builder namespaces. Exclude their suffixes at every API/authoring entry.\n */\nexport const NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/\n\n/** Caller-scoped delegated data credential, supplied by an authenticated host. */\nexport const ORM_DATA_TOKEN_HEADER = 'x-sequence-data-token'\n\n/** Separate service-identity credential; never used as an implicit fallback. */\nexport const ORM_SERVICE_DATA_TOKEN_HEADER = 'x-sequence-data-token-service'\n\nexport const IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/\n/** Native source columns may have one leading underscore; relation names may not. */\nexport const COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/\nexport const MAX_IDENTIFIER_LENGTH = 63\n\n/**\n * Custom Roles & Capabilities claim keys as policies reference them: a\n * host-scoped registry key, an org pin's `org/<key>`, or an Application\n * capability pin's `app/<application-id>/<key>`. Matches the registry\n * key grammar EXACTLY (`[a-z0-9-]`, 1–64 chars, no `_` — the FGA object-id\n * delimiter) so any capability that's declarable/attachable in namespace.yaml\n * can also be referenced here — a stricter pattern would let a valid key\n * register yet fail at apply (e.g. `org/2fa`, a one-char or digit-led key).\n */\nexport const CAPABILITY_KEY_PATTERN = /^(?:org\\/|app\\/[a-z][a-z0-9-]{0,63}\\/)?[a-z0-9-]{1,64}$/\n\n/** Hard ceiling for an explicitly authored flat persisted GraphQL read. */\nexport const MAX_PERSISTED_READ_ROWS = 50_001\n\nexport const CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/\n\n/** Qualified reference to a table outside the defining file: `<schema>.<table>`. */\nexport const QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\\.[a-z][a-z0-9_]{0,62}$/\n\n/** Qualified source syntax only; the serving installation controls authorized backing. */\nexport const SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN\n\nexport const ORM_SCHEMA_PREFIX = 'orm_'\nexport const CONSUMER_ROLE_SUFFIX = '_consumer'\n\nexport const ormSchemaName = (namespace: string): string => {\n  if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`)\n  return `${ORM_SCHEMA_PREFIX}${namespace}`\n}\nexport const consumerRoleName = (namespace: string): string =>\n  `${ormSchemaName(namespace)}${CONSUMER_ROLE_SUFFIX}`\n\nexport const DEFINITION_FILE_EXTENSIONS = ['.yml', '.yaml'] as const\n\n/** Reserved basenames for the namespace-level config file (description, org capability pins). */\nexport const NAMESPACE_CONFIG_FILENAMES = new Set(['namespace.yaml', 'namespace.yml'])\n\nexport const HASH_DOMAIN = 'sequence-orm-definitions\\0'\n\n/**\n * A per-file byte cap where the loader reads untrusted YAML into memory — a real failure mode, not a product\n * limit. Counts of tables/indexes/params and policy/SQL lengths are\n * deliberately uncapped; Postgres enforces its own limits loudly at apply.\n */\nexport const MAX_DEFINITION_FILE_BYTES = 1024 * 1024\n\n/** Generated SDL aggregates every table/view; it is not an individual source file. */\nexport const MAX_GENERATED_SDL_BYTES = 16 * 1024 * 1024\n\n/** Registration and reviewed exports carry SDL, canonical metadata, snapshots and migrations. */\nexport const ORM_REGISTRATION_MAX_BYTES = 64 * 1024 * 1024\n\n/** `/api/data/<ns>/actions/…` and `/api/data/<ns>/query` share the table path segment. */\nexport const RESERVED_TABLE_NAMES = new Set(['actions', 'query'])\n\n/**\n * The Data API's query-string grammar owns these parameter names — a column\n * with one of them could never be filtered over the wire, so definitions\n * refuse it up front (\"validate rejects only what can never work\").\n */\nexport const RESERVED_COLUMN_NAMES = new Set(['select', 'order', 'limit', 'offset'])\n\n/**\n * Per-cell metadata (`cellMetadata: true`, and every resolved-table source) is\n * stored as typed system columns beside each tracked column `c`:\n *\n *  - `c__at`  timestamptz — when the cell was last written (NULL: never / no opinion)\n *  - `c__by`  text        — who wrote it\n *  - `c__rev` uuid        — a resolved table's manual source only: the edit's\n *                           identity, so an async writeback confirmation clears\n *                           only the exact edit it delivered\n *\n * A resolved view additionally exposes, per resolved column, the winner's\n * `c__src` (source name) and `c__lost` (newer candidates that lost, jsonb).\n * None of these are GraphQL columns: they surface through the typed `cells`\n * object and are never client-writable.\n */\nexport const CELL_PARTS = ['at', 'by', 'rev', 'source', 'conflicts'] as const\nexport type CellPart = (typeof CELL_PARTS)[number]\nexport const CELL_PART_SUFFIX: Readonly<Record<CellPart, string>> = {\n  at: '__at', by: '__by', rev: '__rev', source: '__src', conflicts: '__lost',\n}\n/** Longest physical column name that can carry cell parts (63 minus the longest suffix). */\nexport const MAX_TRACKED_COLUMN_NAME = MAX_IDENTIFIER_LENGTH - 6\n/** GraphQL field carrying a row's per-cell metadata object. */\nexport const CELLS_FIELD = 'cells'\n\n/** Physical (and logical) name of one cell part of a column. */\nexport function cellColumnName(column: string, part: CellPart): string {\n  return `${column}${CELL_PART_SUFFIX[part]}`\n}\n\n/**\n * Actor recorded when the data plane computes a materialized resolved table's\n * rows for every caller. Its claims are what the compute view's synced\n * sources see (materialized ETL sources must be readable by anyone).\n */\nexport const MATERIALIZE_ACTOR = 'orm:materialize'\nexport const MATERIALIZE_CLAIMS_JSON = JSON.stringify({ sub: MATERIALIZE_ACTOR, org: null, roles: [], capabilities: [] })\n\n/**\n * Apply-generated function that reconciles a materialized resolved table with\n * its compute view: `SELECT * FROM orm_<ns>.\"<table>__refresh\"(wait)` returns\n * `(upserted, deleted, locked)`; without `wait` it skips when another refresh\n * holds the table's lock. The one refresh implementation — the Atlas\n * reconcile, the post-ETL hook, and an operator in psql all call it.\n */\nexport function materializedRefreshFunctionName(table: string): string {\n  return `${table}__refresh`\n}\n\n/**\n * Advisory-lock key serializing a materialized table's refreshes (hashed with\n * `hashtext`). A full refresh holds it exclusively and every ORM write's\n * per-row refresh holds it shared, both before reading the compute view — so\n * a full refresh never reads a snapshot older than a write it then overwrites.\n */\nexport function materializeLockKey(schema: string, table: string): string {\n  return `orm:materialize:${schema}.${table}`\n}\n","export class OrmClientError extends Error {\n  override readonly name: string = 'OrmClientError'\n\n  constructor(message: string, readonly status: number | null = null) {\n    super(message)\n  }\n}\n\nexport interface OperationErrorEntry {\n  readonly message: string\n  readonly extensions?: { readonly code?: string }\n}\n\nexport class OrmOperationError extends OrmClientError {\n  override readonly name = 'OrmOperationError'\n\n  constructor(\n    message: string,\n    status: number | null,\n    readonly code: string | null,\n    readonly errors: readonly OperationErrorEntry[] = [],\n  ) {\n    super(message, status)\n  }\n}\n","/**\n * Fetch-based transport for the Data API. Deliberately free of node builtins\n * so the client runs anywhere a `fetch` exists — browsers, artifact bridges,\n * Cloud Functions, `node:vm` sandboxes.\n */\nimport { ORM_DATA_TOKEN_HEADER } from '../constants.js'\n\nimport { OrmClientError } from './errors.js'\nexport { OrmClientError } from './errors.js'\n\nexport interface OrmTransport {\n  get(path: string, params: URLSearchParams): Promise<unknown>\n  post(path: string, body: unknown): Promise<unknown>\n}\n\nexport function createFetchTransport({\n  baseUrl,\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: {\n  baseUrl: string\n  /** App-user / session bearer → `Authorization: Bearer`. */\n  getToken?: () => Promise<string | null> | string | null\n  /** Delegated, attenuated function token → the `ORM_DATA_TOKEN_HEADER`. */\n  getDataToken?: () => Promise<string | null> | string | null\n  fetchImpl?: typeof globalThis.fetch\n}): OrmTransport {\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n\n  const request = async (path: string, init: Omit<RequestInit, 'headers'>): Promise<unknown> => {\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    // The delegated token rides its own header; the app-user bearer rides Authorization.\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    const response = await fetchImpl(`${root}${path}`, {\n      ...init,\n      headers: { ...auth, 'Content-Type': 'application/json' },\n    })\n    const payload: unknown = await response.json().catch(() => null)\n    if (!response.ok) {\n      const detail =\n        payload && typeof payload === 'object' && 'detail' in payload\n          ? String((payload as { detail: unknown }).detail)\n          : `HTTP ${response.status}`\n      throw new OrmClientError(detail, response.status)\n    }\n    return payload\n  }\n\n  return {\n    get: (path, params) => {\n      // Not params.size — that's Node 19.8+/2023-browser surface, newer than\n      // the fetch this module documents as its only requirement.\n      const serialized = params.toString()\n      return request(serialized === '' ? path : `${path}?${serialized}`, {})\n    },\n    post: (path, body) => request(path, { method: 'POST', body: JSON.stringify(body ?? {}) }),\n  }\n}\n","import { OrmClientError, type OrmTransport } from './transport.js'\n\n/**\n * Fluent read query over one table. Serializes to exactly the PostgREST\n * subset the Data API's query parser accepts — the round-trip contract is\n * asserted server-side (builder output → parseReadQuery) so the two ends\n * can't drift apart silently.\n *\n * IMMUTABLE: every method returns a new query, so narrowing `select()` can\n * never leave an alias holding a stale wider row type, and a base query can\n * be safely forked into variants.\n */\n\nexport type FilterValue = string | number | boolean\n\nexport interface ReadResponse<Row> {\n  readonly rows: readonly Row[]\n  readonly limit: number\n  readonly offset: number\n}\n\n/** Characters the in-list grammar cannot carry — there is no escaping, so the builder hard-fails. */\nconst IN_LIST_UNREPRESENTABLE = /[,()]/\n\ninterface QueryState {\n  readonly filters: ReadonlyArray<[column: string, expression: string]>\n  readonly orderings: readonly string[]\n  readonly selection: readonly string[] | null\n  readonly limitValue: number | null\n  readonly offsetValue: number | null\n}\n\nconst EMPTY_STATE: QueryState = {\n  filters: [],\n  orderings: [],\n  selection: null,\n  limitValue: null,\n  offsetValue: null,\n}\n\n/**\n * `Row` is the TABLE's row (filters and order always accept every column);\n * `Result` is what rows() yields — narrowed by select(), re-widenable by a\n * later select() since keys always come from Row.\n */\nexport class TableQuery<Row extends Record<string, unknown>, Result = Row> {\n  constructor(\n    private readonly transport: OrmTransport,\n    private readonly namespace: string,\n    private readonly table: string,\n    private readonly state: QueryState = EMPTY_STATE,\n  ) {}\n\n  private with(patch: Partial<QueryState>): TableQuery<Row, Result> {\n    return new TableQuery(this.transport, this.namespace, this.table, { ...this.state, ...patch })\n  }\n\n  select<K extends keyof Row & string>(...columns: [K, ...K[]]): TableQuery<Row, Pick<Row, K>> {\n    return new TableQuery<Row, Pick<Row, K>>(this.transport, this.namespace, this.table, {\n      ...this.state,\n      selection: columns,\n    })\n  }\n\n  eq<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'eq', value)\n  }\n\n  ne<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'ne', value)\n  }\n\n  gt<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'gt', value)\n  }\n\n  gte<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'gte', value)\n  }\n\n  lt<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'lt', value)\n  }\n\n  lte<K extends keyof Row & string>(column: K, value: FilterValue): TableQuery<Row, Result> {\n    return this.filter(column, 'lte', value)\n  }\n\n  like<K extends keyof Row & string>(column: K, pattern: string): TableQuery<Row, Result> {\n    return this.filter(column, 'like', pattern)\n  }\n\n  ilike<K extends keyof Row & string>(column: K, pattern: string): TableQuery<Row, Result> {\n    return this.filter(column, 'ilike', pattern)\n  }\n\n  in<K extends keyof Row & string>(column: K, values: readonly FilterValue[]): TableQuery<Row, Result> {\n    // An empty list is representable — `in.()` matches nothing, the same\n    // semantics the server executes. Blank entries are legitimate values in\n    // multi-entry lists (`in.(a,)` carries ['a','']), but a LONE '' renders\n    // as `in.()` and silently becomes the empty list — unrepresentable.\n    // Beyond that only characters the grammar can't escape, and whitespace\n    // padding the server-side split would silently swallow, are refused.\n    const rendered = values.map((value) => {\n      const text = String(value)\n      if (IN_LIST_UNREPRESENTABLE.test(text) || text !== text.trim()) {\n        throw new OrmClientError(`in() value '${text}' cannot be represented — the list grammar has no escaping`)\n      }\n      return text\n    })\n    if (rendered.length === 1 && rendered[0] === '') {\n      throw new OrmClientError(\"in() with a lone '' cannot be represented — it would read as the empty list\")\n    }\n    return this.with({ filters: [...this.state.filters, [column, `in.(${rendered.join(',')})`]] })\n  }\n\n  is<K extends keyof Row & string>(column: K, value: null | boolean): TableQuery<Row, Result> {\n    return this.with({\n      filters: [...this.state.filters, [column, `is.${value === null ? 'null' : value}`]],\n    })\n  }\n\n  order<K extends keyof Row & string>(column: K, direction: 'asc' | 'desc' = 'asc'): TableQuery<Row, Result> {\n    return this.with({ orderings: [...this.state.orderings, `${column}.${direction}`] })\n  }\n\n  limit(value: number): TableQuery<Row, Result> {\n    return this.with({ limitValue: value })\n  }\n\n  offset(value: number): TableQuery<Row, Result> {\n    return this.with({ offsetValue: value })\n  }\n\n  /** The exact query string sent to the Data API — exposed for debugging and the grammar contract test. */\n  searchParams(): URLSearchParams {\n    const params = new URLSearchParams()\n    for (const [column, expression] of this.state.filters) params.append(column, expression)\n    if (this.state.orderings.length > 0) params.set('order', this.state.orderings.join(','))\n    if (this.state.selection) params.set('select', this.state.selection.join(','))\n    if (this.state.limitValue !== null) params.set('limit', String(this.state.limitValue))\n    if (this.state.offsetValue !== null) params.set('offset', String(this.state.offsetValue))\n    return params\n  }\n\n  async rows(): Promise<Result[]> {\n    const payload = await this.transport.get(\n      `/api/data/${this.namespace}/${this.table}`,\n      this.searchParams(),\n    )\n    if (!payload || typeof payload !== 'object' || !Array.isArray((payload as { rows?: unknown }).rows)) {\n      throw new OrmClientError('unexpected Data API response shape — missing rows array')\n    }\n    return (payload as { rows: Result[] }).rows\n  }\n\n  private filter(column: string, op: string, value: FilterValue): TableQuery<Row, Result> {\n    return this.with({ filters: [...this.state.filters, [column, `${op}.${String(value)}`]] })\n  }\n}\n","import { OrmOperationError, type OperationErrorEntry } from './errors.js'\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction isOperationError(value: unknown): value is OperationErrorEntry {\n  if (!isRecord(value) || typeof value.message !== 'string') return false\n  if (value.extensions === undefined) return true\n  return isRecord(value.extensions) && (value.extensions.code === undefined || typeof value.extensions.code === 'string')\n}\n\nexport function readOperationResponse<TData>({\n  ok, status, body,\n}: { ok: boolean; status: number; body: unknown }): TData {\n  const payload = isRecord(body) ? body : null\n  const rawErrors = payload?.errors\n  if (rawErrors !== undefined && (!Array.isArray(rawErrors) || !rawErrors.every(isOperationError))) {\n    throw new OrmOperationError('malformed response: invalid errors', status, null)\n  }\n  const errors: OperationErrorEntry[] = rawErrors ?? []\n  if (!ok || errors.length > 0) {\n    const first = errors[0]\n    throw new OrmOperationError(first?.message ?? `HTTP ${status}`, status, first?.extensions?.code ?? null, errors)\n  }\n  if (!payload || payload.data === undefined || payload.data === null) {\n    throw new OrmOperationError('malformed response: missing data', status, null)\n  }\n  if (!isRecord(payload.data)) {\n    throw new OrmOperationError('malformed response: data must be an object', status, null)\n  }\n  // Generated consumer types describe operation data; envelope validation\n  // cannot prove an application's selection-specific TData at runtime.\n  return payload.data as TData\n}\n\n/** Only expose data together with a validated, opaque source receipt. */\nexport function readOperationResponseWithReceipt<TData>({\n  ok, status, body, expectedSourceGeneration,\n}: { ok: boolean; status: number; body: unknown; expectedSourceGeneration?: string }): { data: TData; sourceGeneration: string } {\n  const data = readOperationResponse<TData>({ ok, status, body })\n  const extensions = isRecord(body) && isRecord(body.extensions) ? body.extensions : null\n  const sourceGeneration = extensions?.sourceGeneration\n  if (typeof sourceGeneration !== 'string' || !/^[a-f0-9]{64}$/.test(sourceGeneration)\n    || (expectedSourceGeneration !== undefined && expectedSourceGeneration !== sourceGeneration)) {\n    // Missing and changed receipts are indistinguishable; do not expose either token.\n    throw new OrmOperationError('Source generation unavailable', status, 'OBJECT_UNAVAILABLE')\n  }\n  return { data, sourceGeneration }\n}\n","/** Runtime SQL inputs are values, never interpolated into the submitted SQL. */\n// SHA-256 of \"sequence-orm-builtin-sql-read-v1\". This identifies server-owned\n// behavior, independent of a namespace's authored operation manifest.\nexport const BUILTIN_SQL_READ_HASH = 'sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258'\n\nexport type SqlQueryParameter =\n  | { type: 'text' | 'uuid' | 'date' | 'timestamptz' | 'numeric' | 'bigint'; value: string | null }\n  | { type: 'integer' | 'double'; value: number | null }\n  | { type: 'boolean'; value: boolean | null }\n\nexport type SqlQueryVariables = {\n  sql: string\n  parameters?: Record<string, SqlQueryParameter>\n}\n\ntype SqlQueryCell = string | number | boolean | null | SqlQueryCell[] | { [key: string]: SqlQueryCell }\n\nexport interface SqlQueryResult {\n  columns: Array<{ name: string; type: string; nullable: boolean }>\n  rows: Array<Array<SqlQueryCell>>\n  truncated: boolean\n}\n","/**\n * Persisted-operation client for the v2 data plane. The wire carries only\n * `{ op: <hash>, variables, idempotencyKey?, expectedSourceGeneration? }`. Runtime SQL contracts accept SQL in variables;\n * GraphQL and fixed SQL operations keep their documents server-side. This runtime\n * is deliberately free of node builtins and third-\n * party deps (no @apollo/client import): Apollo integration happens through a\n * fetch-compatible shim (`createOrmFetch`) handed to `HttpLink({ fetch })`.\n */\nimport { OrmClientError } from './errors.js'\nimport { readOperationResponse, readOperationResponseWithReceipt } from './response.js'\nimport { ORM_DATA_TOKEN_HEADER } from '../constants.js'\nimport { BUILTIN_SQL_READ_HASH, type SqlQueryVariables, type SqlQueryResult } from './sql.js'\n\nexport { OrmOperationError, type OperationErrorEntry } from './errors.js'\n\n/** One entry of `operations.manifest.json` (generated by `orm generate`). */\nexport interface ManifestOperation {\n  readonly hash: string\n  readonly kind: 'query' | 'mutation'\n  readonly requires: { readonly capability?: string; readonly role?: string } | null\n}\n\nexport interface OperationsManifest {\n  readonly schemaHash: string\n  readonly opsHash?: string\n  readonly operations: Readonly<Record<string, ManifestOperation>>\n}\n\nexport interface OperationExecutorConfig {\n  /** Deployment host root, e.g. `https://atlas.seqholdings.com`. */\n  baseUrl: string\n  namespace: string\n  manifest?: OperationsManifest\n  /** App-user / session bearer → `Authorization: Bearer`. */\n  getToken?: () => Promise<string | null> | string | null\n  /** Delegated, attenuated function token → the `ORM_DATA_TOKEN_HEADER`. */\n  getDataToken?: () => Promise<string | null> | string | null\n  fetchImpl?: typeof globalThis.fetch\n}\n\nexport interface OperationExecutionOptions {\n  /** Reuse only when retrying the same logical mutation. */\n  idempotencyKey?: string\n  /** Require the same source publication as an earlier read receipt. */\n  expectedSourceGeneration?: string\n}\n\nexport function validateIdempotencyKey(key: string | undefined): void {\n  if (key !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(key)) {\n    throw new OrmClientError('idempotencyKey must be 1–128 letters, digits, dots, underscores, colons or hyphens')\n  }\n}\n\nexport function validateExpectedSourceGeneration(value: string | undefined): void {\n  if (value !== undefined && (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value))) {\n    throw new OrmClientError('expectedSourceGeneration must be a lowercase 64-character hexadecimal receipt')\n  }\n}\n\nexport interface OperationExecutor {\n  /** Execute a manifest operation by name (or a raw `sha256:` hash). */\n  execute<TData = Record<string, unknown>>(\n    op: string,\n    variables?: Record<string, unknown>,\n    options?: OperationExecutionOptions,\n  ): Promise<TData>\n}\n\n/** Additive factory result; existing host wrappers implementing OperationExecutor remain valid. */\nexport interface SqlOperationExecutor extends OperationExecutor {\n  /** Default read-only ontology SQL; no authored operation or manifest needed. */\n  sql(variables: SqlQueryVariables): Promise<SqlQueryResult>\n}\n\nexport interface TypedOperationExecutor extends OperationExecutor {\n  execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n}\n\n/** Factory result adds SQL without requiring it on existing typed host wrappers. */\nexport type TypedSqlOperationExecutor = TypedOperationExecutor & SqlOperationExecutor\n\nexport interface OperationReadReceipt<TData> {\n  readonly data: TData\n  /** Opaque source-publication identity; never an authorization credential. */\n  readonly sourceGeneration: string\n}\n\nexport interface ReadReceiptOperationExecutor extends OperationExecutor {\n  /** Execute a registered query or built-in SQL read; fail closed without a receipt. */\n  executeWithReadReceipt<TData = Record<string, unknown>>(\n    op: string,\n    variables?: Record<string, unknown>,\n    options?: OperationExecutionOptions,\n  ): Promise<OperationReadReceipt<TData>>\n}\n\n/** Additive factories preserve existing host wrappers without receipt support. */\nexport type ReadReceiptSqlOperationExecutor = SqlOperationExecutor & ReadReceiptOperationExecutor\n\nexport interface TypedReadReceiptOperationExecutor extends TypedOperationExecutor {\n  executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n}\n\nexport type TypedReadReceiptSqlOperationExecutor = TypedReadReceiptOperationExecutor & ReadReceiptSqlOperationExecutor\n\nconst dataPlanePath = (namespace: string): string => `/_data/v2/${namespace}`\n\n/** Generated handle identifies the registered contract; optional types are phantom. */\nexport interface OperationReference<TVariables extends Record<string, unknown>, TData> {\n  readonly namespace: string\n  readonly hash: string\n  readonly variables?: TVariables\n  readonly result?: TData\n}\n\nfunction resolveOpHash(manifest: OperationsManifest, op: string): string {\n  if (op.startsWith('sha256:')) return op\n  const entry = manifest.operations[op]\n  if (!entry) {\n    const known = Object.keys(manifest.operations).sort()\n    throw new OrmClientError(\n      `unknown operation \"${op}\" — not in the manifest (${known.length} known). ` +\n        'Re-run `seq-studio orm generate` after editing graphql documents.',\n    )\n  }\n  return entry.hash\n}\n\n/** Snapshot classification and name resolution before any receipt request can dispatch. */\nexport function createReadReceiptOperationResolver({ operations }: {\n  operations: Iterable<readonly [string, Pick<ManifestOperation, 'hash' | 'kind'>]>\n}): (selection: { selector: string; hashOnly?: boolean }) => string {\n  const hashesByName = new Map<string, string>()\n  const readHashes = new Set([BUILTIN_SQL_READ_HASH])\n  const mutationHashes = new Set<string>()\n  for (const [name, entry] of operations) {\n    hashesByName.set(name, entry.hash)\n    if (entry.kind === 'query' && /^sha256:[a-f0-9]{64}$/.test(entry.hash)) readHashes.add(entry.hash)\n    if (entry.kind === 'mutation') mutationHashes.add(entry.hash)\n  }\n  return ({ selector, hashOnly = false }) => {\n    const hash = selector.startsWith('sha256:') ? selector : hashOnly ? undefined : hashesByName.get(selector)\n    if (!hash || !readHashes.has(hash) || mutationHashes.has(hash)) {\n      throw new OrmClientError('read receipts require a registered query or the built-in SQL read')\n    }\n    return hash\n  }\n}\n\nexport function createOperationExecutor({\n  baseUrl,\n  namespace,\n  manifest = { schemaHash: 'builtin', operations: {} },\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: OperationExecutorConfig): TypedReadReceiptSqlOperationExecutor {\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n  const resolveReceiptOperation = createReadReceiptOperationResolver({ operations: Object.entries(manifest.operations) })\n\n  async function request({ op, variables, options, requireReadReceipt = false }: {\n    op: string | OperationReference<Record<string, unknown>, unknown>\n    variables: Record<string, unknown>\n    options: OperationExecutionOptions\n    requireReadReceipt?: boolean\n  }): Promise<{ ok: boolean; status: number; body: unknown }> {\n    validateIdempotencyKey(options.idempotencyKey)\n    validateExpectedSourceGeneration(options.expectedSourceGeneration)\n    if (typeof op !== 'string' && op.namespace !== namespace) throw new OrmClientError('operation belongs to a different namespace')\n    const hash = requireReadReceipt\n      ? resolveReceiptOperation({ selector: typeof op === 'string' ? op : op.hash, hashOnly: typeof op !== 'string' })\n      : typeof op === 'string' ? resolveOpHash(manifest, op) : op.hash\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    const response = await fetchImpl(`${root}${dataPlanePath(namespace)}`, {\n      method: 'POST',\n      headers: { ...auth, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ op: hash, variables, idempotencyKey: options.idempotencyKey,\n        expectedSourceGeneration: options.expectedSourceGeneration }),\n    })\n    return {\n      ok: response.ok,\n      status: response.status,\n      body: await response.json().catch(() => null),\n    }\n  }\n\n  function execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  function execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n  async function execute<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<TData> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions })\n    return executionOptions.expectedSourceGeneration === undefined\n      ? readOperationResponse<TData>(response)\n      : readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration }).data\n  }\n\n  function executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  function executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  async function executeWithReadReceipt<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<OperationReadReceipt<TData>> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions, requireReadReceipt: true })\n    return readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration })\n  }\n  return { execute, executeWithReadReceipt, sql: variables => execute<SqlQueryResult>(BUILTIN_SQL_READ_HASH, variables) }\n}\n\n// ---------------------------------------------------------------------------\n// Module-level convenience for generated server functions (`db<Name>`)\n// ---------------------------------------------------------------------------\n\nlet configured: OperationExecutor | null = null\n\n/**\n * Configure the process-wide executor the generated `db<Name>` server\n * functions call through. Call once at startup (server-side); browser apps\n * should prefer Apollo + `createOrmFetch` or an explicit executor.\n */\nexport function configureOrmOperations(config: OperationExecutorConfig): OperationExecutor {\n  configured = createOperationExecutor(config)\n  return configured\n}\n\n/** Used by generated code: `executeOperation({ op: 'getOpenDeals', variables })`. */\nexport async function executeOperation<TData = Record<string, unknown>>({\n  op,\n  variables,\n  idempotencyKey,\n}: {\n  op: string\n  variables?: Record<string, unknown>\n  idempotencyKey?: string\n}): Promise<TData> {\n  if (!configured) {\n    throw new OrmClientError(\n      'ORM operations client not configured — call configureOrmOperations({ baseUrl, namespace, manifest, getToken }) at startup',\n    )\n  }\n  return configured.execute<TData>(op, variables, idempotencyKey === undefined ? {} : { idempotencyKey })\n}\n\n// ---------------------------------------------------------------------------\n// Apollo integration without an @apollo/client dependency\n// ---------------------------------------------------------------------------\n\n/**\n * A fetch-compatible function for `new HttpLink({ uri: '/unused', fetch: createOrmFetch(...) })`.\n * Intercepts Apollo's GraphQL POST, swaps the body for the persisted-op\n * envelope (`{ op: <hash>, variables }`) resolved via the manifest's\n * operationName, rewrites the URL to the data plane, and attaches auth.\n * The GraphQL-spec response body passes through untouched, so InMemoryCache\n * and error links behave exactly as they do against a GraphQL server.\n */\nexport function createOrmFetch({\n  baseUrl,\n  namespace,\n  manifest,\n  getToken,\n  getDataToken,\n  fetchImpl = globalThis.fetch,\n}: OperationExecutorConfig): typeof globalThis.fetch {\n  if (!manifest) throw new OrmClientError('createOrmFetch requires an operations manifest')\n  if (!fetchImpl) throw new OrmClientError('no fetch implementation available')\n  if ((getToken ? 1 : 0) + (getDataToken ? 1 : 0) !== 1) {\n    throw new OrmClientError('provide exactly one of getToken (bearer) or getDataToken (delegated)')\n  }\n  const root = baseUrl.replace(/\\/+$/, '')\n  const url = `${root}${dataPlanePath(namespace)}`\n\n  // Derived from `globalThis.fetch` rather than naming `RequestInfo` (a DOM-lib\n  // global this module compiles without). The input is ignored — Apollo's\n  // HttpLink calls the injected fetch with a string URI, and the real target\n  // URL is fixed at `url` above.\n  return async (_input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit): Promise<Response> => {\n    const raw = typeof init?.body === 'string' ? init.body : null\n    const parsed = raw\n      ? (JSON.parse(raw) as { operationName?: string; variables?: Record<string, unknown> })\n      : {}\n    const name = parsed.operationName\n    if (!name) {\n      throw new OrmClientError(\n        'createOrmFetch requires named operations (Apollo sends operationName for named documents)',\n      )\n    }\n    const hash = resolveOpHash(manifest, name)\n    const idempotencyKey = new Headers(init?.headers).get('Idempotency-Key') ?? undefined\n    validateIdempotencyKey(idempotencyKey)\n    const token = await (getDataToken ?? getToken)!()\n    if (!token) throw new OrmClientError('not authenticated — no token available')\n    const auth: Record<string, string> = getDataToken\n      ? { [ORM_DATA_TOKEN_HEADER]: token }\n      : { Authorization: `Bearer ${token}` }\n\n    return fetchImpl(url, {\n      method: 'POST',\n      headers: { ...auth, 'Content-Type': 'application/json' },\n      body: JSON.stringify({ op: hash, variables: parsed.variables ?? {}, idempotencyKey }),\n      ...(init?.signal ? { signal: init.signal } : {}),\n    })\n  }\n}\n","import { NAMESPACE_PATTERN } from '../constants.js'\nimport { OrmClientError, OrmOperationError } from './errors.js'\nimport {\n  validateIdempotencyKey, validateExpectedSourceGeneration, createReadReceiptOperationResolver,\n  type ManifestOperation,\n  type TypedReadReceiptSqlOperationExecutor, type OperationReadReceipt, type OperationReference, type OperationExecutionOptions,\n} from './operations.js'\nimport { isRecord, readOperationResponse, readOperationResponseWithReceipt } from './response.js'\nimport { BUILTIN_SQL_READ_HASH, type SqlQueryResult } from './sql.js'\n\nexport interface OperationTransportRequest {\n  namespace: string\n  op: string\n  variables: Record<string, unknown>\n  idempotencyKey?: string\n  expectedSourceGeneration?: string\n}\n\nexport interface OperationTransportResponse {\n  ok: boolean\n  status: number\n  body: unknown\n}\n\nexport type OperationTransport = (request: OperationTransportRequest) => Promise<OperationTransportResponse>\n\nconst operationHash = /^sha256:[a-f0-9]{64}$/\n\nfunction readManifestHashes(manifest: unknown): ReadonlyMap<string, Pick<ManifestOperation, 'hash' | 'kind'>> {\n  if (!isRecord(manifest) || typeof manifest.schemaHash !== 'string' || !manifest.schemaHash || !isRecord(manifest.operations)) {\n    throw new OrmClientError('invalid operations manifest — use operations.manifest.json from seq-studio orm generate')\n  }\n  const hashes = new Map<string, Pick<ManifestOperation, 'hash' | 'kind'>>()\n  for (const [name, entry] of Object.entries(manifest.operations)) {\n    if (!/^[_A-Za-z][_0-9A-Za-z]*$/.test(name) || !isRecord(entry) || typeof entry.hash !== 'string' || !operationHash.test(entry.hash)\n      || (entry.kind !== 'query' && entry.kind !== 'mutation')) {\n      throw new OrmClientError(`invalid operations manifest entry \"${name}\" — regenerate the manifest`)\n    }\n    hashes.set(name, { hash: entry.hash, kind: entry.kind })\n  }\n  return hashes\n}\n\n/**\n * Execute generated operations through a host-owned authenticated transport.\n * No credential handling, retries, or global configuration. The manifest is\n * validated once and copied, so later caller mutation cannot alter the target.\n */\nexport function createOperationExecutorWithTransport({ namespace, manifest, transport }: {\n  namespace: string\n  /** Accept generated JSON imports directly; validate them at construction. */\n  manifest?: unknown\n  transport: OperationTransport\n}): TypedReadReceiptSqlOperationExecutor {\n  if (typeof namespace !== 'string' || !NAMESPACE_PATTERN.test(namespace)) throw new OrmClientError('invalid ORM namespace — expected a lowercase identifier of at most 41 characters')\n  const hashes = manifest === undefined ? new Map<string, Pick<ManifestOperation, 'hash' | 'kind'>>() : readManifestHashes(manifest)\n  const knownHashes = new Set([...hashes.values()].map(entry => entry.hash))\n  const resolveReceiptOperation = createReadReceiptOperationResolver({ operations: hashes })\n  async function request({ op, variables, options, requireReadReceipt = false }: {\n    op: string | OperationReference<Record<string, unknown>, unknown>\n    variables: Record<string, unknown>\n    options: OperationExecutionOptions\n    requireReadReceipt?: boolean\n  }): Promise<OperationTransportResponse> {\n    validateIdempotencyKey(options.idempotencyKey)\n    validateExpectedSourceGeneration(options.expectedSourceGeneration)\n    if (typeof op !== 'string' && op.namespace !== namespace) throw new OrmClientError('operation belongs to a different namespace')\n    const selector = typeof op === 'string' ? op : op.hash\n    const hash = requireReadReceipt\n      ? resolveReceiptOperation({ selector, hashOnly: typeof op !== 'string' })\n      : selector === BUILTIN_SQL_READ_HASH ? selector : hashes.get(selector)?.hash ?? (knownHashes.has(selector) ? selector : undefined)\n    if (!hash) throw new OrmClientError(`unknown operation \"${op}\" — not in the manifest (${hashes.size} known). Re-run seq-studio orm generate.`)\n    if (!isRecord(variables)) throw new OrmClientError('operation variables must be an object')\n    const response = await transport({ namespace, op: hash, variables,\n      ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),\n      ...(options.expectedSourceGeneration === undefined ? {} : { expectedSourceGeneration: options.expectedSourceGeneration }),\n    })\n    if (!response || typeof response.ok !== 'boolean' || !Number.isInteger(response.status) || response.status < 100 || response.status > 599\n      || response.ok !== (response.status >= 200 && response.status < 300)) {\n      throw new OrmOperationError('malformed transport response', null, null)\n    }\n    return response\n  }\n\n  function execute<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<TData>\n  function execute<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<TData>\n  async function execute<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<TData> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions })\n    return executionOptions.expectedSourceGeneration === undefined\n      ? readOperationResponse<TData>(response)\n      : readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration }).data\n  }\n\n  function executeWithReadReceipt<TVariables extends Record<string, unknown>, TData>(op: OperationReference<TVariables, TData>, variables: TVariables, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  function executeWithReadReceipt<TData = Record<string, unknown>>(op: string, variables?: Record<string, unknown>, options?: OperationExecutionOptions): Promise<OperationReadReceipt<TData>>\n  async function executeWithReadReceipt<TData = Record<string, unknown>>(op: string | OperationReference<Record<string, unknown>, TData>, variables: Record<string, unknown> = {}, options: OperationExecutionOptions = {}): Promise<OperationReadReceipt<TData>> {\n    const executionOptions = { ...options }\n    const response = await request({ op, variables, options: executionOptions, requireReadReceipt: true })\n    return readOperationResponseWithReceipt<TData>({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration })\n  }\n  return { execute, executeWithReadReceipt, sql: variables => execute<SqlQueryResult>(BUILTIN_SQL_READ_HASH, variables) }\n}\n","import { OrmClientError, createFetchTransport, type OrmTransport } from './transport.js'\nimport { TableQuery } from './query-builder.js'\n\n/** Bindable scalar for `query()` placeholders ($1, $2, …). */\nexport type QueryParam = string | number | boolean | null\n\n/** Shape of one action in the generated `<Ns>Actions` map — params in, result out. */\nexport interface OrmActionShape {\n  readonly params?: Record<string, unknown>\n  readonly result: unknown\n}\n\n/** The generated `<Ns>Actions` map: action name → its param and result shapes. */\nexport type OrmActions = Record<string, OrmActionShape>\n\n/**\n * `action()`'s argument list: `params` is required when the action declares a\n * required field, optional otherwise. The empty-object type is assignable to\n * the params shape only when every field is optional, so that assignability is\n * the discriminant.\n */\ntype ActionArgs<Action extends OrmActionShape> =\n  Record<string, never> extends NonNullable<Action['params']>\n    ? [params?: NonNullable<Action['params']>]\n    : [params: NonNullable<Action['params']>]\n\n/**\n * Typed read client for one namespace's Data API. `Tables` comes from\n * `types.gen.ts` (wire types the apply refreshes from the YAML definitions),\n * so column names and row shapes are checked at compile time; the server\n * re-validates everything and Postgres RLS decides row visibility.\n *\n * ```ts\n * const client = createOrmClient<LendingTables>({ namespace: 'lending', baseUrl, getToken })\n * const rows = await client.table('loans').select('id', 'balance').gte('balance', 1000).rows()\n * const top = await client.query<{ officer: string; total: string }>(\n *   'select officer, sum(balance) as total from loans group by officer order by total desc limit $1',\n *   [5],\n * )\n * ```\n */\nexport interface OrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n> {\n  table<Name extends keyof Tables & string>(name: Name): TableQuery<Tables[Name]>\n  /**\n   * Raw read-only SQL for everything the filter grammar can't say —\n   * aggregates, joins, OR, expressions, CTEs. The same sandbox as every\n   * read: the namespace consumer role (grants stop at the namespace schema),\n   * Postgres RLS over the caller's claims, and a READ ONLY transaction —\n   * Postgres itself rejects writes, which stay on declared actions. Values\n   * bind as $1, $2, … placeholders; never interpolate them into the string.\n   */\n  query<Row = Record<string, unknown>>(sql: string, params?: readonly QueryParam[]): Promise<Row[]>\n  /**\n   * Invoke a declared action — the only write path the Data API exposes. The\n   * params and result are typed from the namespace's `<Ns>Actions`: an action\n   * with `returns:` resolves to `{ rows: Row[] }`, a count action to\n   * `{ rowsAffected: number }`.\n   */\n  action<Name extends keyof Actions & string>(\n    name: Name,\n    ...args: ActionArgs<Actions[Name]>\n  ): Promise<Actions[Name]['result']>\n}\n\nexport function createOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>({\n  namespace,\n  baseUrl,\n  getToken,\n  fetchImpl,\n  transport,\n  dataToken,\n}: {\n  namespace: string\n  baseUrl?: string\n  /** App-user / session bearer (CLI, browser). Mutually exclusive with dataToken. */\n  getToken?: () => Promise<string | null> | string | null\n  /**\n   * Delegated function data token — the inbound `ORM_DATA_TOKEN_HEADER` value a\n   * managed function receives. Pass it and the client authenticates as the\n   * invoking user, scoped to the function's declared refs; no manual transport.\n   */\n  dataToken?: string | (() => Promise<string | null> | string | null)\n  fetchImpl?: typeof globalThis.fetch\n  /** Injected transport (tests, bridges); overrides baseUrl/getToken/dataToken. */\n  transport?: OrmTransport\n}): OrmClient<Tables, Actions> {\n  const resolved =\n    transport ??\n    createFetchTransport({\n      baseUrl: requireOption(baseUrl, 'baseUrl'),\n      ...(dataToken !== undefined\n        ? { getDataToken: typeof dataToken === 'function' ? dataToken : () => dataToken }\n        : { getToken: requireOption(getToken, 'getToken') }),\n      fetchImpl,\n    })\n\n  return buildOrmClient<Tables, Actions>(resolved, namespace)\n}\n\n/**\n * The ESCALATION path — use only deliberately. A managed function receives a\n * separate *service* data token on `ORM_SERVICE_DATA_TOKEN_HEADER`; pass that\n * value here and the client authenticates as the function's SERVICE IDENTITY,\n * not the invoking user. Reads run with the service identity's grants (clamped\n * to the function's declared refs), NOT the caller's — so the caller's own row\n * visibility does not apply. The invoking user is still recorded for audit.\n *\n * Default to `createOrmClient` (acts as the invoking user, full per-user RLS).\n * Reach for this only when the function must intentionally act beyond the\n * caller — e.g. enforcing per-user rules in code over a coarse upstream that\n * has no granular permissions of its own. The distinct name is the guardrail:\n * choosing the service identity is always explicit and greppable.\n *\n * ```ts\n * const client = createServiceOrmClient<LendingTables>({\n *   namespace: 'lending',\n *   baseUrl,\n *   serviceDataToken: req.headers['x-sequence-data-token-service'],\n * })\n * ```\n */\nexport function createServiceOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>({\n  namespace,\n  baseUrl,\n  serviceDataToken,\n  fetchImpl,\n  transport,\n}: {\n  namespace: string\n  baseUrl?: string\n  /** The inbound `ORM_SERVICE_DATA_TOKEN_HEADER` value — the function's service token. */\n  serviceDataToken?: string | (() => Promise<string | null> | string | null)\n  fetchImpl?: typeof globalThis.fetch\n  /** Injected transport (tests, bridges); overrides baseUrl/serviceDataToken. */\n  transport?: OrmTransport\n}): OrmClient<Tables, Actions> {\n  const resolved =\n    transport ??\n    createFetchTransport({\n      baseUrl: requireOption(baseUrl, 'baseUrl'),\n      getDataToken:\n        typeof serviceDataToken === 'function'\n          ? serviceDataToken\n          : () => requireOption(serviceDataToken, 'serviceDataToken'),\n      fetchImpl,\n    })\n\n  return buildOrmClient<Tables, Actions>(resolved, namespace)\n}\n\n/** Shared client surface over a resolved transport — the token/identity choice is made by the factory above. */\nfunction buildOrmClient<\n  Tables extends Record<string, Record<string, unknown>>,\n  Actions extends OrmActions = OrmActions,\n>(resolved: OrmTransport, namespace: string): OrmClient<Tables, Actions> {\n  return {\n    table(name) {\n      return new TableQuery(resolved, namespace, name)\n    },\n    async query(sql, params) {\n      const payload = await resolved.post(`/api/data/${namespace}/query`, {\n        sql,\n        ...(params ? { params: [...params] } : {}),\n      })\n      if (!payload || typeof payload !== 'object' || !Array.isArray((payload as { rows?: unknown }).rows)) {\n        throw new OrmClientError('unexpected Data API response shape — missing rows array')\n      }\n      return (payload as { rows: never[] }).rows\n    },\n    async action(name, ...args) {\n      const payload = await resolved.post(`/api/data/${namespace}/actions/${name}`, args[0] ?? {})\n      if (payload && typeof payload === 'object') {\n        // A returns action responds with `rows`; a count action with\n        // `rows_affected` (mapped to `rowsAffected` for the client).\n        if (Array.isArray((payload as { rows?: unknown }).rows)) {\n          return { rows: (payload as { rows: unknown[] }).rows } as Awaited<ReturnType<OrmClient<Tables, Actions>['action']>>\n        }\n        if ('rows_affected' in payload) {\n          const rowsAffected = Number((payload as { rows_affected: unknown }).rows_affected)\n          if (!Number.isNaN(rowsAffected)) {\n            return { rowsAffected } as Awaited<ReturnType<OrmClient<Tables, Actions>['action']>>\n          }\n        }\n      }\n      throw new OrmClientError('unexpected action response shape — expected rows or rows_affected')\n    },\n  }\n}\n\nfunction requireOption<T>(value: T | undefined, name: string): T {\n  if (value === undefined) throw new Error(`createOrmClient requires ${name} when no transport is injected`)\n  return value\n}\n\nexport { TableQuery, type FilterValue, type ReadResponse } from './query-builder.js'\nexport { createFetchTransport, OrmClientError, type OrmTransport } from './transport.js'\n\nexport {\n  OrmOperationError,\n  configureOrmOperations,\n  createOperationExecutor,\n  createOrmFetch,\n  executeOperation,\n} from './operations.js'\nexport type {\n  ManifestOperation,\n  OperationErrorEntry,\n  OperationExecutor,\n  SqlOperationExecutor,\n  OperationReference,\n  TypedOperationExecutor,\n  TypedSqlOperationExecutor,\n  ReadReceiptOperationExecutor,\n  ReadReceiptSqlOperationExecutor,\n  TypedReadReceiptOperationExecutor,\n  TypedReadReceiptSqlOperationExecutor,\n  OperationReadReceipt,\n  OperationExecutionOptions,\n  OperationExecutorConfig,\n  OperationsManifest,\n} from './operations.js'\n\nexport { NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SERVICE_DATA_TOKEN_HEADER } from '../constants.js'\nexport type { SqlQueryParameter, SqlQueryVariables, SqlQueryResult } from './sql.js'\nexport { BUILTIN_SQL_READ_HASH } from './sql.js'\nexport {\n  createOperationExecutorWithTransport,\n  type OperationTransport, type OperationTransportRequest, type OperationTransportResponse,\n} from './transport-executor.js'\n"]}

package/dist/compiler.cjs

@@ -1314,14 +1314,21 @@ function normalizeCanonical(definition) {
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 
 // src/ir/index.ts
-var IR_VERSION = 5;
+var IR_VERSION = 6;
 var LEGACY_IR_VERSION = 1;
 var GUARDED_IR_VERSION = 2;
 var COMPOSED_IR_VERSION = 3;
 var SQL_IR_VERSION = 4;
 var RUNTIME_SQL_IR_VERSION = 5;
-var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION)]);
+var SERVICE_PRINCIPAL_IR_VERSION = 6;
+var irVersionSchema = zod.z.union([zod.z.literal(LEGACY_IR_VERSION), zod.z.literal(GUARDED_IR_VERSION), zod.z.literal(COMPOSED_IR_VERSION), zod.z.literal(SQL_IR_VERSION), zod.z.literal(RUNTIME_SQL_IR_VERSION), zod.z.literal(SERVICE_PRINCIPAL_IR_VERSION)]);
 var operationVersionSchema = zod.z.object({ irVersion: irVersionSchema });
+function usesServicePrincipal(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(usesServicePrincipal);
+  const row = value;
+  return row.kind === "servicePrincipal" || Object.values(row).some(usesServicePrincipal);
+}
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
   for (const operation of operations) {
@@ -1381,6 +1388,7 @@ var predIrSchema = zod.z.lazy(
     zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string(), namespace: zod.z.string().optional() }),
     zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("servicePrincipal") }).strict(),
     zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
   ])
 );
@@ -1606,7 +1614,7 @@ var variableIrSchema = zod.z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
-var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: zod.z.boolean() });
+var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
@@ -1644,6 +1652,9 @@ var compiledOperationSchema = zod.z.object({
   tableSet: zod.z.array(zod.z.string()).min(1),
   roots: zod.z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(operation.roots)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (operation.language === "sql") {
     const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
     const builtin = operation.name === "BuiltinSqlRead" && operation.opHash === BUILTIN_SQL_READ_HASH && operation.requires === null;
@@ -1776,6 +1787,9 @@ var compiledArtifactSchema = zod.z.object({
   tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
   operations: zod.z.record(zod.z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
+  if (artifact.irVersion < SERVICE_PRINCIPAL_IR_VERSION && usesServicePrincipal(artifact)) {
+    ctx.addIssue({ code: "custom", message: "servicePrincipal() requires IR v6" });
+  }
   if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
     ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
   }
@@ -2066,6 +2080,12 @@ var Parser2 = class {
       }
       return node;
     }
+    if (this.peekKeyword("servicePrincipal") && this.tokens[this.index + 1]?.kind === "lparen") {
+      this.advance();
+      this.expect("lparen", "'(' after servicePrincipal");
+      this.expect("rparen", "')' closing servicePrincipal()");
+      return { kind: "servicePrincipal" };
+    }
     if (this.peekKeyword("exists")) return this.parseExists();
     if (this.peekKeyword("visible") && this.tokens[this.index + 1]?.kind === "lparen") return this.parseVisible();
     return this.parseComparison();
@@ -2278,6 +2298,8 @@ var PolicyCompiler = class _PolicyCompiler {
         return { kind: "capability", key: node.key };
       case "role":
         return { kind: "role", key: node.key };
+      case "servicePrincipal":
+        return { kind: "servicePrincipal" };
       case "exists":
         return this.compileExists(node.path, node.where, table, depth);
       case "visible":
@@ -2973,7 +2995,10 @@ function platformUserMeta() {
     { name: "role", columnName: "role", type: "text", nullable: true },
     { name: "managerId", columnName: "manager_id", type: "text", nullable: true },
     // NOT NULL DEFAULT true on chat.users, so non-null through the view.
-    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false }
+    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false },
+    { name: "canonicalSub", columnName: "canonical_sub", type: "text", nullable: false },
+    { name: "normalizedEmail", columnName: "normalized_email", type: "text", nullable: true },
+    { name: "emailDomain", columnName: "email_domain", type: "text", nullable: true }
   ];
   return {
     table: "users_directory",
@@ -4960,7 +4985,7 @@ function compileNamespace({ canonical, sdl, documents }) {
           }
         }
         operations[restricted.name] = {
-          irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
+          irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
           name: restricted.name,
           opHash: computeOpHash({ definition: flattened, schemaHash }),
           kind: restricted.kind,
@@ -4987,7 +5012,7 @@ function compileNamespace({ canonical, sdl, documents }) {
   }
   if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
   const artifact = {
-    irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
+    irVersion: usesServicePrincipal([...ctx.readPolicies.values(), ...ctx.writePolicies.values(), ...ctx.insertPolicies.values(), ...ctx.updatePolicies.values(), ...Object.values(operations)]) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
     namespace: ctx.namespace,
     schemaHash,
     ownSchemaHash: computeSchemaHash(localContract(canonical)),
@@ -5424,6 +5449,8 @@ function compilePredIrToSql(pred, options = {}) {
       return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
     case "cmp":
       return compileCmp(pred.op, pred.column, pred.value, options);
+    case "servicePrincipal":
+      return `coalesce(${claimExpression("servicePrincipal")} = 'true', false)`;
     case "capability":
       return `(${options.statementClaimChecks ? "SELECT " : ""}${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
     case "role":
@@ -5526,6 +5553,39 @@ function compileArrayValue(value, columnType, _options) {
   return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
 }
 
+// src/compiler/static-policy-sql.ts
+function compileStaticPolicySql({ table, predicate, tables, namespace, alias, rootRelation, statementClaimChecks, onRead }) {
+  let sequence = 0;
+  const aliases = new Set([alias, rootRelation].filter((value) => value !== void 0));
+  const column = (meta, qualifier, name2) => {
+    const found = meta.columns.find((c) => c.name === name2 || c.columnName === name2);
+    if (!found) throw new OrmDefinitionError("Static policy relationship column is unavailable");
+    return `${quoteIdentifier(qualifier)}.${quoteIdentifier(found.columnName)}`;
+  };
+  const render = (meta, pred, qualifier, outerRelation) => compilePredIrToSql(pred, {
+    alias: qualifier,
+    namespace: meta.namespace ?? namespace,
+    statementClaimChecks,
+    columnNames: Object.fromEntries(meta.columns.map((c) => [c.name, c.columnName])),
+    columnTypes: Object.fromEntries(meta.columns.map((c) => [c.name, c.type])),
+    exists: (node) => {
+      const link = meta.links.find((candidate) => candidate.name === node.link);
+      const target = link?.target ? tables[link.target] : void 0;
+      const parent = qualifier ?? outerRelation;
+      if (!link || !target || !parent) throw new OrmDefinitionError("Static policy relationship metadata is unavailable");
+      onRead?.(target);
+      let child;
+      do {
+        child = `policy_${++sequence}`;
+      } while (aliases.has(child));
+      aliases.add(child);
+      const join = link.kind === "toMany" ? `${column(target, child, link.on)} = ${column(meta, parent, link.references)}` : `${column(meta, parent, link.on)} = ${column(target, child, link.references)}`;
+      return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join} AND (${render(target, node.where, child)}))`;
+    }
+  });
+  return render(table, predicate, alias, rootRelation);
+}
+
 // src/sql/catalog.ts
 function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -5546,27 +5606,6 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
     const meta = Object.values(ctx.tables).find((table) => refOf(table) === ref);
     if (!meta || internal.has(ref) || meta.namespace !== canonical.namespace && !meta.exportRead) throw new Error(`SQL object not published: ${ref}`);
     const reads = /* @__PURE__ */ new Set([ref]);
-    let sequence = 0;
-    const predicate = (table, pred, alias) => compilePredIrToSql(pred, {
-      alias,
-      namespace: table.namespace ?? canonical.namespace,
-      columnNames: Object.fromEntries(table.columns.map((c) => [c.name, c.columnName])),
-      columnTypes: Object.fromEntries(table.columns.map((c) => [c.name, c.type])),
-      exists: (node) => {
-        const link = table.links.find((candidate) => candidate.name === node.link);
-        const target = link?.target ? ctx.tables[link.target] : void 0;
-        if (!link || !target) throw new Error("SQL policy link is unavailable");
-        reads.add(refOf(target));
-        const child = `p${++sequence}`;
-        const col = (t, a, name2) => {
-          const c = t.columns.find((c2) => c2.name === name2 || c2.columnName === name2);
-          if (!c) throw new Error("SQL policy column is unavailable");
-          return `${quoteIdentifier(a)}.${quoteIdentifier(c.columnName)}`;
-        };
-        const join = link.kind === "toMany" ? `${col(target, child, link.on)} = ${col(table, alias, link.references)}` : `${col(table, alias, link.on)} = ${col(target, child, link.references)}`;
-        return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join} AND (${predicate(target, node.where, child)}))`;
-      }
-    });
     const columns = meta.columns.filter((c) => meta.filterable.includes(c.name)).map((c) => ({
       name: c.name,
       type: typeof c.type === "string" ? c.type : "text",
@@ -5577,7 +5616,7 @@ function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
       return `${quoteIdentifier("p0")}.${quoteIdentifier(physical.columnName)}${typeof physical.type === "object" ? "::text" : ""} AS ${quoteIdentifier(c.name)}`;
     }).join(", ");
     const policy = ctx.readPolicies.get(meta.table) ?? { kind: "const", value: true };
-    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${predicate(meta, policy, "p0")}`;
+    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${compileStaticPolicySql({ table: meta, predicate: policy, tables: ctx.tables, namespace: canonical.namespace, alias: "p0", onRead: (target) => reads.add(refOf(target)) })}`;
     return { ref, table: meta.table, columns, scan, read: [...reads].sort() };
   });
   return { identity, objects };
@@ -6370,7 +6409,7 @@ function compileDatasetPreviews(input) {
     }
     const hash = crypto.createHash("sha256").update("sequence-orm-dataset-preview-v1\0").update(stableJson({ schemaHash, roots, tableSet })).digest("hex");
     operations[relation.table] = compiledOperationSchema.parse({
-      irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : LEGACY_IR_VERSION,
+      irVersion: usesServicePrincipal(roots) ? SERVICE_PRINCIPAL_IR_VERSION : canonical.imports?.length ? COMPOSED_IR_VERSION : LEGACY_IR_VERSION,
       name: `DatasetPreview_${relation.table}`,
       opHash: `sha256:${hash}`,
       kind: "query",