@nodaro/sdk 2.28.0 → 2.29.0

package/dist/index.cjs

@@ -188,36 +188,57 @@ var JobHeldError = class extends NodaroError {
   }
   jobId;
 };
+var finite = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+var BARE_CODE = /^[a-z][a-z0-9_]*$/;
+var nonEmpty = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+function readErrorBody(status, body) {
+  const raw = body.error;
+  const envelope = raw && typeof raw === "object" ? raw : {};
+  const bare = typeof raw === "string" ? raw : void 0;
+  const bareCode = bare !== void 0 && BARE_CODE.test(bare) ? bare : void 0;
+  const bareSentence = bare !== void 0 && bareCode === void 0 && /\s/.test(bare.trim()) ? bare : void 0;
+  const code = nonEmpty(envelope.code) ?? bareCode ?? (status === 400 && raw === void 0 && Array.isArray(body.issues) ? "validation_error" : void 0);
+  const outside = status >= 500 ? void 0 : nonEmpty(body.message) ?? nonEmpty(body.error_description) ?? bareSentence;
+  const message = nonEmpty(envelope.message) ?? outside;
+  return { code, message, envelope };
+}
 function throwFromResponse(status, body) {
-  const code = body.error?.code ?? "internal_error";
-  const message = body.error?.message ?? "Request failed";
-  if (status === 401) throw new UnauthorizedError(message);
+  const parsed = body && typeof body === "object" ? body : {};
+  const read = readErrorBody(status, parsed);
+  const envelope = read.envelope;
+  const code = read.code ?? "internal_error";
+  const message = read.message ?? (read.code ? read.code : "Request failed");
+  if (status === 401) throw new UnauthorizedError(read.message);
   if (status === 409 && (code === "workflow_conflict" || code === "production_busy")) {
     throw new WorkflowConflictError(
-      message,
-      body.error?.currentUpdatedAt,
-      body.error?.currentVersion,
-      body.error?.currentRecord,
+      read.message,
+      envelope.currentUpdatedAt,
+      envelope.currentVersion,
+      envelope.currentRecord,
       code
     );
   }
-  if (status >= 400 && status < 500 && typeof body.error?.opIndex === "number") {
-    throw new StudioOpError(message, code, status, body.error.opIndex);
+  if (status >= 400 && status < 500 && typeof envelope.opIndex === "number") {
+    throw new StudioOpError(message, code, status, envelope.opIndex);
   }
-  if (status === 409 && CONTINUATION_REFUSAL_CODES.has(code) && typeof body.jobId === "string") {
-    throw new ContinuationRefusedError(message, code, body.jobId);
+  if (status === 409 && CONTINUATION_REFUSAL_CODES.has(code) && typeof parsed.jobId === "string") {
+    throw new ContinuationRefusedError(message, code, parsed.jobId);
   }
-  if (status === 422 && code === "job_blocked") throw new JobBlockedError(message);
+  if (status === 422 && code === "job_blocked") throw new JobBlockedError(read.message);
   if (status === 403 && code === "insufficient_scope") {
-    throw new ForbiddenError(message, body.error?.missingScope);
+    throw new ForbiddenError(read.message, envelope.missingScope);
   }
-  if (status === 403) throw new ForbiddenError(message);
-  if (status === 404) throw new NotFoundError(body.error?.message ?? (typeof body.message === "string" ? body.message : void 0));
-  if (status === 429) throw new RateLimitedError(message);
+  if (status === 403) throw new ForbiddenError(read.message);
+  if (status === 404) throw new NotFoundError(read.message);
+  if (status === 429) throw new RateLimitedError(read.message);
   if (status === 402) {
-    throw new InsufficientCreditsError(message, body.error?.required, body.error?.available);
+    throw new InsufficientCreditsError(
+      read.message,
+      finite(envelope.required) ?? finite(parsed.required),
+      finite(envelope.available) ?? finite(parsed.balance)
+    );
   }
-  if (status === 413) throw new StorageExceededError(message, body.error?.limitBytes);
+  if (status === 413) throw new StorageExceededError(read.message, envelope.limitBytes);
   throw new NodaroError(message, code, status);
 }
 
@@ -507,6 +528,10 @@ var SessionsResource = class {
 };
 
 // src/resources/jobs.ts
+function listParam(value) {
+  if (value === void 0) return void 0;
+  return typeof value === "string" ? value : value.join(",");
+}
 var JobsResource = class {
   constructor(client) {
     this.client = client;
@@ -520,9 +545,26 @@ var JobsResource = class {
    * Your jobs, newest first (`GET /v1/jobs`), cursor-paginated. `type` and
    * `origin` filter on the job's own `input_data`, which every job carries —
    * a client app lists its runs with `{ type: "llm-structured", origin: "studio" }`.
+   * `status` and `type` take one value or a list; `favorited` and `rating`
+   * filter on your own marks. Every filter combines with AND, and each job
+   * carries `favorited` and `rating`.
    */
   list(params = {}) {
-    return this.client.request("GET", "/v1/jobs", { query: { ...params } });
+    const { status, type, ...rest } = params;
+    return this.client.request("GET", "/v1/jobs", {
+      query: { ...rest, status: listParam(status), type: listParam(type) }
+    });
+  }
+  /**
+   * Rate one of your jobs `"good"` or `"bad"`, or clear the rating with
+   * `null` (`PUT /v1/jobs/:id/rating`). Only the job's owner rates it — anyone
+   * else's job is a `NotFoundError`. The rating reads back as `Job.rating`
+   * and filters {@link list}. OAuth apps need the `assets:write` scope.
+   */
+  rate(id, rating) {
+    return this.client.request("PUT", `/v1/jobs/${encodeURIComponent(id)}/rating`, {
+      body: { rating }
+    });
   }
   /**
    * Get the lean status of a single job (poll-loop friendly).
@@ -649,6 +691,26 @@ function extractJobId(result, label) {
   }
   throw new JobFailedError(`${label} did not return a jobId`, "");
 }
+function isImageBatchRequest(type, params) {
+  if (type !== "generate-image") return false;
+  return typeof params.count === "number" && params.count > 1 || Array.isArray(params.models);
+}
+function batchJobIds(result) {
+  const ids = result?.jobIds;
+  return Array.isArray(ids) && ids.every((id) => typeof id === "string") ? ids : null;
+}
+function batchRefusal(detail) {
+  return new NodaroError(
+    `${detail}: this waits for one job \u2014 use nodes.runBatchAndWait() for a batch (count above 1, or models).`,
+    "batch_requires_run_batch_and_wait",
+    0
+  );
+}
+function batchResultOf(result) {
+  const r = result;
+  if (!r || typeof r.batchId !== "string" || !batchJobIds(result) || !Array.isArray(r.groups)) return null;
+  return r;
+}
 var NodesResource = class {
   constructor(client) {
     this.client = client;
@@ -681,10 +743,55 @@ var NodesResource = class {
   }
   async runAndWait(type, params = {}, opts = {}) {
     if (opts.signal?.aborted) throw new JobAbortedError();
+    if (isImageBatchRequest(type, params)) throw batchRefusal(`${type} with count above 1 or models makes several jobs`);
     const result = await this.run(type, params, { idempotencyKey: opts.idempotencyKey });
+    const ids = batchJobIds(result);
+    if (ids && ids.length > 1) throw batchRefusal(`${type} started ${ids.length} jobs (${ids.join(", ")}), which keep running`);
     const jobId = extractJobId(result, type);
     return this.pollJob(jobId, type, opts);
   }
+  /**
+   * Run a generate-image BATCH — `count` above 1 and/or `models` — to the end:
+   * submit it once ({@link run}, with your `idempotencyKey` if any), then wait
+   * for every job at once, each the way {@link runAndWait} waits.
+   *
+   * Resolves `{ batch, results }`: the submit's answer
+   * ({@link GenerateImageBatchResult} — ids, groups by model, credits) and one
+   * {@link BatchJobOutcome} per job, in `batch.jobIds` order — its output, or the
+   * typed error that ended the wait for it. One image failing never discards the
+   * others. Rejects only before any job exists (the submit's own errors, e.g.
+   * `InsufficientCreditsError` with the batch total as `required`), and on
+   * `signal` ({@link JobAbortedError}; `cancelOnAbort` cancels every job).
+   *
+   * A request for one image is refused before anything is sent (code
+   * `not_a_batch`) — wait for it with {@link runAndWait}.
+   */
+  async runBatchAndWait(type, params, opts = {}) {
+    if (opts.signal?.aborted) throw new JobAbortedError();
+    if (!isImageBatchRequest(type, params)) {
+      throw new NodaroError(
+        "runBatchAndWait waits for a batch \u2014 count above 1, or models; wait for one image with nodes.runAndWait().",
+        "not_a_batch",
+        0
+      );
+    }
+    const result = await this.run(type, params, { idempotencyKey: opts.idempotencyKey });
+    const batch = batchResultOf(result);
+    if (!batch) throw new JobFailedError(`${type} did not answer with a batch`, "");
+    const modelOf = new Map(batch.groups.flatMap((group) => group.jobIds.map((id) => [id, group.model])));
+    const results = await Promise.all(
+      batch.jobIds.map(async (jobId) => {
+        const model = modelOf.get(jobId) ?? "";
+        try {
+          return { jobId, model, status: "completed", output: await this.pollJob(jobId, type, opts) };
+        } catch (err) {
+          if (err instanceof JobAbortedError || !(err instanceof NodaroError)) throw err;
+          return { jobId, model, status: "error", error: err };
+        }
+      })
+    );
+    return { batch, results };
+  }
   /**
    * Fan out N async runs of the same node `type` to completion concurrently —
    * the candidate-grid path (generate N stills/clips in parallel). Each runs
@@ -700,6 +807,9 @@ var NodesResource = class {
    */
   async runMany(type, paramsList, opts = {}) {
     if (opts.signal?.aborted) throw new JobAbortedError();
+    if (paramsList.some((params) => isImageBatchRequest(type, params))) {
+      throw batchRefusal(`a ${type} entry with count above 1 or models makes several jobs`);
+    }
     return Promise.all(
       paramsList.map(async (params) => {
         if (opts.signal?.aborted) throw new JobAbortedError();
@@ -1016,6 +1126,66 @@ var OAuthResource = class {
   }
 };
 
+// src/resources/webhooks.ts
+var WebhooksResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** `POST /v1/webhook-endpoints` → the endpoint and its signing secret (shown this once). */
+  create(input) {
+    return this.client.request("POST", "/v1/webhook-endpoints", { body: input });
+  }
+  /** `GET /v1/webhook-endpoints` → your endpoints, newest first. Never a secret. */
+  list() {
+    return this.client.request("GET", "/v1/webhook-endpoints");
+  }
+  /** `GET /v1/webhook-endpoints/:id`. */
+  get(id) {
+    return this.client.request("GET", `/v1/webhook-endpoints/${encodeURIComponent(id)}`);
+  }
+  /** `PATCH /v1/webhook-endpoints/:id` → change the address, events, description; switch on or off. */
+  update(id, input) {
+    return this.client.request("PATCH", `/v1/webhook-endpoints/${encodeURIComponent(id)}`, { body: input });
+  }
+  /** `DELETE /v1/webhook-endpoints/:id` → the endpoint and its delivery log. */
+  delete(id) {
+    return this.client.request("DELETE", `/v1/webhook-endpoints/${encodeURIComponent(id)}`);
+  }
+  /**
+   * `POST /v1/webhook-endpoints/:id/rotate-secret` → a new signing secret,
+   * shown this once. It signs every delivery from now on (retries included);
+   * the one it replaces keeps signing beside it for `gracePeriodSeconds` (a
+   * day by default), so update your receiver within that time.
+   */
+  rotateSecret(id, input = {}) {
+    return this.client.request("POST", `/v1/webhook-endpoints/${encodeURIComponent(id)}/rotate-secret`, {
+      body: input
+    });
+  }
+  /** `GET /v1/webhook-endpoints/:id/deliveries` → the delivery log, newest first (kept 30 days). */
+  deliveries(id, params = {}) {
+    return this.client.request("GET", `/v1/webhook-endpoints/${encodeURIComponent(id)}/deliveries`, {
+      query: { status: params.status, limit: params.limit, cursor: params.cursor }
+    });
+  }
+  /** `GET /v1/webhook-endpoints/:id/deliveries/:deliveryId` → one delivery (`test()` returns its id). */
+  getDelivery(id, deliveryId) {
+    return this.client.request(
+      "GET",
+      `/v1/webhook-endpoints/${encodeURIComponent(id)}/deliveries/${encodeURIComponent(deliveryId)}`
+    );
+  }
+  /**
+   * `POST /v1/webhook-endpoints/:id/test` → queue a `ping` (sent within
+   * seconds, tried once — even to an endpoint that is switched off). Follow
+   * it with `deliveries()`.
+   */
+  test(id) {
+    return this.client.request("POST", `/v1/webhook-endpoints/${encodeURIComponent(id)}/test`);
+  }
+};
+
 // src/resources/apps.ts
 var AppsResource = class {
   constructor(client) {
@@ -1089,7 +1259,7 @@ var CharactersResource = class {
    * List the caller's characters. By default returns active characters only;
    * pass `archived: true` to fetch soft-deleted rows for an "archive" view.
    * When `projectId` is set, only characters belonging to that project are
-   * returned.
+   * returned; `q` keeps the ones whose name or description contains it.
    *
    * Cursor-paginated: a response carrying a non-null `nextCursor` means more
    * rows exist. Pass it back as `cursor` to fetch the next page, and keep going
@@ -1111,6 +1281,7 @@ var CharactersResource = class {
     const query = {};
     if (params.projectId) query.projectId = params.projectId;
     if (params.archived) query.archived = "true";
+    if (params.q) query.q = params.q;
     if (params.limit !== void 0) query.limit = String(params.limit);
     if (params.cursor) query.cursor = params.cursor;
     return this.client.request("GET", "/v1/characters", { query });
@@ -1243,6 +1414,41 @@ var CharactersResource = class {
       `/v1/characters/${encodeURIComponent(id)}/llm-caption`
     );
   }
+  /**
+   * Start training a high-fidelity model of the character on its own images
+   * (Nodaro Cloud only — other editions answer `NotFoundError`). Reserves the
+   * training price up front and refunds it if the training fails or is
+   * cancelled. Resolves at once (202); a training takes about 15 minutes —
+   * follow it with {@link trainingStatus}. Once it succeeds, a workflow's
+   * Generate Image node whose prompt @-mentions this one character runs on the
+   * trained model.
+   *
+   * An OAuth app token needs the `assets:write` scope (`ForbiddenError`
+   * otherwise, before anything is reserved); a session or personal API key
+   * needs none. Refusals are `NodaroError`s whose `code` is a
+   * {@link TrainCharacterRefusalCode}; rate-limited to 3 calls a minute.
+   */
+  train(id, input = {}) {
+    return this.client.request("POST", `/v1/characters/${encodeURIComponent(id)}/train`, { body: input });
+  }
+  /**
+   * The character's training record (Nodaro Cloud only). Poll it while
+   * `status` is `queued` or `training` — every 10 s or so is plenty.
+   */
+  trainingStatus(id) {
+    return this.client.request("GET", `/v1/characters/${encodeURIComponent(id)}/training`);
+  }
+  /**
+   * Remove the character's trained model (Nodaro Cloud only): cancels a
+   * training in flight and refunds its reservation, deletes the model, and
+   * clears the training record (`trainingStatus` then reads `untrained`).
+   * Generations go back to reference images. Cannot be undone — a new model
+   * means a new, paid training. An OAuth app token needs the `assets:write`
+   * scope (`ForbiddenError` otherwise), like deleting the character.
+   */
+  async deleteLora(id) {
+    await this.client.request("DELETE", `/v1/characters/${encodeURIComponent(id)}/lora`);
+  }
 };
 function buildPersonSeedPrompt(value) {
   return person.buildPersonHints(value).join(", ");
@@ -1254,11 +1460,13 @@ var LocationsResource = class {
   client;
   /**
    * List the caller's locations. By default returns active locations only;
-   * pass `archived: true` to fetch soft-deleted rows for an "archive" view.
+   * pass `archived: true` to fetch soft-deleted rows for an "archive" view,
+   * and `q` to keep the ones whose name or description contains it.
    */
   list(params = {}) {
     const query = {};
     if (params.archived) query.archived = "true";
+    if (params.q) query.q = params.q;
     if (params.limit !== void 0) query.limit = String(params.limit);
     if (params.cursor) query.cursor = params.cursor;
     return this.client.request("GET", "/v1/locations", { query });
@@ -1432,12 +1640,14 @@ var ObjectsResource = class {
   /**
    * List the caller's objects. By default returns active objects only;
    * pass `archived: true` to fetch soft-deleted rows for an "archive" view.
-   * Optional `projectId` scopes the result to a single project.
+   * Optional `projectId` scopes the result to a single project; `q` keeps the
+   * objects whose name or description contains it.
    */
   list(params = {}) {
     const query = {};
     if (params.archived) query.archived = "true";
     if (params.projectId) query.projectId = params.projectId;
+    if (params.q) query.q = params.q;
     if (params.limit !== void 0) query.limit = String(params.limit);
     if (params.cursor) query.cursor = params.cursor;
     return this.client.request("GET", "/v1/objects", { query });
@@ -1618,12 +1828,14 @@ var CreaturesResource = class {
   /**
    * List the caller's creatures. By default returns active creatures only;
    * pass `archived: true` to fetch soft-deleted rows for an "archive" view.
-   * Optional `projectId` scopes the result to a single project.
+   * Optional `projectId` scopes the result to a single project; `q` keeps the
+   * creatures whose name or description contains it.
    */
   list(params = {}) {
     const query = {};
     if (params.archived) query.archived = "true";
     if (params.projectId) query.projectId = params.projectId;
+    if (params.q) query.q = params.q;
     if (params.limit !== void 0) query.limit = String(params.limit);
     if (params.cursor) query.cursor = params.cursor;
     return this.client.request("GET", "/v1/creatures", { query });
@@ -2747,6 +2959,53 @@ var CreditsResource = class {
   // a consumer needs it, shaped to that need.
 };
 
+// src/resources/billing.ts
+var BillingResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * `GET /v1/billing/plans` → the plans and credit packs on sale, with their
+   * prices. Public: works with no credential, the same for every caller.
+   * Nodaro Cloud only — a self-hosted instance answers 404. Throws on `403
+   * self_serve_disabled` (this deployment does not sell to its users) and on
+   * `503` (`stripe_not_configured`, or prices briefly unavailable).
+   */
+  plans() {
+    return this.client.request("GET", "/v1/billing/plans");
+  }
+  /**
+   * `GET /v1/billing/subscription` → the account's latest subscription
+   * (`null` when it never subscribed) and the tier its entitlements follow.
+   * Match `effectiveTier` to a {@link BillingPlan} `id` to mark the current
+   * plan (no match: pay-as-you-go, or a tier not on sale). Needs a signed-in
+   * session, a personal API token without a workflow limit, or an app's OAuth
+   * token. Nodaro Cloud only — a self-hosted instance answers 404.
+   */
+  subscription() {
+    return this.client.request("GET", "/v1/billing/subscription");
+  }
+  /**
+   * `GET /v1/billing/surface` → how this deployment bills: whether it meters
+   * at all (`providerId !== "none"`) and in which unit costs display. Public,
+   * every edition.
+   */
+  async surface() {
+    const res = await this.client.request("GET", "/v1/billing/surface");
+    return res.data;
+  }
+  /**
+   * `GET /v1/billing/account` → the caller's plan and balance as the
+   * deployment's billing provider reports them, in its display unit. `null`
+   * when the provider could not answer — not a zero balance. Every edition.
+   */
+  async account() {
+    const res = await this.client.request("GET", "/v1/billing/account");
+    return res.data;
+  }
+};
+
 // src/resources/uploads.ts
 var UploadsResource = class {
   constructor(client) {
@@ -2782,14 +3041,15 @@ var LibraryResource = class {
   /**
    * `GET /v1/library` → a page of the caller's media assets (newest first) plus
    * a `nextCursor`. Pass the returned `nextCursor` back as `cursor` for the next
-   * page. Filter by `type` and a filename `search`; `owned: true` returns the
-   * full Storage set (uploads + generations), the default only library-saved +
-   * shared items.
+   * page. Filter by `type` and search the filename with `q`; `owned: true`
+   * returns the full Storage set (uploads + generations), the default only
+   * library-saved + shared items.
    */
   list(params = {}) {
     const qs = new URLSearchParams();
     if (params.type) qs.set("type", params.type);
-    if (params.search) qs.set("search", params.search);
+    if (params.q) qs.set("q", params.q);
+    else if (params.search) qs.set("search", params.search);
     if (params.limit !== void 0) qs.set("limit", String(params.limit));
     if (params.cursor) qs.set("cursor", params.cursor);
     if (params.owned !== void 0) qs.set("owned", String(params.owned));
@@ -2799,6 +3059,46 @@ var LibraryResource = class {
   }
 };
 
+// src/resources/gallery.ts
+var GalleryResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * `GET /v1/gallery` → a page of the public gallery, newest first (no auth
+   * needed), or one person's work with `userId`.
+   */
+  browse(params = {}) {
+    return this.client.request("GET", "/v1/gallery", {
+      query: {
+        type: params.type,
+        userId: params.userId,
+        favoritesOnly: params.favoritesOnly,
+        limit: params.limit,
+        cursor: params.cursor
+      }
+    });
+  }
+  /**
+   * Favorite a job, or un-favorite it when it already is
+   * (`POST /v1/gallery/favorite`). You can favorite your own jobs and public
+   * ones; another person's private job is a `NotFoundError`. OAuth apps need
+   * the `assets:write` scope.
+   */
+  toggleFavorite(jobId) {
+    return this.client.request("POST", "/v1/gallery/favorite", { body: { jobId } });
+  }
+  /**
+   * Your favorited job ids, newest first (`GET /v1/gallery/favorites`). OAuth
+   * apps need the `assets:read` or `jobs:read` scope.
+   */
+  async favorites() {
+    const res = await this.client.request("GET", "/v1/gallery/favorites");
+    return res.data;
+  }
+};
+
 // src/resources/node-presets.ts
 var PresetsResource = class {
   constructor(client) {
@@ -2834,6 +3134,76 @@ var PresetsResource = class {
       `/v1/node-presets/factory?nodeType=${encodeURIComponent(nodeType)}`
     );
   }
+  /** `POST /v1/node-presets` → the new preset. */
+  async create(input) {
+    const res = await this.client.request("POST", "/v1/node-presets", { body: input });
+    return res.data;
+  }
+  /**
+   * `PATCH /v1/node-presets/:id` → the updated preset. Pass the `updatedAt` you
+   * read as `expectedUpdatedAt` to refuse (409 `conflict`) a change made
+   * elsewhere since.
+   */
+  async update(id, patch, opts = {}) {
+    const body = opts.expectedUpdatedAt ? { ...patch, expectedUpdatedAt: opts.expectedUpdatedAt } : patch;
+    const res = await this.client.request("PATCH", `/v1/node-presets/${encodeURIComponent(id)}`, { body });
+    return res.data;
+  }
+  /** `DELETE /v1/node-presets/:id` (404 when it is not yours). `expectedUpdatedAt` as on `update`. */
+  async delete(id, opts = {}) {
+    const res = await this.client.request("DELETE", `/v1/node-presets/${encodeURIComponent(id)}`, {
+      query: { expectedUpdatedAt: opts.expectedUpdatedAt }
+    });
+    return res.data;
+  }
+  /**
+   * `POST /v1/node-presets/import` — up to 500 presets in one call. A name you
+   * already use gets an "(imported N)" suffix; a preset whose data is empty
+   * after stripping runtime keys is skipped.
+   */
+  async import(presets) {
+    const res = await this.client.request("POST", "/v1/node-presets/import", { body: { presets } });
+    return res.data;
+  }
+  /** `POST /v1/node-presets/reorder` — positions (and group membership) for many presets and groups at once. */
+  async reorder(input) {
+    const res = await this.client.request("POST", "/v1/node-presets/reorder", { body: input });
+    return res.data;
+  }
+  /** `GET /v1/node-presets/favorites` → your favorite preset ids for `nodeType`, newest first. */
+  async favorites(nodeType) {
+    const res = await this.client.request("GET", "/v1/node-presets/favorites", { query: { nodeType } });
+    return res.data;
+  }
+  /** `POST /v1/node-presets/favorites` — idempotent. */
+  async addFavorite(input) {
+    const res = await this.client.request("POST", "/v1/node-presets/favorites", { body: input });
+    return res.data;
+  }
+  /** `DELETE /v1/node-presets/favorites` — idempotent. */
+  async removeFavorite(input) {
+    const res = await this.client.request("DELETE", "/v1/node-presets/favorites", {
+      query: { nodeType: input.nodeType, presetId: input.presetId }
+    });
+    return res.data;
+  }
+  /** `POST /v1/node-preset-groups` → the new folder or section. */
+  async createGroup(input) {
+    const res = await this.client.request("POST", "/v1/node-preset-groups", { body: input });
+    return res.data;
+  }
+  /** `PATCH /v1/node-preset-groups/:id` → the renamed or moved group. */
+  async updateGroup(id, patch) {
+    const res = await this.client.request("PATCH", `/v1/node-preset-groups/${encodeURIComponent(id)}`, {
+      body: patch
+    });
+    return res.data;
+  }
+  /** `DELETE /v1/node-preset-groups/:id` — its presets move out of the group; none are deleted. */
+  async deleteGroup(id) {
+    const res = await this.client.request("DELETE", `/v1/node-preset-groups/${encodeURIComponent(id)}`);
+    return res.data;
+  }
 };
 
 // src/resources/saved-posts.ts
@@ -2974,6 +3344,68 @@ var CollectionsResource = class {
   }
 };
 
+// src/resources/palettes.ts
+var PALETTE_DIRECTION_PREFIX = "palette:";
+function paletteDirectionId(id) {
+  return `${PALETTE_DIRECTION_PREFIX}${id}`;
+}
+var PalettesResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Your palettes, newest first. Page with `nextCursor`. */
+  list(params = {}) {
+    return this.client.request("GET", "/v1/palettes", {
+      query: { limit: params.limit, cursor: params.cursor }
+    });
+  }
+  get(id) {
+    return this.client.request("GET", `/v1/palettes/${encodeURIComponent(id)}`);
+  }
+  create(input) {
+    return this.client.request("POST", "/v1/palettes", { body: input });
+  }
+  update(id, input) {
+    return this.client.request("PATCH", `/v1/palettes/${encodeURIComponent(id)}`, { body: input });
+  }
+  /** A run that still names the palette answers 404 `direction_not_found`. */
+  async delete(id) {
+    await this.client.request("DELETE", `/v1/palettes/${encodeURIComponent(id)}`);
+  }
+};
+
+// src/resources/moodboards.ts
+var MOODBOARD_DIRECTION_PREFIX = "moodboard:";
+function moodboardDirectionId(id) {
+  return `${MOODBOARD_DIRECTION_PREFIX}${id}`;
+}
+var MoodboardsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Your moodboards, newest first. Page with `nextCursor`. */
+  list(params = {}) {
+    return this.client.request("GET", "/v1/moodboards", {
+      query: { limit: params.limit, cursor: params.cursor }
+    });
+  }
+  get(id) {
+    return this.client.request("GET", `/v1/moodboards/${encodeURIComponent(id)}`);
+  }
+  create(input) {
+    return this.client.request("POST", "/v1/moodboards", { body: input });
+  }
+  update(id, input) {
+    return this.client.request("PATCH", `/v1/moodboards/${encodeURIComponent(id)}`, { body: input });
+  }
+  /** Deletes the moodboard only; the images it links to are untouched. */
+  async delete(id) {
+    await this.client.request("DELETE", `/v1/moodboards/${encodeURIComponent(id)}`);
+  }
+};
+
 // src/resources/competitors.ts
 var CompetitorsResource = class {
   constructor(client) {
@@ -4234,7 +4666,7 @@ var EditResource = class {
     return edl.remapTranscriptThroughEdl(edl$1, transcript);
   }
 };
-var SDK_VERSION = "2.28.0" ;
+var SDK_VERSION = "2.29.0" ;
 var CLIENT_HEADER = "X-Nodaro-Client";
 var isBrowser = () => typeof window !== "undefined" && typeof window.document !== "undefined";
 var NodaroClient = class _NodaroClient {
@@ -4266,6 +4698,8 @@ var NodaroClient = class _NodaroClient {
   scene3d;
   developerApps;
   oauth;
+  /** Outbound webhooks: endpoints that receive your job.completed / job.failed. */
+  webhooks;
   apps;
   characters;
   locations;
@@ -4279,11 +4713,19 @@ var NodaroClient = class _NodaroClient {
   media;
   audio;
   credits;
+  /** Plans and prices, the subscription, and how this deployment bills. */
+  billing;
   uploads;
   library;
+  /** The public gallery and your favorites. */
+  gallery;
   presets;
   savedPosts;
   collections;
+  /** Your colour palettes — a generate-image direction (`direction.colorLook: paletteDirectionId(id)`). */
+  palettes;
+  /** Your moodboards — a generate-image direction (`direction.style: moodboardDirectionId(id)`). */
+  moodboards;
   competitors;
   pickerCatalogs;
   catalogs;
@@ -4318,6 +4760,7 @@ var NodaroClient = class _NodaroClient {
     this.scene3d = new Scene3DResource(this);
     this.developerApps = new DeveloperAppsResource(this);
     this.oauth = new OAuthResource(this);
+    this.webhooks = new WebhooksResource(this);
     this.apps = new AppsResource(this);
     this.characters = new CharactersResource(this);
     this.locations = new LocationsResource(this);
@@ -4331,11 +4774,15 @@ var NodaroClient = class _NodaroClient {
     this.media = new MediaResource(this);
     this.audio = new AudioResource(this);
     this.credits = new CreditsResource(this);
+    this.billing = new BillingResource(this);
     this.uploads = new UploadsResource(this);
     this.library = new LibraryResource(this);
+    this.gallery = new GalleryResource(this);
     this.presets = new PresetsResource(this);
     this.savedPosts = new SavedPostsResource(this);
     this.collections = new CollectionsResource(this);
+    this.palettes = new PalettesResource(this);
+    this.moodboards = new MoodboardsResource(this);
     this.competitors = new CompetitorsResource(this);
     this.pickerCatalogs = new PickerCatalogsResource(this);
     this.catalogs = new CatalogsResource(this);
@@ -4460,6 +4907,32 @@ var NodaroClient = class _NodaroClient {
     const res = await this.request("GET", "/v1/me");
     return res.data;
   }
+  /**
+   * `GET /v1/me/connected-apps` → every app with access to the signed-in
+   * user's account (see {@link ConnectedApp}), newest grant first.
+   *
+   * **A signed-in browser session only.** The route answers a Supabase
+   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a
+   * `StaticTokenAuth` holding one) and refuses every other credential with
+   * `UnauthorizedError` ("Sign in required"): an app token or an API key must
+   * not list the grants it lives under. Build your "Connected apps" settings
+   * screen on this; a server-side integration cannot call it.
+   */
+  async connectedApps() {
+    const res = await this.request("GET", "/v1/me/connected-apps");
+    return res.apps;
+  }
+  /**
+   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's
+   * access: the grant and every token issued under it, at once (the app's next
+   * call is a 401). Resolves when done.
+   *
+   * A signed-in browser session only, like {@link connectedApps}. Throws
+   * `NotFoundError` when the grant is not the user's or is already revoked.
+   */
+  async revokeConnectedApp(authorizationId) {
+    await this.request("POST", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`);
+  }
   buildUrl(path2, query) {
     const base = this.baseUrl || (typeof window !== "undefined" ? window.location.origin : "http://placeholder");
     const url = new URL(path2, base);
@@ -4506,6 +4979,96 @@ function supabaseAuth(supabase) {
   };
 }
 
+// src/webhook-signature.ts
+var WebhookSignatureError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WebhookSignatureError";
+    this.code = code;
+  }
+};
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var HEX_SIGNATURE = /^[0-9a-f]{64}$/;
+function toBytes(payload) {
+  if (typeof payload === "string") return new TextEncoder().encode(payload);
+  if (payload instanceof Uint8Array) return payload;
+  return new Uint8Array(payload);
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function parseHeader(raw) {
+  let timestamp = null;
+  const signatures = [];
+  for (const part of raw.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key === "t") {
+      if (!/^\d{1,15}$/.test(value)) {
+        throw new WebhookSignatureError("malformed_header", "Nodaro-Signature has no valid timestamp (t=)");
+      }
+      timestamp = Number(value);
+    } else if (key === "v1") {
+      signatures.push(value.toLowerCase());
+    }
+  }
+  if (timestamp === null) throw new WebhookSignatureError("malformed_header", "Nodaro-Signature has no timestamp (t=)");
+  if (signatures.length === 0) throw new WebhookSignatureError("malformed_header", "Nodaro-Signature has no v1 signature");
+  return { timestamp, signatures };
+}
+async function verifyWebhookSignature(options) {
+  const { payload, secret } = options;
+  const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+  if (typeof tolerance !== "number" || !Number.isFinite(tolerance) || tolerance < 0) {
+    throw new RangeError("toleranceSeconds must be a finite number of seconds, 0 or more");
+  }
+  if (!secret) throw new WebhookSignatureError("missing_secret", "No signing secret was given");
+  const header = typeof options.header === "string" ? options.header : options.header?.[0];
+  if (!header || !header.trim()) throw new WebhookSignatureError("missing_header", "The request has no Nodaro-Signature header");
+  const { timestamp, signatures } = parseHeader(header);
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) throw new WebhookSignatureError("crypto_unavailable", "Web Crypto (crypto.subtle) is not available in this runtime");
+  const body = toBytes(payload);
+  const prefix = new TextEncoder().encode(`${timestamp}.`);
+  const message = new Uint8Array(prefix.length + body.length);
+  message.set(prefix, 0);
+  message.set(body, prefix.length);
+  const key = await subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const expected = new Uint8Array(await subtle.sign("HMAC", key, message));
+  let matched = false;
+  for (const candidate of signatures) {
+    const wellFormed = HEX_SIGNATURE.test(candidate);
+    const bytes = wellFormed ? hexToBytes(candidate) : new Uint8Array(expected.length);
+    if (constantTimeEqual(bytes, expected) && wellFormed) matched = true;
+  }
+  if (!matched) throw new WebhookSignatureError("signature_mismatch", "The Nodaro-Signature does not match the body");
+  if (tolerance > 0) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - timestamp) > tolerance) {
+      throw new WebhookSignatureError(
+        "timestamp_outside_tolerance",
+        `The signature's timestamp is more than ${tolerance} seconds from now`
+      );
+    }
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(body));
+  } catch {
+    throw new WebhookSignatureError("invalid_payload", "The signed body is not JSON");
+  }
+}
+
 Object.defineProperty(exports, "OUTPUT_BEARING_NODE_STATUSES", {
   enumerable: true,
   get: function () { return workflow.OUTPUT_BEARING_NODE_STATUSES; }
@@ -4608,6 +5171,7 @@ Object.defineProperty(exports, "RECAST_SEGMENT_PACKS", {
 });
 exports.AppsResource = AppsResource;
 exports.AudioResource = AudioResource;
+exports.BillingResource = BillingResource;
 exports.CREATURE_ASSET_TYPES = CREATURE_ASSET_TYPES;
 exports.CallbackAuth = CallbackAuth;
 exports.CatalogsResource = CatalogsResource;
@@ -4623,6 +5187,7 @@ exports.DeveloperAppsResource = DeveloperAppsResource;
 exports.EditResource = EditResource;
 exports.ExecutionsResource = ExecutionsResource;
 exports.ForbiddenError = ForbiddenError;
+exports.GalleryResource = GalleryResource;
 exports.InsufficientCreditsError = InsufficientCreditsError;
 exports.JobAbortedError = JobAbortedError;
 exports.JobBlockedError = JobBlockedError;
@@ -4633,8 +5198,10 @@ exports.JobsResource = JobsResource;
 exports.LibraryResource = LibraryResource;
 exports.LlmResource = LlmResource;
 exports.LocationsResource = LocationsResource;
+exports.MOODBOARD_DIRECTION_PREFIX = MOODBOARD_DIRECTION_PREFIX;
 exports.MediaResource = MediaResource;
 exports.ModelsResource = ModelsResource;
+exports.MoodboardsResource = MoodboardsResource;
 exports.NodaroClient = NodaroClient;
 exports.NodaroError = NodaroError;
 exports.NodesResource = NodesResource;
@@ -4642,6 +5209,8 @@ exports.NotFoundError = NotFoundError;
 exports.OAuthResource = OAuthResource;
 exports.ObjectsResource = ObjectsResource;
 exports.OrganizationsResource = OrganizationsResource;
+exports.PALETTE_DIRECTION_PREFIX = PALETTE_DIRECTION_PREFIX;
+exports.PalettesResource = PalettesResource;
 exports.PickerCatalogsResource = PickerCatalogsResource;
 exports.PipelinesResource = PipelinesResource;
 exports.PresetsResource = PresetsResource;
@@ -4668,13 +5237,18 @@ exports.UnauthorizedError = UnauthorizedError;
 exports.UploadsResource = UploadsResource;
 exports.VideoProResource = VideoProResource;
 exports.VoicesResource = VoicesResource;
+exports.WebhookSignatureError = WebhookSignatureError;
+exports.WebhooksResource = WebhooksResource;
 exports.WorkflowConflictError = WorkflowConflictError;
 exports.WorkflowsResource = WorkflowsResource;
 exports.WorkspacesResource = WorkspacesResource;
 exports.buildPersonSeedPrompt = buildPersonSeedPrompt;
 exports.createClient = createClient;
 exports.isStudioGenerateEstimate = isStudioGenerateEstimate;
+exports.moodboardDirectionId = moodboardDirectionId;
+exports.paletteDirectionId = paletteDirectionId;
 exports.supabaseAuth = supabaseAuth;
 exports.throwFromResponse = throwFromResponse;
+exports.verifyWebhookSignature = verifyWebhookSignature;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map