@nodaro/sdk 2.29.0 → 2.31.0

package/dist/chunk-KNMW722T.cjs

@@ -0,0 +1,48 @@
+'use strict';
+
+var chunkN6GLZOE4_cjs = require('./chunk-N6GLZOE4.cjs');
+
+// src/sse.ts
+async function* readSseStream(res, opts = {}) {
+  if (!res.ok) {
+    let errBody = {};
+    try {
+      errBody = await res.json();
+    } catch {
+    }
+    chunkN6GLZOE4_cjs.throwFromResponse(res.status, errBody);
+  }
+  if (!res.body) {
+    throw new chunkN6GLZOE4_cjs.NodaroError(`${opts.label ?? "event stream"} has no response body`, "empty_stream", res.status);
+  }
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = buffer.indexOf("\n\n")) >= 0) {
+        const frame = buffer.slice(0, sep);
+        buffer = buffer.slice(sep + 2);
+        for (const line of frame.split("\n")) {
+          if (!line.startsWith("data:")) continue;
+          try {
+            yield JSON.parse(line.slice(5).trim());
+          } catch {
+          }
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+    await res.body.cancel().catch(() => {
+    });
+  }
+}
+
+exports.readSseStream = readSseStream;
+//# sourceMappingURL=chunk-KNMW722T.cjs.map
+//# sourceMappingURL=chunk-KNMW722T.cjs.map

package/dist/chunk-KNMW722T.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sse.ts"],"names":["throwFromResponse","NodaroError"],"mappings":";;;;;AAyBA,gBAAuB,aAAA,CACrB,GAAA,EACA,IAAA,GAGI,EAAC,EAC+B;AACpC,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,IAAI,UAAmC,EAAC;AACxC,IAAA,IAAI;AACF,MAAA,OAAA,GAAW,MAAM,IAAI,IAAA,EAAK;AAAA,IAC5B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAAA,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAC,IAAI,IAAA,EAAM;AACb,IAAA,MAAM,IAAIC,8BAAY,CAAA,EAAG,IAAA,CAAK,SAAS,cAAc,CAAA,qBAAA,CAAA,EAAyB,cAAA,EAAgB,GAAA,CAAI,MAAM,CAAA;AAAA,EAC1G;AAEA,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,CAAK,SAAA,EAAU;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI;AACF,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,MAAA,IAAU,QAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAM,CAAA;AAChD,MAAA,IAAI,GAAA;AACJ,MAAA,OAAA,CAAQ,GAAA,GAAM,MAAA,CAAO,OAAA,CAAQ,MAAM,MAAM,CAAA,EAAG;AAC1C,QAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AACjC,QAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC7B,QAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AACpC,UAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,UAAA,IAAI;AACF,YAAA,MAAM,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,CAAE,MAAM,CAAA;AAAA,UACvC,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,SAAE;AAEA,IAAA,MAAA,CAAO,WAAA,EAAY;AACnB,IAAA,MAAM,GAAA,CAAI,IAAA,CAAK,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACxC;AACF","file":"chunk-KNMW722T.cjs","sourcesContent":["import { NodaroError, throwFromResponse } from \"./errors.js\"\n\n/**\n * The ONE server-sent-event reader in this package.\n *\n * Every streaming route here writes the same minimal shape — `data: <json>\\n\\n`\n * frames, with the event kind INSIDE the JSON rather than on an `event:` line —\n * so one reader serves them all, and a second hand-rolled parse loop is the\n * thing this file exists to prevent. Deliberately minimal, matching the\n * server's writer rather than the whole SSE grammar: split on blank lines,\n * JSON-parse each `data:` line on its own, skip what does not parse (the next\n * frame re-reports state), and ignore every other line — keepalive comments\n * (`: keepalive`) included.\n *\n * Frames are separated by a bare `\\n\\n` and each `data:` line is parsed on its\n * own, exactly as the server writes them. Both halves are literal: a stream\n * whose frames arrive CRLF-terminated, or whose JSON was split across two\n * `data:` lines, yields NOTHING rather than erroring — so an intermediary that\n * normalises line endings would show up as an empty stream, not a parse\n * failure. The server's writer produces neither shape.\n *\n * No timeout is applied. The caller owns the lifetime: pass the `AbortSignal`\n * to the `fetch` that produced `res`, or just stop iterating — the `finally`\n * cancels the body, which ends the HTTP request.\n */\nexport async function* readSseStream<T>(\n  res: Response,\n  opts: {\n    /** Names the stream in the \"no response body\" error. */\n    label?: string\n  } = {},\n): AsyncGenerator<T, void, undefined> {\n  if (!res.ok) {\n    let errBody: Record<string, unknown> = {}\n    try {\n      errBody = (await res.json()) as Record<string, unknown>\n    } catch {\n      // Empty/non-JSON body — fall through with empty errBody\n    }\n    throwFromResponse(res.status, errBody)\n  }\n  if (!res.body) {\n    throw new NodaroError(`${opts.label ?? \"event stream\"} has no response body`, \"empty_stream\", res.status)\n  }\n\n  const reader = res.body.getReader()\n  const decoder = new TextDecoder()\n  let buffer = \"\"\n  try {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      buffer += decoder.decode(value, { stream: true })\n      let sep: number\n      while ((sep = buffer.indexOf(\"\\n\\n\")) >= 0) {\n        const frame = buffer.slice(0, sep)\n        buffer = buffer.slice(sep + 2)\n        for (const line of frame.split(\"\\n\")) {\n          if (!line.startsWith(\"data:\")) continue\n          try {\n            yield JSON.parse(line.slice(5).trim()) as T\n          } catch {\n            // Skip malformed frames — the next tick re-reports full state.\n          }\n        }\n      }\n    }\n  } finally {\n    // Ends the HTTP request when the consumer breaks out of the loop early.\n    reader.releaseLock()\n    await res.body.cancel().catch(() => {})\n  }\n}\n"]}

package/dist/chunk-KTTL7BND.cjs

@@ -0,0 +1,4 @@
+'use strict';
+
+//# sourceMappingURL=chunk-KTTL7BND.cjs.map
+//# sourceMappingURL=chunk-KTTL7BND.cjs.map

package/dist/chunk-KTTL7BND.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-KTTL7BND.cjs"}

package/dist/chunk-KXEWTYS4.cjs

@@ -0,0 +1,80 @@
+'use strict';
+
+// src/resources/recast.ts
+var RecastResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  // ── Authored-script lane (all three endpoints are free) ────────────────
+  /** The generated authoring guide (markdown): document contract, enum
+   *  vocabularies, bounds, audio rules, and a validated worked example. */
+  async authoringSkill() {
+    const res = await this.client.request(
+      "GET",
+      "/v1/video-analysis/authoring-skill"
+    );
+    return res.markdown ?? "";
+  }
+  /** FREE validation of an authored script. Loop until `valid: true`. */
+  validateScript(script) {
+    return this.client.request("POST", "/v1/video-analysis/import/validate", {
+      body: { script }
+    });
+  }
+  /**
+   * Import a VALIDATED authored script as a completed analysis job.
+   * `rightsAttested: true` is required (403 otherwise) — authored recasts
+   * render Faithful, exactly as written, so only import work you own.
+   */
+  importScript(script, opts) {
+    return this.client.request("POST", "/v1/video-analysis/import", {
+      body: { script, rightsAttested: opts.rightsAttested }
+    });
+  }
+  // ── Run lane ───────────────────────────────────────────────────────────
+  /** Quote a run (credits) before buying the plan. */
+  estimate(input) {
+    return this.client.request("POST", "/v1/recast/estimate", { body: input });
+  }
+  /** Create a run (buys the plan). Returns `{ recastId }`. */
+  create(input) {
+    return this.client.request("POST", "/v1/recast", { body: input });
+  }
+  /** Poll the run — status plus any pending interactive step. */
+  get(recastId) {
+    return this.client.request("GET", `/v1/recast/${encodeURIComponent(recastId)}`);
+  }
+  /** Quote a revisioned Music replacement and/or complete desired mix. Free. */
+  estimateRescore(recastId, input) {
+    return this.client.request(
+      "POST",
+      `/v1/recast/${encodeURIComponent(recastId)}/estimate-rescore`,
+      { body: input }
+    );
+  }
+  /** Apply a quoted audio operation. Reuse its request id only for a transport retry. */
+  rescore(recastId, input) {
+    return this.client.request(
+      "POST",
+      `/v1/recast/${encodeURIComponent(recastId)}/rescore`,
+      { body: input }
+    );
+  }
+  /** Start rendering a `planned` run. Idempotent server-side. */
+  start(recastId, opts = {}) {
+    return this.client.request("POST", `/v1/recast/${encodeURIComponent(recastId)}/start`, {
+      body: opts
+    });
+  }
+  /** Answer a pending interactive gate (the pick itself is free). */
+  resolveGate(recastId, input) {
+    return this.client.request("POST", `/v1/recast/${encodeURIComponent(recastId)}/select`, {
+      body: input
+    });
+  }
+};
+
+exports.RecastResource = RecastResource;
+//# sourceMappingURL=chunk-KXEWTYS4.cjs.map
+//# sourceMappingURL=chunk-KXEWTYS4.cjs.map

package/dist/chunk-KXEWTYS4.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/recast.ts"],"names":[],"mappings":";;;AA6KO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA,EAMpB,MAAM,cAAA,GAAkC;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA;AAAA,MAC5B,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,IAAI,QAAA,IAAY,EAAA;AAAA,EACzB;AAAA;AAAA,EAGA,eAAe,MAAA,EAAkE;AAC/E,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,oCAAA,EAAsC;AAAA,MACvE,IAAA,EAAM,EAAE,MAAA;AAAO,KAChB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAA,CACE,QACA,IAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,2BAAA,EAA6B;AAAA,MAC9D,IAAA,EAAM,EAAE,MAAA,EAAQ,cAAA,EAAgB,KAAK,cAAA;AAAe,KACrD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA,EAKA,SAAS,KAAA,EAAqD;AAC5D,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,uBAAuB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,OAAO,KAAA,EAAyD;AAC9D,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,cAAc,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAClE;AAAA;AAAA,EAGA,IAAI,QAAA,EAA8C;AAChD,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,cAAc,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,eAAA,CACE,UACA,KAAA,EAC6B;AAC7B,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,WAAA,EAAc,kBAAA,CAAmB,QAAQ,CAAC,CAAA,iBAAA,CAAA;AAAA,MAC1C,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,CACE,UACA,KAAA,EACgC;AAChC,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,WAAA,EAAc,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,CAAA;AAAA,MAC1C,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,IAAA,GAA8D,EAAC,EAC/B;AAChC,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,cAAc,kBAAA,CAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU;AAAA,MACrF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,WAAA,CAAY,UAAkB,KAAA,EAAiE;AAC7F,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,cAAc,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MACtF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF","file":"chunk-KXEWTYS4.cjs","sourcesContent":["import type { RecastSegmentPack } from \"@nodaro/shared/apps\"\n/** How a recast render packs scenes into parts — `RECAST_SEGMENT_PACKS` in `@nodaro/shared`. */\nexport type { RecastSegmentPack } from \"@nodaro/shared/apps\"\nimport type { NodaroClientCore } from \"../core.js\"\n\n/**\n * Recast — regenerate an analyzed source video with your own cast (the engine\n * behind recast.nodaro.ai), plus the authored-script import lane (\"movie as\n * JSON\", no source video).\n *\n * Cloud edition only: the `/v1/recast/*` and `/v1/video-analysis/import*`\n * routes are served by the cloud plugin and 404 on self-hosted installs.\n * Wire contract: docs/api-integration.md §13c/§13d and\n * docs/mcp/recast-authoring.md. The interactive run is server-driven — poll\n * `get()` and answer gates with `resolveGate()`; the platform advances every\n * non-gate step itself.\n */\n\nexport interface RecastScriptValidationError {\n  path: string\n  message: string\n  /** Written for an LLM repair loop — fix `path` using this and re-validate. */\n  hint?: string\n}\n\nexport interface RecastScriptValidation {\n  valid: boolean\n  errors: RecastScriptValidationError[]\n  warnings: string[]\n}\n\nexport interface RecastScriptImportResult {\n  /** A standard completed analysis job — feed it to `create()` as `analysisJobId`. */\n  jobId: string\n  /** false when an identical script was already imported (idempotent re-import). */\n  created: boolean\n  warnings: string[]\n  /** The document of record — WITH the server-derived fields; always prefer it\n   *  over your input. */\n  json: Record<string, unknown>\n}\n\nexport interface CreateRecastInput {\n  /** Required: an existing workflow you own that the run attaches to. */\n  workflowId: string\n  /** The source analysis job (from a video analysis or an authored-script import). */\n  analysisJobId: string\n  /** Authored imports render `\"faithful\"` — exactly as written. */\n  fidelity?: string\n  /** Required (`true`) for faithful renders of authored scripts. */\n  rightsAttested?: boolean\n  resolution?: string\n  /** How the render packs scenes into parts — a name, not seconds. */\n  segmentSec?: RecastSegmentPack\n  renderMethod?: string\n  /** Opt in to the interactive walk (pick-1-of-3 gates surfaced via `get()`). */\n  interactive?: boolean\n  provider?: string\n  /**\n   * Interactive gates the CLIENT can answer, e.g. `[\"sheet-gate\"]`. The\n   * platform only opens a gate kind for runs whose create declared support\n   * for it — undeclared kinds are decided automatically.\n   */\n  clientCapabilities?: string[]\n}\n\nexport type EstimateRecastInput = Omit<CreateRecastInput, \"workflowId\" | \"rightsAttested\" | \"clientCapabilities\">\n\nexport interface RecastEstimate {\n  totalCredits?: number\n  breakdown?: Record<string, number>\n  [key: string]: unknown\n}\n\nexport type RecastAudioLayerName = \"music\" | \"video\"\n\nexport interface RecastAudioMixControl {\n  /** Linear gain percentage. The server rounds and clamps this to 0–200. */\n  gain: number\n  /** A muted lane has an effective wire gain of zero. */\n  muted: boolean\n}\n\n/** Complete desired controls for the logical lanes addressed by an operation. */\nexport interface RecastAudioMix {\n  music?: RecastAudioMixControl\n  video?: RecastAudioMixControl\n}\n\nexport interface RecastAudioManifestV1 {\n  version: 1\n  /** Opaque server-minted identity of the currently published audio delivery. */\n  revision: string\n  mode: \"bed\" | \"replace\"\n  /** Logical layers in the delivery, including layers whose preview derivative failed. */\n  present: { music?: true; video?: true }\n  /** Browser-ready, CORS-enabled audio-only derivatives. */\n  layers: { music?: { url: string }; video?: { url: string } }\n  /** Effective integer gain percentages baked into the current `resultUrl`. */\n  bakedEffectiveGain: { music?: number; video?: number }\n  /** Present only while a paid audio operation is genuinely live. */\n  pendingRescore?: {\n    jobId: string\n    requestId: string\n    state: \"pending\" | \"running\"\n    expectedAudioRevision: string\n    requestedEffectiveGain: { music?: number; video?: number }\n  }\n}\n\nexport interface RecastAudioSectionReplacement {\n  index: number\n  brief: string\n}\n\n/** Exactly one replacement lane may be combined with a mix. */\nexport type RecastRescoreReplacement =\n  | { audioUrl: string; sections?: never }\n  | { sections: RecastAudioSectionReplacement[]; audioUrl?: never }\n\ntype RecastNoReplacement = { audioUrl?: never; sections?: never }\n\n/** A mix, one Music replacement, or a replacement and its complete desired mix. */\nexport type RecastRescoreOperation =\n  | ({ mix: RecastAudioMix } & (RecastRescoreReplacement | RecastNoReplacement))\n  | (RecastRescoreReplacement & { mix?: RecastAudioMix })\n\n/** Free quote input. `requestId` is deliberately absent because quoting has no side effects. */\nexport type EstimateRecastRescoreInput = RecastRescoreOperation & {\n  expectedAudioRevision: string\n}\n\n/** Revision-safe paid operation. Reuse `requestId` only for transport retries. */\nexport type RecastRescoreRequestV2 = EstimateRecastRescoreInput & {\n  requestId: string\n}\n\nexport interface RecastRescoreQuote {\n  credits: number\n  audioRevision: string\n  noOp: boolean\n}\n\nexport type RecastRescoreResponse =\n  | { recastId: string; jobId: string; noOp?: false }\n  | { recastId: string; noOp: true; audioRevision: string }\n\n/** Run snapshot — `status` plus, on interactive runs, the pending step. */\nexport interface RecastRunSnapshot {\n  status: string\n  interactive?: Record<string, unknown>\n  /** Presence of `audioLayers: 1` opts a client into the revisioned audio contract. */\n  capabilities?: { audioLayers?: 1; [key: string]: unknown }\n  /** Server-authored manifest for the selected completed take. */\n  audio?: RecastAudioManifestV1\n  [key: string]: unknown\n}\n\nexport interface ResolveRecastGateInput {\n  /** Which gate the picks answer. Defaults server-side to `\"cast\"`. */\n  gate?: \"cast\" | \"sheet\" | \"anchors\" | \"music\"\n  /** cast / sheet gates: the pick payload as surfaced by the pending gate. */\n  picks?: unknown\n  /** anchors gate: which segment the anchor picks apply to. */\n  segment?: number\n  anchorPicks?: { start?: number; end?: number }\n  /** music gate: which section the pick applies to. */\n  section?: number\n  musicPick?: number | string\n  /** Let the critic decide this and every remaining gate automatically. */\n  finishAuto?: boolean\n}\n\nexport class RecastResource {\n  constructor(private client: NodaroClientCore) {}\n\n  // ── Authored-script lane (all three endpoints are free) ────────────────\n\n  /** The generated authoring guide (markdown): document contract, enum\n   *  vocabularies, bounds, audio rules, and a validated worked example. */\n  async authoringSkill(): Promise<string> {\n    const res = await this.client.request<{ markdown?: string }>(\n      \"GET\",\n      \"/v1/video-analysis/authoring-skill\",\n    )\n    return res.markdown ?? \"\"\n  }\n\n  /** FREE validation of an authored script. Loop until `valid: true`. */\n  validateScript(script: Record<string, unknown>): Promise<RecastScriptValidation> {\n    return this.client.request(\"POST\", \"/v1/video-analysis/import/validate\", {\n      body: { script },\n    })\n  }\n\n  /**\n   * Import a VALIDATED authored script as a completed analysis job.\n   * `rightsAttested: true` is required (403 otherwise) — authored recasts\n   * render Faithful, exactly as written, so only import work you own.\n   */\n  importScript(\n    script: Record<string, unknown>,\n    opts: { rightsAttested: true },\n  ): Promise<RecastScriptImportResult> {\n    return this.client.request(\"POST\", \"/v1/video-analysis/import\", {\n      body: { script, rightsAttested: opts.rightsAttested },\n    })\n  }\n\n  // ── Run lane ───────────────────────────────────────────────────────────\n\n  /** Quote a run (credits) before buying the plan. */\n  estimate(input: EstimateRecastInput): Promise<RecastEstimate> {\n    return this.client.request(\"POST\", \"/v1/recast/estimate\", { body: input })\n  }\n\n  /** Create a run (buys the plan). Returns `{ recastId }`. */\n  create(input: CreateRecastInput): Promise<{ recastId: string }> {\n    return this.client.request(\"POST\", \"/v1/recast\", { body: input })\n  }\n\n  /** Poll the run — status plus any pending interactive step. */\n  get(recastId: string): Promise<RecastRunSnapshot> {\n    return this.client.request(\"GET\", `/v1/recast/${encodeURIComponent(recastId)}`)\n  }\n\n  /** Quote a revisioned Music replacement and/or complete desired mix. Free. */\n  estimateRescore(\n    recastId: string,\n    input: EstimateRecastRescoreInput,\n  ): Promise<RecastRescoreQuote> {\n    return this.client.request(\n      \"POST\",\n      `/v1/recast/${encodeURIComponent(recastId)}/estimate-rescore`,\n      { body: input },\n    )\n  }\n\n  /** Apply a quoted audio operation. Reuse its request id only for a transport retry. */\n  rescore(\n    recastId: string,\n    input: RecastRescoreRequestV2,\n  ): Promise<RecastRescoreResponse> {\n    return this.client.request(\n      \"POST\",\n      `/v1/recast/${encodeURIComponent(recastId)}/rescore`,\n      { body: input },\n    )\n  }\n\n  /** Start rendering a `planned` run. Idempotent server-side. */\n  start(\n    recastId: string,\n    opts: { segmentSec?: RecastSegmentPack; provider?: string } = {},\n  ): Promise<{ gvpJobId?: string }> {\n    return this.client.request(\"POST\", `/v1/recast/${encodeURIComponent(recastId)}/start`, {\n      body: opts,\n    })\n  }\n\n  /** Answer a pending interactive gate (the pick itself is free). */\n  resolveGate(recastId: string, input: ResolveRecastGateInput): Promise<Record<string, unknown>> {\n    return this.client.request(\"POST\", `/v1/recast/${encodeURIComponent(recastId)}/select`, {\n      body: input,\n    })\n  }\n}\n"]}

package/dist/chunk-KZQKFBRN.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-KZQKFBRN.js.map
+//# sourceMappingURL=chunk-KZQKFBRN.js.map

package/dist/chunk-KZQKFBRN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-KZQKFBRN.js"}

package/dist/chunk-LAWYFC4G.cjs

@@ -0,0 +1,37 @@
+'use strict';
+
+// src/resources/projects.ts
+var ProjectsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** List the authenticated user's projects. */
+  list() {
+    return this.client.request("GET", "/v1/projects");
+  }
+  /** Get a project by ID. */
+  get(id) {
+    return this.client.request("GET", `/v1/projects/${encodeURIComponent(id)}`);
+  }
+  /** Create a new project. */
+  create(input) {
+    return this.client.request("POST", "/v1/projects", { body: input });
+  }
+  /** Update a project. At least one field must be provided. */
+  update(id, input) {
+    return this.client.request(
+      "PATCH",
+      `/v1/projects/${encodeURIComponent(id)}`,
+      { body: input }
+    );
+  }
+  /** Delete a project. Returns `{ success: true }`. */
+  delete(id) {
+    return this.client.request("DELETE", `/v1/projects/${encodeURIComponent(id)}`);
+  }
+};
+
+exports.ProjectsResource = ProjectsResource;
+//# sourceMappingURL=chunk-LAWYFC4G.cjs.map
+//# sourceMappingURL=chunk-LAWYFC4G.cjs.map

package/dist/chunk-LAWYFC4G.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/projects.ts"],"names":[],"mappings":";;;AAwBO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA,EAGpB,IAAA,GAAqC;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,cAAc,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,IAAI,EAAA,EAAwC;AAC1C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,gBAAgB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,OAAO,KAAA,EAAuD;AAC5D,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,gBAAgB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,MAAA,CAAO,IAAY,KAAA,EAAuD;AACxE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,OAAA;AAAA,MACA,CAAA,aAAA,EAAgB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAA;AAAA,MACtC,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,EAAA,EAAwC;AAC7C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,QAAA,EAAU,gBAAgB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/E;AACF","file":"chunk-LAWYFC4G.cjs","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\n\nexport interface Project {\n  id: string\n  userId: string\n  name: string\n  description?: string | null\n  settings?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\nexport interface CreateProjectInput {\n  name: string\n  description?: string\n  settings?: Record<string, unknown>\n}\n\nexport interface UpdateProjectInput {\n  name?: string\n  description?: string\n  settings?: Record<string, unknown>\n}\n\nexport class ProjectsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /** List the authenticated user's projects. */\n  list(): Promise<{ data: Project[] }> {\n    return this.client.request(\"GET\", \"/v1/projects\")\n  }\n\n  /** Get a project by ID. */\n  get(id: string): Promise<{ data: Project }> {\n    return this.client.request(\"GET\", `/v1/projects/${encodeURIComponent(id)}`)\n  }\n\n  /** Create a new project. */\n  create(input: CreateProjectInput): Promise<{ data: Project }> {\n    return this.client.request(\"POST\", \"/v1/projects\", { body: input })\n  }\n\n  /** Update a project. At least one field must be provided. */\n  update(id: string, input: UpdateProjectInput): Promise<{ data: Project }> {\n    return this.client.request(\n      \"PATCH\",\n      `/v1/projects/${encodeURIComponent(id)}`,\n      { body: input },\n    )\n  }\n\n  /** Delete a project. Returns `{ success: true }`. */\n  delete(id: string): Promise<{ success: true }> {\n    return this.client.request(\"DELETE\", `/v1/projects/${encodeURIComponent(id)}`)\n  }\n}\n"]}

package/dist/chunk-LHP2CWHD.js

@@ -0,0 +1,228 @@
+import { throwFromResponse } from './chunk-JGS6YBDW.js';
+import { WORKSPACE_HEADER } from '@nodaro/shared/organizations';
+
+// src/binary-response.ts
+async function readBinaryResponse(response, maxBytes) {
+  const advertised = response.headers.get("content-length");
+  if (advertised !== null && (!/^\d+$/.test(advertised) || Number(advertised) > maxBytes)) {
+    await response.body?.cancel();
+    throw new Error("Binary response exceeds its declared size limit");
+  }
+  if (!response.body) return new ArrayBuffer(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      length += next.value.byteLength;
+      if (length > maxBytes) {
+        await reader.cancel();
+        throw new Error("Binary response exceeds its declared size limit");
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes.buffer;
+}
+var SDK_VERSION = "2.31.0" ;
+var CLIENT_HEADER = "X-Nodaro-Client";
+var isBrowser = () => typeof window !== "undefined" && typeof window.document !== "undefined";
+var NodaroClientCore = class {
+  baseUrl;
+  auth;
+  timeoutMs;
+  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */
+  clientLabel;
+  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */
+  sendClientHeader;
+  fetchOverride;
+  /**
+   * Resolved lazily so consumers can swap `globalThis.fetch` after the
+   * client has been constructed (e.g. test mocks). Always rebound to the
+   * global object — native fetch throws "Illegal invocation" when its
+   * `this` is anything else.
+   */
+  get fetch() {
+    return this.fetchOverride ?? globalThis.fetch.bind(globalThis);
+  }
+  /** The workspace this client acts in; undefined = the personal space. */
+  workspaceId;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+    this.auth = opts.auth;
+    this.fetchOverride = opts.fetch;
+    this.timeoutMs = opts.timeoutMs ?? 6e4;
+    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`;
+    this.workspaceId = opts.workspaceId;
+    this.sendClientHeader = opts.clientLabel !== void 0 || !isBrowser();
+  }
+  /**
+   * The transport: build the request, send it, throw the typed error on a
+   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all
+   * inside the abort timer, so `timeoutMs` bounds the body download too (a
+   * stalled CSV stream aborts, it does not hang forever). Both the JSON path
+   * ({@link request}) and the text path ({@link requestText}) go through here.
+   */
+  async send(method, path, options, read) {
+    const url = this.buildUrl(path, options.query);
+    const token = await this.auth.getToken();
+    const isFormData = typeof FormData !== "undefined" && options.body instanceof FormData;
+    const headers = {
+      ...isFormData ? {} : { "Content-Type": "application/json" },
+      ...this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {},
+      // Before per-request headers: a resource that needs to reach outside
+      // this client's workspace says so explicitly and wins.
+      ...this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {},
+      ...options.headers ?? {}
+    };
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+    const ac = new AbortController();
+    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs);
+    const abort = () => ac.abort(options.signal?.reason);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    if (options.signal?.aborted) abort();
+    try {
+      ac.signal.throwIfAborted();
+      const res = await this.fetch(url, {
+        method,
+        headers,
+        body: options.body === void 0 ? void 0 : isFormData ? options.body : JSON.stringify(options.body),
+        signal: ac.signal
+      });
+      if (!res.ok) {
+        let errBody = {};
+        try {
+          errBody = await res.json();
+        } catch {
+        }
+        throwFromResponse(res.status, errBody);
+      }
+      return await read(res);
+    } finally {
+      clearTimeout(timeoutId);
+      options.signal?.removeEventListener("abort", abort);
+    }
+  }
+  /** Authenticated, bounded binary reads through the normal timeout/error transport. */
+  async requestBytes(method, path, options) {
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error("maxBytes must be a positive integer");
+    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes));
+  }
+  async request(method, path, options = {}) {
+    return this.send(
+      method,
+      path,
+      options,
+      async (res) => (
+        // 204 No Content
+        res.status === 204 ? void 0 : await res.json()
+      )
+    );
+  }
+  /**
+   * Like {@link request}, for endpoints that answer text (CSV exports). Errors
+   * are still the JSON envelope and throw the same typed errors, and the read is
+   * bounded by the same timeout as the request.
+   */
+  async requestText(method, path, options = {}) {
+    return this.send(method, path, options, (res) => res.text());
+  }
+  /**
+   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).
+   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the
+   * token is missing/invalid, and the SDK's other typed errors as usual.
+   *
+   * On an instance with organizations it also carries what the caller belongs
+   * to. THREE states, and collapsing them is wrong in a way users feel: the
+   * organization fields ABSENT means this instance has no organizations at
+   * all; present and empty means the account belongs to none; and
+   * `organizationsUnavailable` means the lookup failed — keep whatever
+   * selection you already had rather than concluding the person was removed
+   * from everything.
+   */
+  async me() {
+    const res = await this.request("GET", "/v1/me");
+    return res.data;
+  }
+  /**
+   * `GET /v1/me/connected-apps` → every app with access to the signed-in
+   * user's account (see {@link ConnectedApp}), newest grant first.
+   *
+   * **A signed-in browser session only.** The route answers a Supabase
+   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a
+   * `StaticTokenAuth` holding one) and refuses every other credential with
+   * `UnauthorizedError` ("Sign in required"): an app token or an API key must
+   * not list the grants it lives under. Build your "Connected apps" settings
+   * screen on this; a server-side integration cannot call it.
+   */
+  async connectedApps() {
+    const res = await this.request("GET", "/v1/me/connected-apps");
+    return res.apps;
+  }
+  /**
+   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's
+   * access: the grant and every token issued under it, at once (the app's next
+   * call is a 401). Resolves when done.
+   *
+   * A signed-in browser session only, like {@link connectedApps}. Throws
+   * `NotFoundError` when the grant is not the user's or is already revoked.
+   */
+  async revokeConnectedApp(authorizationId) {
+    await this.request("POST", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`);
+  }
+  buildUrl(path, query) {
+    const base = this.baseUrl || (typeof window !== "undefined" ? window.location.origin : "http://placeholder");
+    const url = new URL(path, base);
+    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search;
+    if (query) {
+      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base);
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0) u.searchParams.set(k, String(v));
+      }
+      return this.baseUrl ? u.toString() : u.pathname + u.search;
+    }
+    return fullUrl;
+  }
+};
+
+// src/auth.ts
+var StaticTokenAuth = class {
+  constructor(token) {
+    this.token = token;
+  }
+  token;
+  async getToken() {
+    return this.token;
+  }
+};
+var CallbackAuth = class {
+  constructor(fn) {
+    this.fn = fn;
+  }
+  fn;
+  async getToken() {
+    return this.fn();
+  }
+};
+function supabaseAuth(supabase) {
+  return {
+    async getToken() {
+      const { data } = await supabase.auth.getSession();
+      return data.session?.access_token ?? null;
+    }
+  };
+}
+
+export { CallbackAuth, NodaroClientCore, StaticTokenAuth, supabaseAuth };
+//# sourceMappingURL=chunk-LHP2CWHD.js.map
+//# sourceMappingURL=chunk-LHP2CWHD.js.map

package/dist/chunk-LHP2CWHD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":[],"mappings":";;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAAC,gBAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,iBAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-LHP2CWHD.js","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}

package/dist/chunk-LHRQXWI5.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-LHRQXWI5.js.map
+//# sourceMappingURL=chunk-LHRQXWI5.js.map

package/dist/chunk-LHRQXWI5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-LHRQXWI5.js"}

package/dist/chunk-LKH5M44B.cjs

@@ -0,0 +1,114 @@
+'use strict';
+
+// src/resources/workspaces.ts
+var WorkspacesResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Every workspace this account belongs to, across all its organizations.
+   *
+   * An identity read: a stale workspace binding cannot lock a caller out of
+   * it, which is what makes it safe to call when a selection has gone bad.
+   *
+   * Byte-for-byte the list `GET /v1/me` carries, so a client reconciles
+   * against one truth rather than two. That is why these are SUMMARIES —
+   * enough to render a switcher, not the full view; use {@link get} for that.
+   */
+  list() {
+    return this.client.request("GET", "/v1/workspaces");
+  }
+  listForOrg(orgId, opts = {}) {
+    return this.client.request("GET", `/v1/orgs/${encodeURIComponent(orgId)}/workspaces`, {
+      query: { includeArchived: opts.includeArchived }
+    });
+  }
+  get(id) {
+    return this.client.request("GET", `/v1/workspaces/${encodeURIComponent(id)}`);
+  }
+  create(orgId, input) {
+    return this.client.request("POST", `/v1/orgs/${encodeURIComponent(orgId)}/workspaces`, { body: input });
+  }
+  update(id, input) {
+    return this.client.request("PATCH", `/v1/workspaces/${encodeURIComponent(id)}`, { body: input });
+  }
+  /**
+   * Archive or restore. Archiving is REVERSIBLE and destroys nothing: the
+   * workspace stops accepting new work and stays fully readable, which is
+   * what a finished class term needs and a delete would not survive.
+   */
+  setArchived(id, archived) {
+    return this.client.request(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(id)}/${archived ? "archive" : "unarchive"}`
+    );
+  }
+  // -- members --------------------------------------------------------------
+  listMembers(id, opts = {}) {
+    return this.client.request("GET", `/v1/workspaces/${encodeURIComponent(id)}/members`, {
+      query: { ...opts }
+    });
+  }
+  /** Add someone who is ALREADY in the organization. To bring in a new person, invite them. */
+  addMember(id, input) {
+    return this.client.request("POST", `/v1/workspaces/${encodeURIComponent(id)}/members`, { body: input });
+  }
+  updateMember(id, userId, input) {
+    return this.client.request(
+      "PATCH",
+      `/v1/workspaces/${encodeURIComponent(id)}/members/${encodeURIComponent(userId)}`,
+      { body: input }
+    );
+  }
+  removeMember(id, userId) {
+    return this.client.request(
+      "DELETE",
+      `/v1/workspaces/${encodeURIComponent(id)}/members/${encodeURIComponent(userId)}`
+    );
+  }
+  // -- join codes -----------------------------------------------------------
+  /** The workspace's join code, or `null` if none has been created. Admins only. */
+  getJoinCode(id) {
+    return this.client.request("GET", `/v1/workspaces/${encodeURIComponent(id)}/join-code`);
+  }
+  /**
+   * Rotate, enable or disable the code. Rotating invalidates the old one
+   * immediately — that is the point of it, and anyone still holding a link
+   * with the old code will be refused.
+   */
+  actOnJoinCode(id, action) {
+    return this.client.request("POST", `/v1/workspaces/${encodeURIComponent(id)}/join-code`, {
+      body: { action }
+    });
+  }
+  /**
+   * Join by code. Another way IN, so a stale workspace binding must not block
+   * it — the server treats this as an identity route for that reason.
+   */
+  join(code) {
+    return this.client.request("POST", "/v1/workspaces/join", { body: { code } });
+  }
+  // -- usage ----------------------------------------------------------------
+  /**
+   * Credits by member, model or day for this workspace. A plain member sees
+   * their OWN runs (the report is self-narrowed and `groupBy: "member"` is
+   * refused); a workspace admin sees everyone and may filter `userId`.
+   * Inclusive dates, IANA `tz` (default UTC), ≤ 366 days (default last 30).
+   */
+  usage(id, opts = {}) {
+    return this.client.request("GET", `/v1/workspaces/${encodeURIComponent(id)}/usage`, { query: { ...opts } });
+  }
+  /** The individual runs behind a report, newest first, cursor-paged. */
+  usageRows(id, opts = {}) {
+    return this.client.request("GET", `/v1/workspaces/${encodeURIComponent(id)}/usage`, { query: { ...opts, groupBy: "none" } });
+  }
+  /** The same report (or the rows, with `groupBy: "none"`) as CSV text. */
+  usageCsv(id, opts = {}) {
+    return this.client.requestText("GET", `/v1/workspaces/${encodeURIComponent(id)}/usage`, { query: { ...opts, format: "csv" } });
+  }
+};
+
+exports.WorkspacesResource = WorkspacesResource;
+//# sourceMappingURL=chunk-LKH5M44B.cjs.map
+//# sourceMappingURL=chunk-LKH5M44B.cjs.map