@nodaro/sdk 2.29.0 → 2.31.0

package/dist/developer-apps-zSQXWmEG.d.cts

@@ -0,0 +1,294 @@
+import { OAuthScope } from '@nodaro/shared/apps';
+import { MeOrganizations } from '@nodaro/shared/organizations';
+
+/**
+ * Auth provides the token used for `Authorization: Bearer <token>` on each request.
+ * Implementations:
+ *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)
+ *   - CallbackAuth    — caller-supplied async function (BYO logic)
+ *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)
+ */
+interface Auth {
+    /** Returns the current Bearer token, or null if not authenticated. */
+    getToken(): Promise<string | null>;
+}
+declare class StaticTokenAuth implements Auth {
+    private token;
+    constructor(token: string);
+    getToken(): Promise<string>;
+}
+declare class CallbackAuth implements Auth {
+    private fn;
+    constructor(fn: () => string | null | Promise<string | null>);
+    getToken(): Promise<string | null>;
+}
+interface SupabaseLikeClient {
+    auth: {
+        getSession(): Promise<{
+            data: {
+                session: {
+                    access_token: string;
+                } | null;
+            };
+        }>;
+    };
+}
+/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */
+declare function supabaseAuth(supabase: SupabaseLikeClient): Auth;
+
+/**
+ * OAuth scopes that a developer app may request — the server's own list
+ * (`OAUTH_SCOPES` in `@nodaro/shared`), so it cannot fall behind.
+ */
+type DeveloperAppScope = OAuthScope;
+type DeveloperAppStatus = "active" | "suspended" | "pending_review";
+/**
+ * How the app came to exist. `user` is an app someone registered by hand in
+ * the dashboard; the others register themselves (MCP clients via Dynamic
+ * Client Registration, first-party MCP, a connected community instance).
+ * Only `user` apps count toward the per-user registration cap.
+ */
+type DeveloperAppKind = "user" | "dynamic_mcp" | "first_party_mcp" | "community_instance";
+interface DeveloperApp {
+    id: string;
+    name: string;
+    description: string | null;
+    logoUrl: string | null;
+    homepageUrl: string | null;
+    redirectUris: string[];
+    allowedOrigins: string[];
+    scopesRequested: DeveloperAppScope[];
+    clientId: string;
+    status: DeveloperAppStatus;
+    /** Absent from servers older than this field; treat missing as `"user"`. */
+    kind?: DeveloperAppKind | (string & {});
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * One-shot create response — `clientSecret` is returned exactly ONCE here.
+ * Store it securely; subsequent `get`/`list` calls will not include it.
+ */
+interface CreateDeveloperAppResult extends DeveloperApp {
+    clientSecret: string;
+}
+interface CreateDeveloperAppInput {
+    name: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    /** At least 1, at most 10 redirect URIs. Each must be https or http://localhost. */
+    redirectUris: string[];
+    /** Up to 5 bare origins (no path/query/hash), e.g. "https://example.com". */
+    allowedOrigins?: string[];
+    /** At least 1 scope required. */
+    scopesRequested: DeveloperAppScope[];
+}
+interface UpdateDeveloperAppInput {
+    name?: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    redirectUris?: string[];
+    allowedOrigins?: string[];
+    scopesRequested?: DeveloperAppScope[];
+}
+interface RotateSecretResult {
+    /** New client secret. Returned exactly once — old secret is invalidated. */
+    clientSecret: string;
+}
+declare class DeveloperAppsResource {
+    private client;
+    constructor(client: NodaroClientCore);
+    /** List the authenticated user's developer apps. */
+    list(): Promise<{
+        data: DeveloperApp[];
+    }>;
+    /** Get a developer app by ID. */
+    get(id: string): Promise<{
+        data: DeveloperApp;
+    }>;
+    /**
+     * Create a new developer app. Returns the app PLUS a one-time `clientSecret`
+     * — store it now, the secret hash is the only copy kept server-side.
+     */
+    create(input: CreateDeveloperAppInput): Promise<{
+        data: CreateDeveloperAppResult;
+    }>;
+    /** Update a developer app's metadata, redirect URIs, origins, or requested scopes. */
+    update(id: string, input: UpdateDeveloperAppInput): Promise<{
+        data: DeveloperApp;
+    }>;
+    /** Delete a developer app. Returns `{ success: true }`. Throws
+     *  `NotFoundError` when the id doesn't exist or isn't yours. */
+    delete(id: string): Promise<{
+        success: true;
+    }>;
+    /**
+     * Generate a new `clientSecret`. The previous secret is invalidated.
+     * Server returns ONLY the new secret, not the full app record.
+     */
+    rotateSecret(id: string): Promise<RotateSecretResult>;
+}
+
+interface ClientOptions {
+    /** Backend base URL, e.g. "https://nodaro.example.com" or empty string for same-origin. */
+    baseUrl: string;
+    /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */
+    auth: Auth;
+    /** Optional fetch override (for tests or custom transports). */
+    fetch?: typeof fetch;
+    /** Default request timeout in ms. Default 60s. */
+    timeoutMs?: number;
+    /**
+     * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.
+     *
+     * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an
+     * override every CLI invocation would be recorded as an SDK call and the two
+     * surfaces could never be told apart.
+     */
+    clientLabel?: string;
+    /**
+     * The workspace every request acts in — sent as `X-Nodaro-Workspace`.
+     *
+     * It selects which workspace a LIST reads from and where a CREATE lands.
+     * It never authorizes: reading, updating, deleting or running an
+     * identified object is decided by that object's own workspace, so a
+     * forgotten header cannot hide work and a forged one cannot reach anyone
+     * else's. Omit it to work in the caller's personal space.
+     *
+     * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one
+     * client per workspace, no shared mutable selection to get wrong.
+     */
+    workspaceId?: string;
+}
+interface RequestOptions {
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/**
+ * The authenticated user's canonical identity (`GET /v1/me`). A token-
+ * introspection primitive: any valid bearer token (first-party Supabase JWT or
+ * a developer-app OAuth token) resolves to its owner's identity. Mirrors the
+ * `profiles` identity columns server-side — the route is the source of truth.
+ */
+interface UserIdentity {
+    /** Nodaro user id (= the Supabase auth user id). */
+    readonly id: string;
+    readonly email: string;
+    /** Human-readable display name (from `profiles.full_name`); `null` if unset. */
+    readonly displayName: string | null;
+    /** Avatar URL; `null` if unset. */
+    readonly avatarUrl: string | null;
+    /** Subscription tier (e.g. "free", "pro"). */
+    readonly tier: string;
+    /**
+     * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide
+     * whether to render admin surfaces without capability-probing an admin
+     * endpoint; every admin API stays enforced server-side regardless.
+     */
+    readonly isAdmin: boolean;
+}
+/**
+ * An app the user let into their account through OAuth (`GET
+ * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or
+ * a self-hosted install. One entry per grant still in force.
+ */
+interface ConnectedApp {
+    /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */
+    readonly authorizationId: string;
+    /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */
+    readonly name: string | null;
+    /**
+     * How the app came to exist: `user` (a developer app someone registered),
+     * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or
+     * `community_instance` (a self-hosted install).
+     */
+    readonly kind: DeveloperAppKind | (string & {});
+    readonly homepageUrl: string | null;
+    /** The scopes this grant holds. */
+    readonly scopes: readonly DeveloperAppScope[];
+    /** When the user granted access (ISO 8601). */
+    readonly connectedAt: string;
+    /** The latest use of any token issued under the grant; `null` if never used. */
+    readonly lastUsedAt: string | null;
+}
+declare class NodaroClientCore {
+    readonly baseUrl: string;
+    readonly auth: Auth;
+    readonly timeoutMs: number;
+    /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */
+    readonly clientLabel: string;
+    /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */
+    private readonly sendClientHeader;
+    private readonly fetchOverride;
+    /**
+     * Resolved lazily so consumers can swap `globalThis.fetch` after the
+     * client has been constructed (e.g. test mocks). Always rebound to the
+     * global object — native fetch throws "Illegal invocation" when its
+     * `this` is anything else.
+     */
+    get fetch(): typeof fetch;
+    /** The workspace this client acts in; undefined = the personal space. */
+    readonly workspaceId: string | undefined;
+    constructor(opts: ClientOptions);
+    /**
+     * The transport: build the request, send it, throw the typed error on a
+     * non-2xx via {@link throwFromResponse}, then read the body via `read` — all
+     * inside the abort timer, so `timeoutMs` bounds the body download too (a
+     * stalled CSV stream aborts, it does not hang forever). Both the JSON path
+     * ({@link request}) and the text path ({@link requestText}) go through here.
+     */
+    private send;
+    /** Authenticated, bounded binary reads through the normal timeout/error transport. */
+    requestBytes(method: string, path: string, options: RequestOptions & {
+        maxBytes: number;
+    }): Promise<ArrayBuffer>;
+    request<T>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Like {@link request}, for endpoints that answer text (CSV exports). Errors
+     * are still the JSON envelope and throw the same typed errors, and the read is
+     * bounded by the same timeout as the request.
+     */
+    requestText(method: string, path: string, options?: RequestOptions): Promise<string>;
+    /**
+     * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).
+     * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the
+     * token is missing/invalid, and the SDK's other typed errors as usual.
+     *
+     * On an instance with organizations it also carries what the caller belongs
+     * to. THREE states, and collapsing them is wrong in a way users feel: the
+     * organization fields ABSENT means this instance has no organizations at
+     * all; present and empty means the account belongs to none; and
+     * `organizationsUnavailable` means the lookup failed — keep whatever
+     * selection you already had rather than concluding the person was removed
+     * from everything.
+     */
+    me(): Promise<UserIdentity & MeOrganizations>;
+    /**
+     * `GET /v1/me/connected-apps` → every app with access to the signed-in
+     * user's account (see {@link ConnectedApp}), newest grant first.
+     *
+     * **A signed-in browser session only.** The route answers a Supabase
+     * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a
+     * `StaticTokenAuth` holding one) and refuses every other credential with
+     * `UnauthorizedError` ("Sign in required"): an app token or an API key must
+     * not list the grants it lives under. Build your "Connected apps" settings
+     * screen on this; a server-side integration cannot call it.
+     */
+    connectedApps(): Promise<ConnectedApp[]>;
+    /**
+     * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's
+     * access: the grant and every token issued under it, at once (the app's next
+     * call is a 401). Resolves when done.
+     *
+     * A signed-in browser session only, like {@link connectedApps}. Throws
+     * `NotFoundError` when the grant is not the user's or is already revoked.
+     */
+    revokeConnectedApp(authorizationId: string): Promise<void>;
+    private buildUrl;
+}
+
+export { type Auth as A, CallbackAuth as C, type DeveloperApp as D, NodaroClientCore as N, type RotateSecretResult as R, StaticTokenAuth as S, type UpdateDeveloperAppInput as U, type ClientOptions as a, type ConnectedApp as b, type CreateDeveloperAppInput as c, type CreateDeveloperAppResult as d, type DeveloperAppKind as e, type DeveloperAppScope as f, type DeveloperAppStatus as g, DeveloperAppsResource as h, type UserIdentity as i, supabaseAuth as s };

package/dist/developer-apps-zSQXWmEG.d.ts

@@ -0,0 +1,294 @@
+import { OAuthScope } from '@nodaro/shared/apps';
+import { MeOrganizations } from '@nodaro/shared/organizations';
+
+/**
+ * Auth provides the token used for `Authorization: Bearer <token>` on each request.
+ * Implementations:
+ *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)
+ *   - CallbackAuth    — caller-supplied async function (BYO logic)
+ *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)
+ */
+interface Auth {
+    /** Returns the current Bearer token, or null if not authenticated. */
+    getToken(): Promise<string | null>;
+}
+declare class StaticTokenAuth implements Auth {
+    private token;
+    constructor(token: string);
+    getToken(): Promise<string>;
+}
+declare class CallbackAuth implements Auth {
+    private fn;
+    constructor(fn: () => string | null | Promise<string | null>);
+    getToken(): Promise<string | null>;
+}
+interface SupabaseLikeClient {
+    auth: {
+        getSession(): Promise<{
+            data: {
+                session: {
+                    access_token: string;
+                } | null;
+            };
+        }>;
+    };
+}
+/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */
+declare function supabaseAuth(supabase: SupabaseLikeClient): Auth;
+
+/**
+ * OAuth scopes that a developer app may request — the server's own list
+ * (`OAUTH_SCOPES` in `@nodaro/shared`), so it cannot fall behind.
+ */
+type DeveloperAppScope = OAuthScope;
+type DeveloperAppStatus = "active" | "suspended" | "pending_review";
+/**
+ * How the app came to exist. `user` is an app someone registered by hand in
+ * the dashboard; the others register themselves (MCP clients via Dynamic
+ * Client Registration, first-party MCP, a connected community instance).
+ * Only `user` apps count toward the per-user registration cap.
+ */
+type DeveloperAppKind = "user" | "dynamic_mcp" | "first_party_mcp" | "community_instance";
+interface DeveloperApp {
+    id: string;
+    name: string;
+    description: string | null;
+    logoUrl: string | null;
+    homepageUrl: string | null;
+    redirectUris: string[];
+    allowedOrigins: string[];
+    scopesRequested: DeveloperAppScope[];
+    clientId: string;
+    status: DeveloperAppStatus;
+    /** Absent from servers older than this field; treat missing as `"user"`. */
+    kind?: DeveloperAppKind | (string & {});
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * One-shot create response — `clientSecret` is returned exactly ONCE here.
+ * Store it securely; subsequent `get`/`list` calls will not include it.
+ */
+interface CreateDeveloperAppResult extends DeveloperApp {
+    clientSecret: string;
+}
+interface CreateDeveloperAppInput {
+    name: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    /** At least 1, at most 10 redirect URIs. Each must be https or http://localhost. */
+    redirectUris: string[];
+    /** Up to 5 bare origins (no path/query/hash), e.g. "https://example.com". */
+    allowedOrigins?: string[];
+    /** At least 1 scope required. */
+    scopesRequested: DeveloperAppScope[];
+}
+interface UpdateDeveloperAppInput {
+    name?: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    redirectUris?: string[];
+    allowedOrigins?: string[];
+    scopesRequested?: DeveloperAppScope[];
+}
+interface RotateSecretResult {
+    /** New client secret. Returned exactly once — old secret is invalidated. */
+    clientSecret: string;
+}
+declare class DeveloperAppsResource {
+    private client;
+    constructor(client: NodaroClientCore);
+    /** List the authenticated user's developer apps. */
+    list(): Promise<{
+        data: DeveloperApp[];
+    }>;
+    /** Get a developer app by ID. */
+    get(id: string): Promise<{
+        data: DeveloperApp;
+    }>;
+    /**
+     * Create a new developer app. Returns the app PLUS a one-time `clientSecret`
+     * — store it now, the secret hash is the only copy kept server-side.
+     */
+    create(input: CreateDeveloperAppInput): Promise<{
+        data: CreateDeveloperAppResult;
+    }>;
+    /** Update a developer app's metadata, redirect URIs, origins, or requested scopes. */
+    update(id: string, input: UpdateDeveloperAppInput): Promise<{
+        data: DeveloperApp;
+    }>;
+    /** Delete a developer app. Returns `{ success: true }`. Throws
+     *  `NotFoundError` when the id doesn't exist or isn't yours. */
+    delete(id: string): Promise<{
+        success: true;
+    }>;
+    /**
+     * Generate a new `clientSecret`. The previous secret is invalidated.
+     * Server returns ONLY the new secret, not the full app record.
+     */
+    rotateSecret(id: string): Promise<RotateSecretResult>;
+}
+
+interface ClientOptions {
+    /** Backend base URL, e.g. "https://nodaro.example.com" or empty string for same-origin. */
+    baseUrl: string;
+    /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */
+    auth: Auth;
+    /** Optional fetch override (for tests or custom transports). */
+    fetch?: typeof fetch;
+    /** Default request timeout in ms. Default 60s. */
+    timeoutMs?: number;
+    /**
+     * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.
+     *
+     * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an
+     * override every CLI invocation would be recorded as an SDK call and the two
+     * surfaces could never be told apart.
+     */
+    clientLabel?: string;
+    /**
+     * The workspace every request acts in — sent as `X-Nodaro-Workspace`.
+     *
+     * It selects which workspace a LIST reads from and where a CREATE lands.
+     * It never authorizes: reading, updating, deleting or running an
+     * identified object is decided by that object's own workspace, so a
+     * forgotten header cannot hide work and a forged one cannot reach anyone
+     * else's. Omit it to work in the caller's personal space.
+     *
+     * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one
+     * client per workspace, no shared mutable selection to get wrong.
+     */
+    workspaceId?: string;
+}
+interface RequestOptions {
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/**
+ * The authenticated user's canonical identity (`GET /v1/me`). A token-
+ * introspection primitive: any valid bearer token (first-party Supabase JWT or
+ * a developer-app OAuth token) resolves to its owner's identity. Mirrors the
+ * `profiles` identity columns server-side — the route is the source of truth.
+ */
+interface UserIdentity {
+    /** Nodaro user id (= the Supabase auth user id). */
+    readonly id: string;
+    readonly email: string;
+    /** Human-readable display name (from `profiles.full_name`); `null` if unset. */
+    readonly displayName: string | null;
+    /** Avatar URL; `null` if unset. */
+    readonly avatarUrl: string | null;
+    /** Subscription tier (e.g. "free", "pro"). */
+    readonly tier: string;
+    /**
+     * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide
+     * whether to render admin surfaces without capability-probing an admin
+     * endpoint; every admin API stays enforced server-side regardless.
+     */
+    readonly isAdmin: boolean;
+}
+/**
+ * An app the user let into their account through OAuth (`GET
+ * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or
+ * a self-hosted install. One entry per grant still in force.
+ */
+interface ConnectedApp {
+    /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */
+    readonly authorizationId: string;
+    /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */
+    readonly name: string | null;
+    /**
+     * How the app came to exist: `user` (a developer app someone registered),
+     * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or
+     * `community_instance` (a self-hosted install).
+     */
+    readonly kind: DeveloperAppKind | (string & {});
+    readonly homepageUrl: string | null;
+    /** The scopes this grant holds. */
+    readonly scopes: readonly DeveloperAppScope[];
+    /** When the user granted access (ISO 8601). */
+    readonly connectedAt: string;
+    /** The latest use of any token issued under the grant; `null` if never used. */
+    readonly lastUsedAt: string | null;
+}
+declare class NodaroClientCore {
+    readonly baseUrl: string;
+    readonly auth: Auth;
+    readonly timeoutMs: number;
+    /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */
+    readonly clientLabel: string;
+    /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */
+    private readonly sendClientHeader;
+    private readonly fetchOverride;
+    /**
+     * Resolved lazily so consumers can swap `globalThis.fetch` after the
+     * client has been constructed (e.g. test mocks). Always rebound to the
+     * global object — native fetch throws "Illegal invocation" when its
+     * `this` is anything else.
+     */
+    get fetch(): typeof fetch;
+    /** The workspace this client acts in; undefined = the personal space. */
+    readonly workspaceId: string | undefined;
+    constructor(opts: ClientOptions);
+    /**
+     * The transport: build the request, send it, throw the typed error on a
+     * non-2xx via {@link throwFromResponse}, then read the body via `read` — all
+     * inside the abort timer, so `timeoutMs` bounds the body download too (a
+     * stalled CSV stream aborts, it does not hang forever). Both the JSON path
+     * ({@link request}) and the text path ({@link requestText}) go through here.
+     */
+    private send;
+    /** Authenticated, bounded binary reads through the normal timeout/error transport. */
+    requestBytes(method: string, path: string, options: RequestOptions & {
+        maxBytes: number;
+    }): Promise<ArrayBuffer>;
+    request<T>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Like {@link request}, for endpoints that answer text (CSV exports). Errors
+     * are still the JSON envelope and throw the same typed errors, and the read is
+     * bounded by the same timeout as the request.
+     */
+    requestText(method: string, path: string, options?: RequestOptions): Promise<string>;
+    /**
+     * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).
+     * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the
+     * token is missing/invalid, and the SDK's other typed errors as usual.
+     *
+     * On an instance with organizations it also carries what the caller belongs
+     * to. THREE states, and collapsing them is wrong in a way users feel: the
+     * organization fields ABSENT means this instance has no organizations at
+     * all; present and empty means the account belongs to none; and
+     * `organizationsUnavailable` means the lookup failed — keep whatever
+     * selection you already had rather than concluding the person was removed
+     * from everything.
+     */
+    me(): Promise<UserIdentity & MeOrganizations>;
+    /**
+     * `GET /v1/me/connected-apps` → every app with access to the signed-in
+     * user's account (see {@link ConnectedApp}), newest grant first.
+     *
+     * **A signed-in browser session only.** The route answers a Supabase
+     * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a
+     * `StaticTokenAuth` holding one) and refuses every other credential with
+     * `UnauthorizedError` ("Sign in required"): an app token or an API key must
+     * not list the grants it lives under. Build your "Connected apps" settings
+     * screen on this; a server-side integration cannot call it.
+     */
+    connectedApps(): Promise<ConnectedApp[]>;
+    /**
+     * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's
+     * access: the grant and every token issued under it, at once (the app's next
+     * call is a 401). Resolves when done.
+     *
+     * A signed-in browser session only, like {@link connectedApps}. Throws
+     * `NotFoundError` when the grant is not the user's or is already revoked.
+     */
+    revokeConnectedApp(authorizationId: string): Promise<void>;
+    private buildUrl;
+}
+
+export { type Auth as A, CallbackAuth as C, type DeveloperApp as D, NodaroClientCore as N, type RotateSecretResult as R, StaticTokenAuth as S, type UpdateDeveloperAppInput as U, type ClientOptions as a, type ConnectedApp as b, type CreateDeveloperAppInput as c, type CreateDeveloperAppResult as d, type DeveloperAppKind as e, type DeveloperAppScope as f, type DeveloperAppStatus as g, DeveloperAppsResource as h, type UserIdentity as i, supabaseAuth as s };

package/dist/entries/apps.cjs

@@ -0,0 +1,13 @@
+'use strict';
+
+require('../chunk-NJVSKUL2.cjs');
+var chunkDKEYSJCE_cjs = require('../chunk-DKEYSJCE.cjs');
+
+
+
+Object.defineProperty(exports, "AppsResource", {
+  enumerable: true,
+  get: function () { return chunkDKEYSJCE_cjs.AppsResource; }
+});
+//# sourceMappingURL=apps.cjs.map
+//# sourceMappingURL=apps.cjs.map

package/dist/entries/apps.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"apps.cjs"}