@nodaro/sdk 2.29.0 → 2.32.0

package/dist/chunk-FB3S2FON.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":["WORKSPACE_HEADER","throwFromResponse"],"mappings":";;;;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAACA,8BAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAAC,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-FB3S2FON.cjs","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}

package/dist/chunk-FHEYAW5H.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-FHEYAW5H.js.map
+//# sourceMappingURL=chunk-FHEYAW5H.js.map

package/dist/chunk-FHEYAW5H.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-FHEYAW5H.js"}

package/dist/chunk-GA4LZZKQ.cjs

@@ -0,0 +1,104 @@
+'use strict';
+
+// src/resources/audio.ts
+var AudioResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Separate an audio track into stems (`POST /v1/audio-separation`, Demucs).
+   * `mode` `"vocal_instrumental"` (default) splits voice from music/SFX;
+   * `"stems"` returns the full drums/bass/other/… breakdown. `quality`
+   * `auto` (default) / `fast` / `best`.
+   */
+  separate(input) {
+    return this.client.request("POST", "/v1/audio-separation", { body: input });
+  }
+  /** Isolate the primary voice and strip background noise (`POST /v1/audio-isolation`, ElevenLabs). */
+  isolate(input) {
+    return this.client.request("POST", "/v1/audio-isolation", { body: input });
+  }
+  /**
+   * Apply a reverb / echo / telephone / megaphone effect to an audio track
+   * (`POST /v1/audio-fx`) — the same presets VCP's `voiceFx` uses, standalone.
+   * `mix` (0–100) is the reverb wet/dry; `delayMs` + `decay` drive `echo`/`custom`;
+   * `eqLow`/`eqHigh` (dB) shape telephone/megaphone.
+   */
+  applyFx(input) {
+    return this.client.request("POST", "/v1/audio-fx", { body: input });
+  }
+  /**
+   * Layer multiple audio tracks into one (`POST /v1/mix-audio`). `audioUrls`
+   * (2–20) are summed; optional `trackVolumes` (0–200% each, positionally) set
+   * per-track level. `duck` puts a music bed under speech: every track EXCEPT
+   * `duck.under` (the 0-based index of the voice track) dips while that track
+   * is loud and rises back in its pauses (sidechain compression). `amount`
+   * (0–100, default 75) is how hard; `thresholdDb` (-60–0, default -30),
+   * `ratio` (1–20, overrides `amount`), `attackMs` (1–2000, default 20) and
+   * `releaseMs` (10–9000, default 500) are optional fine controls. A ducked mix
+   * sums its tracks rather than averaging them, so the voice keeps its level;
+   * the price is the same with or without a duck. `endAt` (`"longest"`, the
+   * default, or `"voice"`) says where the mix ends: `"voice"` ends it when the
+   * voice (the `duck.under` track) ends (needs `duck`). A video URL is a track
+   * too: its audio is mixed, and a video with no sound is a silent track.
+   */
+  mix(input) {
+    return this.client.request("POST", "/v1/mix-audio", { body: input });
+  }
+  /**
+   * Adjust an audio (or a video's audio) level (`POST /v1/adjust-volume`):
+   * `volume` % (default 100), `normalize` to loudnorm, and `fadeIn`/`fadeOut`
+   * seconds. Provide `audioUrl` or `videoUrl`.
+   */
+  adjustVolume(input) {
+    return this.client.request("POST", "/v1/adjust-volume", { body: input });
+  }
+  /**
+   * Shift pitch and/or change tempo with Rubber Band (`POST /v1/pitch-tempo`):
+   * `semitones` −12…+12 (default 0), `tempo` 0.5…2 with the pitch kept
+   * (default 1; fixed at 1 for a video), `preserveFormants` (default true).
+   * Provide exactly one of `audioUrl` or `videoUrl` — a video keeps its picture.
+   * Input up to 30 minutes, priced per started minute.
+   */
+  pitchTempo(input) {
+    return this.client.request("POST", "/v1/pitch-tempo", { body: input });
+  }
+  /**
+   * Concatenate audio segments end-to-end (`POST /v1/combine-audio`). Each
+   * segment is a `url` with an optional `[startTime, endTime]` sub-range.
+   */
+  combine(input) {
+    return this.client.request("POST", "/v1/combine-audio", { body: input });
+  }
+  /**
+   * Transcribe an audio (or video) track to text (`POST /v1/transcribe`).
+   *
+   * Three engines are accepted. `elevenlabs-stt` (Scribe) is always word-level,
+   * flag or not, and is the only lane that honours `diarize` (who spoke) and
+   * `tagAudioEvents` (laughter, applause, …); `incredibly-fast-whisper` returns
+   * word timings when you ask for them. `whisper` returns NO word timings at
+   * all — named explicitly or reached by OMITTING `provider`, which still falls
+   * back to it — so asking it for them (`wordTimestamps: true`) is rejected with
+   * a `400 validation_error` at ingress, before any credit is spent. A kinetic
+   * caption render therefore has to name one of the other two.
+   *
+   * Poll `jobs.get(jobId)`; the finished job's `output_data` is a
+   * {@link TranscribeJobOutput}: `text` (the whole transcript), `words`
+   * (caption-shaped, in MILLISECONDS), `json` (the normalized
+   * {@link Transcript}, also ms) — and a top-level `segments` array that is in
+   * SECONDS, not ms.
+   *
+   * `words` is the caption source for a kinetic burn-in: hand it to
+   * `media.addCaptions()` as `captions` with `autoTranscribe: false` and the
+   * render uses those exact words (correct the `text` of an entry in between
+   * and the fix is what burns in).
+   */
+  transcribe(input) {
+    return this.client.request("POST", "/v1/transcribe", { body: input });
+  }
+};
+
+exports.AudioResource = AudioResource;
+//# sourceMappingURL=chunk-GA4LZZKQ.cjs.map
+//# sourceMappingURL=chunk-GA4LZZKQ.cjs.map

package/dist/chunk-GA4LZZKQ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/audio.ts"],"names":[],"mappings":";;;AA+CO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpB,SAAS,KAAA,EAAoI;AAC3I,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,wBAAwB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC/F;AAAA;AAAA,EAGA,QAAQ,KAAA,EAAyD;AAC/D,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,uBAAuB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,KAAA,EAQuB;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,gBAAgB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,IAAI,KAAA,EAY2B;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,iBAAiB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,KAAA,EAOkB;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,qBAAqB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,KAAA,EAMoB;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,mBAAmB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,KAAA,EAA+G;AACrH,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,qBAAqB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,WAAW,KAAA,EAOoB;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAA2B,MAAA,EAAQ,kBAAkB,EAAE,IAAA,EAAM,OAAO,CAAA;AAAA,EACzF;AACF","file":"chunk-GA4LZZKQ.cjs","sourcesContent":["import type { AudioFxPreset } from \"@nodaro/shared/media\"\nimport type { TranscribeProvider } from \"@nodaro/shared/models\"\nimport type { Transcript } from \"@nodaro/shared/edl\"\nexport type { TranscribeProvider } from \"@nodaro/shared/models\"\nimport type { NodaroClientCore } from \"../core.js\"\n\n/**\n * One word of a {@link AudioResource.transcribe} result — caption-shaped, in\n * MILLISECONDS, and structurally the `captions[]` entry `media.addCaptions()`\n * takes, so a word list can be passed straight through. `speaker` is present\n * only on a diarized `elevenlabs-stt` run.\n */\nexport interface TranscribeWord {\n  text: string\n  startMs: number\n  endMs: number\n  timestampMs?: number | null\n  confidence?: number | null\n  speaker?: string\n}\n\n/**\n * A completed transcribe job's `output_data` (read it off `jobs.get(jobId)`).\n *\n * Mind the units: `words` and `json.words` are in MILLISECONDS, while the\n * top-level `segments` are in SECONDS (the raw per-utterance ranges) — present\n * only on the legacy lanes; `elevenlabs-stt` returns none, so read `words`.\n */\nexport interface TranscribeJobOutput {\n  /** The full transcript as one string. */\n  text: string\n  /** Detected (or requested) language code. */\n  language?: string\n  /** Per-word timings, ms — present on the word-level lanes. */\n  words?: TranscribeWord[]\n  /** The normalized {@link Transcript} (ms), the shape `edit.*` consumes. */\n  json?: Transcript\n  /** Per-utterance ranges in SECONDS — not ms, unlike everything above. */\n  segments?: Array<{ start: number; end: number; text: string }>\n}\n\n/**\n * Audio primitives — the building blocks Voice Changer Pro composes internally\n * (separation, isolation, effect, mix, level) plus speech-to-text, exposed\n * standalone so a consumer can run any single step or assemble its own\n * pipeline. Each returns a job id to poll (`jobs.get(jobId)`).\n */\nexport class AudioResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /**\n   * Separate an audio track into stems (`POST /v1/audio-separation`, Demucs).\n   * `mode` `\"vocal_instrumental\"` (default) splits voice from music/SFX;\n   * `\"stems\"` returns the full drums/bass/other/… breakdown. `quality`\n   * `auto` (default) / `fast` / `best`.\n   */\n  separate(input: { audioUrl: string; mode?: \"vocal_instrumental\" | \"stems\"; quality?: \"auto\" | \"fast\" | \"best\" }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/audio-separation\", { body: input })\n  }\n\n  /** Isolate the primary voice and strip background noise (`POST /v1/audio-isolation`, ElevenLabs). */\n  isolate(input: { audioUrl: string }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/audio-isolation\", { body: input })\n  }\n\n  /**\n   * Apply a reverb / echo / telephone / megaphone effect to an audio track\n   * (`POST /v1/audio-fx`) — the same presets VCP's `voiceFx` uses, standalone.\n   * `mix` (0–100) is the reverb wet/dry; `delayMs` + `decay` drive `echo`/`custom`;\n   * `eqLow`/`eqHigh` (dB) shape telephone/megaphone.\n   */\n  applyFx(input: {\n    audioUrl: string\n    preset?: AudioFxPreset\n    mix?: number\n    delayMs?: number\n    decay?: number\n    eqLow?: number\n    eqHigh?: number\n  }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/audio-fx\", { body: input })\n  }\n\n  /**\n   * Layer multiple audio tracks into one (`POST /v1/mix-audio`). `audioUrls`\n   * (2–20) are summed; optional `trackVolumes` (0–200% each, positionally) set\n   * per-track level. `duck` puts a music bed under speech: every track EXCEPT\n   * `duck.under` (the 0-based index of the voice track) dips while that track\n   * is loud and rises back in its pauses (sidechain compression). `amount`\n   * (0–100, default 75) is how hard; `thresholdDb` (-60–0, default -30),\n   * `ratio` (1–20, overrides `amount`), `attackMs` (1–2000, default 20) and\n   * `releaseMs` (10–9000, default 500) are optional fine controls. A ducked mix\n   * sums its tracks rather than averaging them, so the voice keeps its level;\n   * the price is the same with or without a duck. `endAt` (`\"longest\"`, the\n   * default, or `\"voice\"`) says where the mix ends: `\"voice\"` ends it when the\n   * voice (the `duck.under` track) ends (needs `duck`). A video URL is a track\n   * too: its audio is mixed, and a video with no sound is a silent track.\n   */\n  mix(input: {\n    audioUrls: string[]\n    trackVolumes?: number[]\n    duck?: {\n      under: number\n      amount?: number\n      thresholdDb?: number\n      ratio?: number\n      attackMs?: number\n      releaseMs?: number\n    }\n    endAt?: \"longest\" | \"voice\"\n  }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/mix-audio\", { body: input })\n  }\n\n  /**\n   * Adjust an audio (or a video's audio) level (`POST /v1/adjust-volume`):\n   * `volume` % (default 100), `normalize` to loudnorm, and `fadeIn`/`fadeOut`\n   * seconds. Provide `audioUrl` or `videoUrl`.\n   */\n  adjustVolume(input: {\n    audioUrl?: string\n    videoUrl?: string\n    volume?: number\n    normalize?: boolean\n    fadeIn?: number\n    fadeOut?: number\n  }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/adjust-volume\", { body: input })\n  }\n\n  /**\n   * Shift pitch and/or change tempo with Rubber Band (`POST /v1/pitch-tempo`):\n   * `semitones` −12…+12 (default 0), `tempo` 0.5…2 with the pitch kept\n   * (default 1; fixed at 1 for a video), `preserveFormants` (default true).\n   * Provide exactly one of `audioUrl` or `videoUrl` — a video keeps its picture.\n   * Input up to 30 minutes, priced per started minute.\n   */\n  pitchTempo(input: {\n    audioUrl?: string\n    videoUrl?: string\n    semitones?: number\n    tempo?: number\n    preserveFormants?: boolean\n  }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/pitch-tempo\", { body: input })\n  }\n\n  /**\n   * Concatenate audio segments end-to-end (`POST /v1/combine-audio`). Each\n   * segment is a `url` with an optional `[startTime, endTime]` sub-range.\n   */\n  combine(input: { segments: Array<{ url: string; startTime?: number; endTime?: number }> }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/combine-audio\", { body: input })\n  }\n\n  /**\n   * Transcribe an audio (or video) track to text (`POST /v1/transcribe`).\n   *\n   * Three engines are accepted. `elevenlabs-stt` (Scribe) is always word-level,\n   * flag or not, and is the only lane that honours `diarize` (who spoke) and\n   * `tagAudioEvents` (laughter, applause, …); `incredibly-fast-whisper` returns\n   * word timings when you ask for them. `whisper` returns NO word timings at\n   * all — named explicitly or reached by OMITTING `provider`, which still falls\n   * back to it — so asking it for them (`wordTimestamps: true`) is rejected with\n   * a `400 validation_error` at ingress, before any credit is spent. A kinetic\n   * caption render therefore has to name one of the other two.\n   *\n   * Poll `jobs.get(jobId)`; the finished job's `output_data` is a\n   * {@link TranscribeJobOutput}: `text` (the whole transcript), `words`\n   * (caption-shaped, in MILLISECONDS), `json` (the normalized\n   * {@link Transcript}, also ms) — and a top-level `segments` array that is in\n   * SECONDS, not ms.\n   *\n   * `words` is the caption source for a kinetic burn-in: hand it to\n   * `media.addCaptions()` as `captions` with `autoTranscribe: false` and the\n   * render uses those exact words (correct the `text` of an entry in between\n   * and the fix is what burns in).\n   */\n  transcribe(input: {\n    audioUrl: string\n    provider?: TranscribeProvider\n    language?: string\n    diarize?: boolean\n    tagAudioEvents?: boolean\n    wordTimestamps?: boolean\n  }): Promise<{ jobId: string }> {\n    return this.client.request<{ jobId: string }>(\"POST\", \"/v1/transcribe\", { body: input })\n  }\n}\n"]}

package/dist/chunk-GAZJ2PA3.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-GAZJ2PA3.js.map
+//# sourceMappingURL=chunk-GAZJ2PA3.js.map

package/dist/chunk-GAZJ2PA3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-GAZJ2PA3.js"}

package/dist/chunk-GB6C5OEZ.cjs

@@ -0,0 +1,32 @@
+'use strict';
+
+// src/resources/reduce.ts
+var ReduceResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Run the Reduce (fan-in) node directly — useful for scripted batch
+   * scoring, picking the best of N generations outside a workflow, or
+   * one-shot programmatic merges.
+   *
+   * Throws `NodaroError` on 4xx/5xx responses (e.g. `code: "no_valid_inputs"`
+   * with status 400 when every input is empty / whitespace; the underlying
+   * `EmptyInputError` is mapped to a 400 server-side).
+   */
+  run(input) {
+    return this.client.request("POST", "/v1/reduce", {
+      body: {
+        strategyId: input.strategyId,
+        strategyConfig: input.strategyConfig ?? {},
+        inputs: input.inputs,
+        ...input.workflowId !== void 0 ? { workflowId: input.workflowId } : {}
+      }
+    });
+  }
+};
+
+exports.ReduceResource = ReduceResource;
+//# sourceMappingURL=chunk-GB6C5OEZ.cjs.map
+//# sourceMappingURL=chunk-GB6C5OEZ.cjs.map

package/dist/chunk-GB6C5OEZ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/reduce.ts"],"names":[],"mappings":";;;AA6CO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWpB,IAAI,KAAA,EAA2C;AAC7C,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,YAAA,EAAc;AAAA,MAC/C,IAAA,EAAM;AAAA,QACJ,YAAY,KAAA,CAAM,UAAA;AAAA,QAClB,cAAA,EAAgB,KAAA,CAAM,cAAA,IAAkB,EAAC;AAAA,QACzC,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,GAAI,MAAM,UAAA,KAAe,MAAA,GACrB,EAAE,UAAA,EAAY,KAAA,CAAM,UAAA,EAAW,GAC/B;AAAC;AACP,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-GB6C5OEZ.cjs","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\nimport type { ReduceStrategyId, ReduceMeta } from \"@nodaro/shared/workflow\"\n\n// Re-export the canonical types from `@nodaro/shared` (single source of\n// truth — the registry lives at `packages/shared/src/reduce-strategy-registry.ts`).\n// `@nodaro/shared` is already a hard dep of this package, so there's no\n// bundle-size cost to importing from it.\nexport type { ReduceStrategyId, ReduceMeta }\n\nexport interface ReduceInput {\n  /** Which fan-in strategy to run. */\n  strategyId: ReduceStrategyId\n  /**\n   * Strategy-specific config. Defaults to `{}` server-side, which uses every\n   * strategy's `defaultConfig`. Schemas (from `@nodaro/shared`):\n   *   - `pick-best-llm`: `{ criteria: string, inputKind?: \"text\" | \"image-url\", llmModel?: string }`\n   *     (`llmModel` = the judge model id from the LLM registry; omitted → the\n   *     feature default. Its tier sets the price: economy / standard / premium.)\n   *   - `concat`: `{ separator?: string }`\n   *   - `vote`: `{ caseSensitive?: boolean }`\n   *   - `merge-json`: `{ strategy?: \"deep\" | \"shallow\" }`\n   *   - `first-non-empty`, `count`: `{}`\n   */\n  strategyConfig?: Record<string, unknown>\n  /** Up to 1000 input strings (URLs, text fragments, etc.). */\n  inputs: string[]\n  /**\n   * Optional — associates this reduce run with a workflow execution. The\n   * server reads this from the body before Zod strips it (same path as\n   * other job-creating routes).\n   */\n  workflowId?: string\n}\n\nexport interface ReduceResult {\n  jobId: string\n  /**\n   * Stringified result — for `count` this is a numeric string, for\n   * `merge-json` this is the JSON-encoded merged object, otherwise the\n   * chosen / joined text.\n   */\n  output: string\n  meta: ReduceMeta\n}\n\nexport class ReduceResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /**\n   * Run the Reduce (fan-in) node directly — useful for scripted batch\n   * scoring, picking the best of N generations outside a workflow, or\n   * one-shot programmatic merges.\n   *\n   * Throws `NodaroError` on 4xx/5xx responses (e.g. `code: \"no_valid_inputs\"`\n   * with status 400 when every input is empty / whitespace; the underlying\n   * `EmptyInputError` is mapped to a 400 server-side).\n   */\n  run(input: ReduceInput): Promise<ReduceResult> {\n    return this.client.request(\"POST\", \"/v1/reduce\", {\n      body: {\n        strategyId: input.strategyId,\n        strategyConfig: input.strategyConfig ?? {},\n        inputs: input.inputs,\n        ...(input.workflowId !== undefined\n          ? { workflowId: input.workflowId }\n          : {}),\n      },\n    })\n  }\n}\n"]}

package/dist/chunk-GB724HW2.cjs

@@ -0,0 +1,106 @@
+'use strict';
+
+// src/resources/credits.ts
+var MODEL_COSTS_LIMIT = 50;
+var CreditsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * `GET /v1/user/credits` → the authenticated user's credit balance and tier
+   * info. Throws `UnauthorizedError` (401) when signed out, and the SDK's
+   * other typed errors on the usual statuses.
+   */
+  async balance() {
+    const res = await this.client.request(
+      "GET",
+      "/v1/user/credits"
+    );
+    return res.data;
+  }
+  /**
+   * `GET /v1/credits/transactions` → one page of the caller's credit
+   * transactions, newest first, with `nextCursor` for the next page (`null`
+   * at the end). Read `credits_charged` for what each run cost — it can be
+   * below the hold (`credits_reserved`) and is `null` while the hold is open.
+   * Cloud-only route: a self-hosted instance answers 404.
+   */
+  transactions(options = {}) {
+    return this.client.request("GET", "/v1/credits/transactions", {
+      query: { limit: options.limit, cursor: options.cursor }
+    });
+  }
+  /**
+   * `POST /v1/credits/model-costs` → per-identifier credit cost, for editor
+   * cost previews. Capped at the first {@link MODEL_COSTS_LIMIT} identifiers
+   * (the route's request limit). Preserves the `{ data, missing, errors }`
+   * fault-isolation shape verbatim (see {@link ModelCostsResult}).
+   */
+  modelCosts(ids) {
+    return this.client.request("POST", "/v1/credits/model-costs", {
+      body: { models: ids.slice(0, MODEL_COSTS_LIMIT) }
+    });
+  }
+  /**
+   * `POST /v1/credits/claim-signup-grant` → claims the account's free signup
+   * grant, once, with the browser signals of the page making the claim.
+   *
+   * Call it once per page load as soon as the session is known, and never
+   * wait on it for rendering: it is idempotent (a decided account answers
+   * with its state and `granted: false`), it costs the user nothing when it
+   * fails (the next load asks again), and the signals are what make the
+   * claim worth sending — collect them with `collectSignupKeys()` from
+   * `@nodaro/sdk/signup-signals` and pass whatever came back, `{}` included.
+   * Cloud-only route: a self-hosted instance answers 404.
+   */
+  claimSignupGrant(keys = {}) {
+    return this.client.request("POST", "/v1/credits/claim-signup-grant", {
+      body: keys
+    });
+  }
+  /**
+   * `POST /v1/credits/welcome-offer/claim` → the user's "yes" to the welcome
+   * offer, as ONE server action: the marketing-email consent is recorded,
+   * then the free signup grant is claimed with that consent. The abuse gate
+   * still decides — consent is necessary, not sufficient — so read `grant`:
+   * `"granted"` (the grant has landed: this call topped the subscription credits up to `credits` — not added on top — or it had landed before), `"withheld"` (refused), `"revoked"` (taken back earlier; nothing moves), `"unclaimed"` (nothing moved — treat as a failure and let the user retry).
+   * Pass the browser signals from `collectSignupKeys()` and your app's slug.
+   *
+   * **Browser session only.** Usable from a first-party web app signed in
+   * with a Supabase session (the consent is a person's choice in a browser);
+   * an API key or OAuth app token is refused with 403. 409
+   * `welcome_offer_disabled` while the deployment has the offer off — show
+   * it only when `balance().welcomeOffer` is present. Cloud-only route: a
+   * self-hosted instance answers 404.
+   */
+  claimWelcomeOffer(input = {}) {
+    return this.client.request("POST", "/v1/credits/welcome-offer/claim", {
+      body: input
+    });
+  }
+  /**
+   * `POST /v1/credits/welcome-offer/seen` → records that the one-time welcome
+   * popup was shown, so `balance().welcomeOffer.popupSeen` turns true on every
+   * app. Idempotent (the first stamp wins); a failed call only means the popup
+   * may show once more, so callers usually ignore errors.
+   *
+   * **Browser session only**, like {@link claimWelcomeOffer}: 403 for an API
+   * key or OAuth app token, 409 `welcome_offer_disabled` while the offer is
+   * off, 404 on a self-hosted instance.
+   */
+  markWelcomeOfferSeen() {
+    return this.client.request("POST", "/v1/credits/welcome-offer/seen");
+  }
+  // NOTE: no `estimate(...)` helper. The backend exposes
+  // `POST /v1/credits/estimate-workflow` (body `{ nodes }` → `{ data: {
+  // totalCredits, nodeCount } }`), but no consumer has a settled shape for it
+  // yet (studio pre-checks `balance >= Σ modelCosts` client-side rather than
+  // calling an estimate endpoint). Adding it now would be inventing an API
+  // surface ahead of a real caller, so it's deliberately omitted — add it when
+  // a consumer needs it, shaped to that need.
+};
+
+exports.CreditsResource = CreditsResource;
+//# sourceMappingURL=chunk-GB724HW2.cjs.map
+//# sourceMappingURL=chunk-GB724HW2.cjs.map

package/dist/chunk-GB724HW2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/credits.ts"],"names":[],"mappings":";;;AAmLA,IAAM,iBAAA,GAAoB,EAAA;AAEnB,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpB,MAAM,OAAA,GAAgC;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA;AAAA,MAC5B,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,CAAa,OAAA,GAAqC,EAAC,EAAoC;AACrF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAgC,KAAA,EAAO,0BAAA,EAA4B;AAAA,MACpF,OAAO,EAAE,KAAA,EAAO,QAAQ,KAAA,EAAO,MAAA,EAAQ,QAAQ,MAAA;AAAO,KACvD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,GAAA,EAA0C;AACnD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAA0B,MAAA,EAAQ,yBAAA,EAA2B;AAAA,MAC9E,MAAM,EAAE,MAAA,EAAQ,IAAI,KAAA,CAAM,CAAA,EAAG,iBAAiB,CAAA;AAAE,KACjD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,gBAAA,CAAiB,IAAA,GAAmB,EAAC,EAAoC;AACvE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAgC,MAAA,EAAQ,gCAAA,EAAkC;AAAA,MAC3F,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,iBAAA,CAAkB,KAAA,GAAgC,EAAC,EAAqC;AACtF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAiC,MAAA,EAAQ,iCAAA,EAAmC;AAAA,MAC7F,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,oBAAA,GAAwD;AACtD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAgC,MAAA,EAAQ,gCAAgC,CAAA;AAAA,EAC7F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASF","file":"chunk-GB724HW2.cjs","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\n\n/**\n * Authenticated user's credit balance — the shape of `GET /v1/user/credits`'s\n * `data` field. Mirrors the canonical `UserBalance` from the backend billing\n * module (`backend/src/ee/billing/credits.ts`), the source of truth: keep this\n * in sync if that interface changes.\n */\nexport interface UserBalance {\n  total: number\n  subscription: number\n  topup: number\n  dailySpent: number\n  dailyLimit: number | null\n  monthlyAllocation: number\n  /** Stored billing tier. Display should prefer `effectiveTier`. */\n  tier: string\n  /** Derived entitlement tier: \"payg\" when stored-free with purchased credits. */\n  effectiveTier: string\n  features: Record<string, unknown>\n  periodEnd: string | null\n  /** Credits earned for app usage (free tier only — earned by running flows). */\n  appCreditsAllowance: number\n  /** Present when a deployment uses an external shared wallet. Raw credits;\n   * null means unavailable. Do not substitute the personal `total` balance. */\n  externalWallet?: { available: number | null }\n  /**\n   * Where the account's free signup grant stands. `\"withheld\"` means the\n   * account works but the grant did not land — show the activation path.\n   * Absent where the deployment has no signup grant.\n   */\n  freeGrantState?: FreeGrantState\n  /**\n   * Present only with `freeGrantState: \"withheld\"`, when the claim showed no\n   * browser signals at all: the app may say \"free credits need a regular\n   * browser — reload\", because a reload in one judges the account again.\n   */\n  freeGrantNotice?: \"browser_unmeasured\"\n  /**\n   * The welcome-credits opt-in. PRESENT only while the deployment has the\n   * offer switched on — absent means \"no popup, no banner, no block\".\n   */\n  welcomeOffer?: WelcomeOfferState\n}\n\n/** Where an account's free signup grant stands. */\nexport type FreeGrantState = \"unclaimed\" | \"granted\" | \"withheld\" | \"revoked\"\n\n/** `UserBalance.welcomeOffer` — what an app needs to show the welcome offer. */\nexport interface WelcomeOfferState {\n  /** The one-time popup was already shown (see `markWelcomeOfferSeen`). */\n  popupSeen: boolean\n  /**\n   * The account already has its credits (granted elsewhere) but still owes\n   * the email consent: the web apps block creation until it is given — the\n   * claim records it.\n   */\n  consentPending: boolean\n  /** The credits a claim grants. Name this figure in the offer; never hard-code it. */\n  credits: number\n}\n\n/** What `claimWelcomeOffer` sends: the browser signals plus the app answering. */\nexport interface WelcomeOfferClaimInput extends SignupKeys {\n  /**\n   * The answering app's slug (lowercase letters, digits and `-`, up to 40\n   * characters), recorded with the consent. A value outside that grammar is\n   * stored as absent, never refused.\n   */\n  sourceApp?: string\n  /**\n   * The interface language the user answered in — the id of a language Nodaro\n   * ships, such as `\"en\"`, `\"ja\"` or `\"pt-BR\"`. Matched exactly and\n   * case-sensitively: `\"en-US\"` or `\"pt-br\"` is stored as absent, never refused.\n   * Recorded with the consent as the language of the LATEST consent: a later\n   * \"yes\" in another language replaces it.\n   */\n  locale?: string\n}\n\n/** The answer of `POST /v1/credits/welcome-offer/claim`. */\nexport interface WelcomeOfferClaimResult {\n  /** The email consent is recorded. */\n  consent: \"granted\"\n  /** Where the free grant stands after the claim — `\"withheld\"` when the abuse gate refused it. */\n  grant: FreeGrantState\n  /** The grant's figure. A grant tops the subscription credits UP TO it (it is not added on top), so a claim that lands it leaves the subscription credits at no less than this. */\n  credits: number\n}\n\n/** The answer of `POST /v1/credits/welcome-offer/seen`. */\nexport interface WelcomeOfferSeenResult {\n  ok: true\n}\n\n/**\n * Result of `POST /v1/credits/model-costs` — a batch cost lookup for editor\n * cost previews. `data` maps each priced identifier → its credit cost.\n *\n * Per-model fault isolation (the route runs the lookups under\n * `Promise.allSettled`): identifiers with no pricing row are reported in\n * `missing` (undisplayable until an operator seeds a price) and lookup\n * failures in `errors`, instead of failing the whole batch. Callers typically\n * render `'—'` for any identifier that lands in `missing`. The hard-fail\n * policy still triggers at reservation time when the user actually runs the\n * node — this preview lookup is intentionally lenient.\n */\nexport interface ModelCostsResult {\n  data: Record<string, number>\n  missing: string[]\n  errors: string[]\n}\n\n/**\n * The two browser signals a claim reports — SHA-256 hex digests computed by\n * `@nodaro/sdk/signup-signals` (`collectSignupKeys`). Either may be absent:\n * a browser that cannot be measured still claims, and the server treats the\n * absence as what it is. Any other value is stored as absent server-side.\n */\nexport interface SignupKeys {\n  browserKey?: string\n  deviceKey?: string\n}\n\n/** The answer of `POST /v1/credits/claim-signup-grant`. */\nexport interface SignupGrantClaimResult {\n  /** Where the account's free grant stands after this call. */\n  state: FreeGrantState\n  /** True only when THIS call moved the credits — a repeat is `false` with the same state. */\n  granted: boolean\n}\n\n/**\n * One row of `GET /v1/credits/transactions` — a run's reservation and how it\n * settled.\n *\n * Which amount to read: a run first HOLDS credits and is then settled — charged\n * all or part of the hold, the rest returned. `credits_charged` is what the run\n * cost (`null` while the hold is still open, `0` once refunded); sum it for\n * spend. `credits_reserved` is the hold, which never changes. `credits_used`\n * is the same hold under its original name, kept for existing integrations.\n */\nexport interface CreditTransaction {\n  id: string\n  /** ISO-8601. Also the paging cursor: pass the last row's value as `cursor`. */\n  created_at: string\n  /** Settled charge; `null` while `status` is `\"reserved\"`, `0` when refunded. */\n  credits_charged: number | null\n  /** The hold taken when the run was accepted. */\n  credits_reserved: number | null\n  /** The hold, under its original name. Prefer `credits_charged`. */\n  credits_used: number | null\n  /** The model or operation the credits were for. */\n  action: string | null\n  provider: string | null\n  /** Reservation lifecycle: `\"reserved\"`, `\"committed\"` or `\"refunded\"`. */\n  status: string | null\n  /** The caller's own billing details for the run (model, which pool paid, …). */\n  metadata: Record<string, unknown>\n  /** `\"workspace\"` when a class or team budget paid, not your balance. */\n  payer: \"user\" | \"workspace\"\n  workspaceId: string | null\n}\n\n/** A page of {@link CreditTransaction}s, newest first. */\nexport interface CreditTransactionsPage {\n  data: CreditTransaction[]\n  /** Pass as `cursor` for the next page; `null` when there are no more rows. */\n  nextCursor: string | null\n}\n\nexport interface CreditTransactionsOptions {\n  /** Rows per page, 1–50 (server default 20). */\n  limit?: number\n  /** The `nextCursor` of the previous page. */\n  cursor?: string\n}\n\n/** Max identifiers per `model-costs` batch — the route caps the request at 50. */\nconst MODEL_COSTS_LIMIT = 50\n\nexport class CreditsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /**\n   * `GET /v1/user/credits` → the authenticated user's credit balance and tier\n   * info. Throws `UnauthorizedError` (401) when signed out, and the SDK's\n   * other typed errors on the usual statuses.\n   */\n  async balance(): Promise<UserBalance> {\n    const res = await this.client.request<{ data: UserBalance }>(\n      \"GET\",\n      \"/v1/user/credits\",\n    )\n    return res.data\n  }\n\n  /**\n   * `GET /v1/credits/transactions` → one page of the caller's credit\n   * transactions, newest first, with `nextCursor` for the next page (`null`\n   * at the end). Read `credits_charged` for what each run cost — it can be\n   * below the hold (`credits_reserved`) and is `null` while the hold is open.\n   * Cloud-only route: a self-hosted instance answers 404.\n   */\n  transactions(options: CreditTransactionsOptions = {}): Promise<CreditTransactionsPage> {\n    return this.client.request<CreditTransactionsPage>(\"GET\", \"/v1/credits/transactions\", {\n      query: { limit: options.limit, cursor: options.cursor },\n    })\n  }\n\n  /**\n   * `POST /v1/credits/model-costs` → per-identifier credit cost, for editor\n   * cost previews. Capped at the first {@link MODEL_COSTS_LIMIT} identifiers\n   * (the route's request limit). Preserves the `{ data, missing, errors }`\n   * fault-isolation shape verbatim (see {@link ModelCostsResult}).\n   */\n  modelCosts(ids: string[]): Promise<ModelCostsResult> {\n    return this.client.request<ModelCostsResult>(\"POST\", \"/v1/credits/model-costs\", {\n      body: { models: ids.slice(0, MODEL_COSTS_LIMIT) },\n    })\n  }\n\n  /**\n   * `POST /v1/credits/claim-signup-grant` → claims the account's free signup\n   * grant, once, with the browser signals of the page making the claim.\n   *\n   * Call it once per page load as soon as the session is known, and never\n   * wait on it for rendering: it is idempotent (a decided account answers\n   * with its state and `granted: false`), it costs the user nothing when it\n   * fails (the next load asks again), and the signals are what make the\n   * claim worth sending — collect them with `collectSignupKeys()` from\n   * `@nodaro/sdk/signup-signals` and pass whatever came back, `{}` included.\n   * Cloud-only route: a self-hosted instance answers 404.\n   */\n  claimSignupGrant(keys: SignupKeys = {}): Promise<SignupGrantClaimResult> {\n    return this.client.request<SignupGrantClaimResult>(\"POST\", \"/v1/credits/claim-signup-grant\", {\n      body: keys,\n    })\n  }\n\n  /**\n   * `POST /v1/credits/welcome-offer/claim` → the user's \"yes\" to the welcome\n   * offer, as ONE server action: the marketing-email consent is recorded,\n   * then the free signup grant is claimed with that consent. The abuse gate\n   * still decides — consent is necessary, not sufficient — so read `grant`:\n   * `\"granted\"` (the grant has landed: this call topped the subscription credits up to `credits` — not added on top — or it had landed before), `\"withheld\"` (refused), `\"revoked\"` (taken back earlier; nothing moves), `\"unclaimed\"` (nothing moved — treat as a failure and let the user retry).\n   * Pass the browser signals from `collectSignupKeys()` and your app's slug.\n   *\n   * **Browser session only.** Usable from a first-party web app signed in\n   * with a Supabase session (the consent is a person's choice in a browser);\n   * an API key or OAuth app token is refused with 403. 409\n   * `welcome_offer_disabled` while the deployment has the offer off — show\n   * it only when `balance().welcomeOffer` is present. Cloud-only route: a\n   * self-hosted instance answers 404.\n   */\n  claimWelcomeOffer(input: WelcomeOfferClaimInput = {}): Promise<WelcomeOfferClaimResult> {\n    return this.client.request<WelcomeOfferClaimResult>(\"POST\", \"/v1/credits/welcome-offer/claim\", {\n      body: input,\n    })\n  }\n\n  /**\n   * `POST /v1/credits/welcome-offer/seen` → records that the one-time welcome\n   * popup was shown, so `balance().welcomeOffer.popupSeen` turns true on every\n   * app. Idempotent (the first stamp wins); a failed call only means the popup\n   * may show once more, so callers usually ignore errors.\n   *\n   * **Browser session only**, like {@link claimWelcomeOffer}: 403 for an API\n   * key or OAuth app token, 409 `welcome_offer_disabled` while the offer is\n   * off, 404 on a self-hosted instance.\n   */\n  markWelcomeOfferSeen(): Promise<WelcomeOfferSeenResult> {\n    return this.client.request<WelcomeOfferSeenResult>(\"POST\", \"/v1/credits/welcome-offer/seen\")\n  }\n\n  // NOTE: no `estimate(...)` helper. The backend exposes\n  // `POST /v1/credits/estimate-workflow` (body `{ nodes }` → `{ data: {\n  // totalCredits, nodeCount } }`), but no consumer has a settled shape for it\n  // yet (studio pre-checks `balance >= Σ modelCosts` client-side rather than\n  // calling an estimate endpoint). Adding it now would be inventing an API\n  // surface ahead of a real caller, so it's deliberately omitted — add it when\n  // a consumer needs it, shaped to that need.\n}\n"]}

package/dist/chunk-GD24ZRFD.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-GD24ZRFD.js.map
+//# sourceMappingURL=chunk-GD24ZRFD.js.map

package/dist/chunk-GD24ZRFD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-GD24ZRFD.js"}

package/dist/chunk-GI7LROLL.cjs

@@ -0,0 +1,4 @@
+'use strict';
+
+//# sourceMappingURL=chunk-GI7LROLL.cjs.map
+//# sourceMappingURL=chunk-GI7LROLL.cjs.map

package/dist/chunk-GI7LROLL.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-GI7LROLL.cjs"}

package/dist/chunk-GRFLPEM2.cjs

@@ -0,0 +1,16 @@
+'use strict';
+
+var organizations = require('@nodaro/shared/organizations');
+
+
+
+Object.defineProperty(exports, "USAGE_GROUP_BYS", {
+  enumerable: true,
+  get: function () { return organizations.USAGE_GROUP_BYS; }
+});
+Object.defineProperty(exports, "WORKSPACE_HEADER", {
+  enumerable: true,
+  get: function () { return organizations.WORKSPACE_HEADER; }
+});
+//# sourceMappingURL=chunk-GRFLPEM2.cjs.map
+//# sourceMappingURL=chunk-GRFLPEM2.cjs.map

package/dist/chunk-GRFLPEM2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-GRFLPEM2.cjs","sourcesContent":[]}

package/dist/chunk-GVIFLUYZ.cjs

@@ -0,0 +1,40 @@
+'use strict';
+
+// src/resources/oauth.ts
+var OAuthResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Server-side authorization-code exchange. Sends the standard OAuth 2.0
+   * `application/json` body to `POST /v1/oauth/token`.
+   *
+   * NEVER call this from a browser — `client_secret` must stay on the server.
+   */
+  exchangeCode(input) {
+    return this.client.request("POST", "/v1/oauth/token", {
+      body: { grant_type: "authorization_code", ...input }
+    });
+  }
+  /**
+   * Revoke an access token (RFC 7009). Always returns `{ success: true }`,
+   * even for unknown tokens — the spec forbids leaking token validity.
+   */
+  revoke(token) {
+    return this.client.request("POST", "/v1/oauth/revoke", { body: { token } });
+  }
+  /**
+   * Get public app metadata for a consent screen.
+   * `GET /v1/oauth/app-info?client_id=<id>`. Public route — no auth needed.
+   */
+  getAppInfo(clientId, redirectUri) {
+    return this.client.request("GET", "/v1/oauth/app-info", {
+      query: redirectUri ? { client_id: clientId, redirect_uri: redirectUri } : { client_id: clientId }
+    });
+  }
+};
+
+exports.OAuthResource = OAuthResource;
+//# sourceMappingURL=chunk-GVIFLUYZ.cjs.map
+//# sourceMappingURL=chunk-GVIFLUYZ.cjs.map

package/dist/chunk-GVIFLUYZ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/oauth.ts"],"names":[],"mappings":";;;AA8CO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpB,aAAa,KAAA,EAAwD;AACnE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAA,EAAmB;AAAA,MACpD,IAAA,EAAM,EAAE,UAAA,EAAY,oBAAA,EAAsB,GAAG,KAAA;AAAM,KACpD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,KAAA,EAA2C;AAChD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,kBAAA,EAAoB,EAAE,IAAA,EAAM,EAAE,KAAA,EAAM,EAAG,CAAA;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAA,CAAW,UAAkB,WAAA,EAA6C;AACxE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,oBAAA,EAAsB;AAAA,MACtD,KAAA,EAAO,WAAA,GAAc,EAAE,SAAA,EAAW,QAAA,EAAU,cAAc,WAAA,EAAY,GAAI,EAAE,SAAA,EAAW,QAAA;AAAS,KACjG,CAAA;AAAA,EACH;AACF","file":"chunk-GVIFLUYZ.cjs","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\nimport type { DeveloperAppScope } from \"./developer-apps.js\"\n\n/**\n * Server-side authorization-code exchange payload. Field names are snake_case\n * per OAuth 2.0 (RFC 6749).\n */\nexport interface ExchangeCodeInput {\n  client_id: string\n  client_secret: string\n  /** Authorization code received from the consent redirect. */\n  code: string\n  /** Must match the redirect_uri used when issuing the code. */\n  redirect_uri: string\n}\n\n/**\n * `POST /v1/oauth/token` response — snake_case per RFC 6749. `expires_in` is\n * the token's lifetime in seconds.\n */\nexport interface AccessTokenResponse {\n  access_token: string\n  token_type: \"Bearer\"\n  /** Space-separated list of granted scopes. */\n  scope: string\n  expires_in: number\n}\n\n/**\n * Public app metadata for consent screens. Only safe-to-display fields —\n * no secret, no full origin list, no owner_user_id.\n */\nexport interface OAuthAppInfo {\n  name: string\n  description: string | null\n  logoUrl: string | null\n  homepageUrl: string | null\n  scopesRequested: DeveloperAppScope[]\n  /**\n   * Present when `getAppInfo` was given a `redirectUri`: whether that exact\n   * URI is registered for the app. `null` when none was given. Lets a consent\n   * screen refuse to redirect anywhere unregistered without exposing the list.\n   */\n  redirectUriRegistered?: boolean | null\n}\n\nexport class OAuthResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /**\n   * Server-side authorization-code exchange. Sends the standard OAuth 2.0\n   * `application/json` body to `POST /v1/oauth/token`.\n   *\n   * NEVER call this from a browser — `client_secret` must stay on the server.\n   */\n  exchangeCode(input: ExchangeCodeInput): Promise<AccessTokenResponse> {\n    return this.client.request(\"POST\", \"/v1/oauth/token\", {\n      body: { grant_type: \"authorization_code\", ...input },\n    })\n  }\n\n  /**\n   * Revoke an access token (RFC 7009). Always returns `{ success: true }`,\n   * even for unknown tokens — the spec forbids leaking token validity.\n   */\n  revoke(token: string): Promise<{ success: true }> {\n    return this.client.request(\"POST\", \"/v1/oauth/revoke\", { body: { token } })\n  }\n\n  /**\n   * Get public app metadata for a consent screen.\n   * `GET /v1/oauth/app-info?client_id=<id>`. Public route — no auth needed.\n   */\n  getAppInfo(clientId: string, redirectUri?: string): Promise<OAuthAppInfo> {\n    return this.client.request(\"GET\", \"/v1/oauth/app-info\", {\n      query: redirectUri ? { client_id: clientId, redirect_uri: redirectUri } : { client_id: clientId },\n    })\n  }\n}\n"]}