@nodaro/sdk 2.29.0 → 2.32.0

package/dist/chunk-ZXJQSFIA.js

@@ -0,0 +1,200 @@
+// src/resources/workflows.ts
+var WorkflowCollaboratorsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** List a workflow's collaborators (id, name, avatar, role — never email). */
+  list(workflowId) {
+    return this.client.request(
+      "GET",
+      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`
+    );
+  }
+  /** Add a collaborator by `userId` OR `email` (exactly one), at the given role. */
+  add(workflowId, input) {
+    return this.client.request(
+      "POST",
+      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`,
+      { body: input }
+    );
+  }
+  /** Change a collaborator's role. */
+  update(workflowId, userId, input) {
+    return this.client.request(
+      "PATCH",
+      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`,
+      { body: input }
+    );
+  }
+  /** Remove a collaborator — or yourself. Returns `{ success: true }`. */
+  remove(workflowId, userId) {
+    return this.client.request(
+      "DELETE",
+      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`
+    );
+  }
+};
+var WorkflowsResource = class {
+  constructor(client) {
+    this.client = client;
+    this.collaborators = new WorkflowCollaboratorsResource(client);
+  }
+  client;
+  /** The people this workflow is shared with. See {@link WorkflowCollaboratorsResource}. */
+  collaborators;
+  /** List workflows for a project. Returns metadata only — `nodes`/`edges` are not included. */
+  list(params) {
+    return this.client.request(
+      "GET",
+      `/v1/projects/${encodeURIComponent(params.projectId)}/workflows`
+    );
+  }
+  /** Get a workflow including its full nodes/edges/settings. */
+  get(id) {
+    return this.client.request("GET", `/v1/workflows/${encodeURIComponent(id)}`);
+  }
+  /**
+   * Get a PUBLICLY-SHARED workflow by id (`GET /v1/public/workflows/:id`) — the
+   * unauthenticated share-by-link read. Returns the workflow's nodes/edges/
+   * settings ONLY when it's opted into sharing server-side (`settings.studio.shared
+   * === true`); otherwise the route 404s (→ `NotFoundError`). No auth required —
+   * a share viewer has no session; the SDK omits the bearer when no token exists.
+   */
+  getPublic(id) {
+    return this.client.request("GET", `/v1/public/workflows/${encodeURIComponent(id)}`);
+  }
+  /**
+   * Create a workflow under a project. Returns the full record.
+   * NOTE: server route is `POST /v1/projects/:projectId/workflows`.
+   */
+  create(input) {
+    const { projectId, ...body } = input;
+    return this.client.request(
+      "POST",
+      `/v1/projects/${encodeURIComponent(projectId)}/workflows`,
+      { body }
+    );
+  }
+  /** Patch a workflow. Returns the full updated record. */
+  update(id, input) {
+    return this.client.request(
+      "PATCH",
+      `/v1/workflows/${encodeURIComponent(id)}`,
+      { body: input }
+    );
+  }
+  /** Delete a workflow. Returns `{ success: true }`. Throws `NotFoundError`
+   *  when the id doesn't exist or isn't yours (the delete is not silent). */
+  delete(id) {
+    return this.client.request("DELETE", `/v1/workflows/${encodeURIComponent(id)}`);
+  }
+  /**
+   * Run a workflow. Returns the executionId for polling via
+   * `client.executions.get(executionId)`.
+   */
+  run(id, params = {}, options) {
+    return this.client.request(
+      "POST",
+      `/v1/workflows/${encodeURIComponent(id)}/run`,
+      {
+        body: params,
+        ...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+      }
+    );
+  }
+  /**
+   * Render final (`renderFinal` on `POST /v1/workflows/:id/run`): run the
+   * render at Final for this run only, and every node after it, continuing the
+   * execution that stopped at its preview. The server derives the nodes and
+   * the override — send nothing else. Quote it first with
+   * {@link estimateRenderFinal}. Refused with `render_final_node_not_found`,
+   * `render_final_not_a_render`, or a continuation code (see `run`); a run
+   * its payer cannot cover throws `InsufficientCreditsError` (with `required`
+   * and, when it is yours to see, `available`) before any execution exists.
+   */
+  renderFinal(id, params) {
+    return this.client.request("POST", `/v1/workflows/${encodeURIComponent(id)}/run`, {
+      body: {
+        renderFinal: { renderNodeId: params.renderNodeId },
+        continueFromExecutionId: params.continueFromExecutionId
+      }
+    });
+  }
+  /**
+   * Quote a Render final (`POST /v1/workflows/:id/render-final/estimate`): the
+   * nodes it will run, the override it runs with and its estimated credits.
+   * Nothing is created or charged.
+   */
+  estimateRenderFinal(id, params) {
+    return this.client.request("POST", `/v1/workflows/${encodeURIComponent(id)}/render-final/estimate`, {
+      body: { renderNodeId: params.renderNodeId, continueFromExecutionId: params.continueFromExecutionId }
+    });
+  }
+  /**
+   * Export a workflow as a portable JSON bundle.
+   * Pass `opts.assets = true` to include character/object/location entity data.
+   */
+  export(workflowId, opts) {
+    return this.client.request(
+      "GET",
+      `/v1/workflows/${encodeURIComponent(workflowId)}/export`,
+      { query: { assets: opts?.assets ?? false } }
+    );
+  }
+  /**
+   * Import a `WorkflowExport` bundle into the specified project.
+   * Re-creates any bundled assets (characters, objects, creatures, locations)
+   * under your account, and re-points BOTH the entity nodes and every `@`-chip
+   * (`ConnectedReference`) bound in the graph at the rows it created.
+   * Media the bundle references on other hosts is copied onto this instance's
+   * storage where reachable; a bundled entity's images are copied whoever
+   * hosts them, because they are the exporter's bytes and their lifecycle is
+   * not yours. `importReport` says what was copied, what could not be reached
+   * and what was skipped (and why); `assetIdMap` maps each bundled entity id
+   * to the row created for it (for chips you hold outside the graph), and
+   * `assetsSkipped` names the entities your storage quota left uncreated —
+   * the workflow itself still lands.
+   */
+  import(input) {
+    const { projectId, ...workflowJson } = input;
+    return this.client.request("POST", "/v1/workflows/import", {
+      body: { projectId, workflow_json: workflowJson }
+    });
+  }
+  /**
+   * Set a workflow's visibility — `"private"` (creator + explicit collaborators)
+   * or `"workspace"` (everyone in its workspace). Only the creator or a workspace
+   * admin may change it; anyone else gets HTTP 403. Thin wrapper over `update()`:
+   * the visibility lever lives on `PATCH /v1/workflows/:id`.
+   */
+  setVisibility(id, visibility) {
+    return this.client.request("PATCH", `/v1/workflows/${encodeURIComponent(id)}`, {
+      body: { visibility }
+    });
+  }
+  /**
+   * Move a workflow to another project (`POST /v1/workflows/:id/move`); its folder
+   * is cleared. When the move takes the workflow out of a workspace, collaborator
+   * grants that came from that workspace are dropped and returned as
+   * `droppedCollaborators`.
+   */
+  move(id, params) {
+    return this.client.request("POST", `/v1/workflows/${encodeURIComponent(id)}/move`, {
+      body: params
+    });
+  }
+  /**
+   * Workflows other people shared with you (`GET /v1/workflows/shared-with-me`) —
+   * grants on work that is NOT in a workspace you belong to (workspace work already
+   * shows in that workspace's own lists). Each carries the `grantedRole` you hold.
+   * Empty when the organizations feature is off server-side.
+   */
+  sharedWithMe() {
+    return this.client.request("GET", "/v1/workflows/shared-with-me");
+  }
+};
+
+export { WorkflowsResource };
+//# sourceMappingURL=chunk-ZXJQSFIA.js.map
+//# sourceMappingURL=chunk-ZXJQSFIA.js.map

package/dist/chunk-ZXJQSFIA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/workflows.ts"],"names":[],"mappings":";AAmQO,IAAM,gCAAN,MAAoC;AAAA,EACzC,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA,EAGpB,KAAK,UAAA,EAAuD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,cAAA;AAAA,KACjD;AAAA,EACF;AAAA;AAAA,EAGA,GAAA,CACE,YACA,KAAA,EAC+D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,cAAA,CAAA;AAAA,MAC/C,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CACE,UAAA,EACA,MAAA,EACA,KAAA,EAC+D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,OAAA;AAAA,MACA,iBAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,eAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CAAO,YAAoB,MAAA,EAA4C;AACrE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,QAAA;AAAA,MACA,iBAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,eAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AACF,CAAA;AAEO,IAAM,oBAAN,MAAwB;AAAA,EAI7B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAClB,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,6BAAA,CAA8B,MAAM,CAAA;AAAA,EAC/D;AAAA,EAFoB,MAAA;AAAA;AAAA,EAFX,aAAA;AAAA;AAAA,EAOT,KAAK,MAAA,EAA4D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,aAAA,EAAgB,kBAAA,CAAmB,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA;AAAA,KACtD;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,EAAA,EAAyC;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,UAAU,EAAA,EAAyC;AACjD,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,wBAAwB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,KAAA,EAAyD;AAC9D,IAAA,MAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAK,GAAI,KAAA;AAC/B,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,aAAA,EAAgB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAA;AAAA,MAC7C,EAAE,IAAA;AAAK,KACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CAAO,IAAY,KAAA,EAAyD;AAC1E,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,OAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAA;AAAA,MACvC,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,OAAO,EAAA,EAAwC;AAC7C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,QAAA,EAAU,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,EAAA,EAAY,MAAA,GAA4B,IAAI,OAAA,EAA0D;AACxG,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,IAAA,CAAA;AAAA,MACvC;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,GAAI,OAAA,EAAS,cAAA,GAAiB,EAAE,OAAA,EAAS,EAAE,iBAAA,EAAmB,OAAA,CAAQ,cAAA,EAAe,EAAE,GAAI;AAAC;AAC9F,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,WAAA,CAAY,IAAY,MAAA,EAAuD;AAC7E,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,IAAA,CAAA,EAAQ;AAAA,MAChF,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa,EAAE,YAAA,EAAc,MAAA,CAAO,YAAA,EAAa;AAAA,QACjD,yBAAyB,MAAA,CAAO;AAAA;AAClC,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAA,CAAoB,IAAY,MAAA,EAAgE;AAC9F,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,sBAAA,CAAA,EAA0B;AAAA,MAClG,MAAM,EAAE,YAAA,EAAc,OAAO,YAAA,EAAc,uBAAA,EAAyB,OAAO,uBAAA;AAAwB,KACpG,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CACE,YACA,IAAA,EACmC;AACnC,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,EAAE,KAAA,EAAO,EAAE,QAAQ,IAAA,EAAM,MAAA,IAAU,OAAM;AAAE,KAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,KAAA,EAAiH;AACtH,IAAA,MAAM,EAAE,SAAA,EAAW,GAAG,YAAA,EAAa,GAAI,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,sBAAA,EAAwB;AAAA,MACzD,IAAA,EAAM,EAAE,SAAA,EAAW,aAAA,EAAe,YAAA;AAAa,KAChD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAA,CAAc,IAAY,UAAA,EAA6D;AACrF,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,OAAA,EAAS,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAA,EAAI;AAAA,MAC7E,IAAA,EAAM,EAAE,UAAA;AAAW,KACpB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAA,CACE,IACA,MAAA,EAC0E;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,KAAA,CAAA,EAAS;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAA,GAAoD;AAClD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,8BAA8B,CAAA;AAAA,EAClE;AACF","file":"chunk-ZXJQSFIA.js","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\nimport type {\n  GenericNode,\n  GenericEdge,\n} from \"@nodaro/shared/types\"\nimport type {\n  WorkflowExport,\n  WorkflowImportReport,\n} from \"@nodaro/shared/workflow\"\nimport type {\n  WorkflowVisibility,\n  CollaboratorRole,\n} from \"@nodaro/shared/organizations\"\n\n/**\n * Workflow metadata + (when fetched as a single record) full nodes/edges/settings.\n *\n * The list endpoint returns metadata only; `get`, `create`, and `update` return the\n * full record. `nodes`, `edges`, `settings`, and `sourcePrompt` are present only on\n * full records and omitted in list responses.\n */\nexport interface Workflow {\n  id: string\n  projectId: string | null\n  userId: string\n  name: string\n  description?: string | null\n  folderId?: string | null\n  isTemplate?: boolean\n  version?: number\n  thumbnailUrl?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string | null\n  createdAt: string\n  updatedAt: string\n}\n\nexport interface ListWorkflowsParams {\n  /** Required — list endpoint is `/v1/projects/:projectId/workflows`. */\n  projectId: string\n}\n\nexport interface CreateWorkflowInput {\n  /** Required — workflow is created under this project. */\n  projectId: string\n  name: string\n  description?: string\n  folderId?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string\n}\n\nexport interface UpdateWorkflowInput {\n  name?: string\n  description?: string\n  folderId?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string\n  thumbnailUrl?: string | null\n  /**\n   * Optimistic concurrency: the `updatedAt` your copy of the workflow was\n   * loaded with. When the row has since been written by another tab/device,\n   * the update is rejected with HTTP 409 `workflow_conflict`\n   * (`WorkflowConflictError`) carrying the current record — re-read/merge and\n   * retry instead of last-writer-wins clobbering the other writer's changes.\n   * Omit for the legacy unconditional replace.\n   */\n  expectedUpdatedAt?: string\n  /**\n   * Optimistic concurrency by monotonic version — preferred over\n   * `expectedUpdatedAt` (integer bumped by the DB on every content change).\n   */\n  expectedVersion?: number\n}\n\nexport interface RunWorkflowParams {\n  /**\n   * Optional subset of node IDs to execute. Omit to run the full workflow.\n   * With `continueMode: \"from-failed\"`, the nodes to consider (default: the\n   * nodes the run's chain was first started on, plus every node left failed or\n   * held back; see `continueMode`); the run executes only those the failed run\n   * did not complete. Every id sent counts as named: a node of work no run of\n   * the chain ever ran (each only handed on its saved results) runs and is\n   * priced, while a source, trigger, parameter picker or container keeps what\n   * the run handed on and a node set to skip never runs.\n   */\n  nodeIds?: string[]\n  /**\n   * Per-node field overrides for this run only, `{ [nodeId]: { field: value } }`,\n   * shallow-merged over each node's saved data (the node's saved results are\n   * not used). A run through the API has nobody to review a Preview render, so\n   * a workflow whose Apply EDL render is set to Preview is refused\n   * (`preview_review_required`) unless the run sets it to Final:\n   * `{ [renderNodeId]: { quality: \"final\" } }`. A node with Review before\n   * render on (Tighten Episode, Trailer) is refused the same way (turn its\n   * review off). A failed execution records what held it —\n   * `preview_review_required` / `preview_render_nested` (a render),\n   * `…_review_on` (a review-on node) or `…_mixed` (both); match all six with\n   * `isPreviewRefusalCode` from `@nodaro/shared`. A review-on Tighten Episode\n   * fed by a List is refused with `use_case_review_list_driven`; a Trailer fed\n   * by a List, with `use_case_list_driven`.\n   */\n  inputOverrides?: Record<string, Record<string, unknown>>\n  /**\n   * Continue from an earlier execution of this workflow — Render final after a\n   * run that stopped at its preview, or (with `continueMode: \"from-failed\"`) a\n   * failed run from where it stopped. The run executes `nodeIds` only\n   * (required with this field, except with `continueMode`); every other node\n   * hands on what that execution produced, not the workflow's saved results,\n   * and an Edit Plan hands on its plan with the person's review applied. The\n   * execution must be your own `completed` run of this workflow (`failed`,\n   * with `continueMode`), not of a published app version. Refused with\n   * `continuation_subset_required`, `continuation_not_found` (404),\n   * `continuation_workflow_mismatch`, `continuation_version_mismatch` or\n   * `continuation_not_completed` (409). A continuation its payer cannot cover\n   * (with or without `continueMode`, priced on the nodes it runs) throws\n   * `InsufficientCreditsError` before any execution exists, checked as a\n   * {@link WorkflowsResource.renderFinal} is.\n   */\n  continueFromExecutionId?: string\n  /**\n   * `\"from-failed\"`: continue a FAILED run (`continueFromExecutionId`) from\n   * where it stopped. It runs every node that run did not complete — of\n   * `nodeIds`, which default to the nodes the run was started on (a run\n   * started on named nodes is continued on those, a run of every node on every\n   * node; a continuation of a continuation keeps those of the first run of its\n   * chain) plus every node the run left failed or held back — and hands on\n   * what it completed,\n   * never run or charged again. That is per node: a node that failed runs\n   * again in full, every list item included. When a later continuation of it\n   * completed only part of what it left (a narrower `nodeIds`), the run builds\n   * on the newest such one: it is seeded from that run and runs only what is\n   * still left ({@link RunWorkflowResult.continuedFrom} names it). A node\n   * `nodeIds` names that no run of the chain ever ran runs too, and is priced\n   * (see `nodeIds`). A Render\n   * final, or a run of named nodes, continuing the newest of those counts as\n   * one of them too. Not combinable with {@link renderFinal}. Refused with\n   * `continuation_not_failed` (409) for a run that did not fail,\n   * `continuation_superseded` (409) when a later continuation supersedes it —\n   * the message names that run: one that failed (continue that one instead),\n   * or one that completed all this run left (the work is done, and its results\n   * are on that run) — `continuation_preview_pending` (409, a\n   * `ContinuationPreviewPendingError`) when the newest later continuation\n   * stopped at a Preview review of a render or of a Tighten Episode (the error\n   * names that run, what holds it, and in `next` the run that finishes it:\n   * `client.workflows.run(workflowId, error.next)` first — for a single render,\n   * its {@link renderFinal}), and\n   * `continuation_subset_required` (409) when nothing is left to run. Send an\n   * {@link RunWorkflowOptions.idempotencyKey} with each continuation.\n   */\n  continueMode?: \"from-failed\"\n}\n\n/** Per-call options for {@link WorkflowsResource.run}. */\nexport interface RunWorkflowOptions {\n  /**\n   * Sent as the `Idempotency-Key` header (at least 8 characters; the server\n   * ignores a shorter one). Reuse the same value when retrying the same\n   * request: the server answers the run it already started (`deduped: true`)\n   * instead of starting a second one — or, once that run is under way or has\n   * superseded the one it continued, refuses with `already_running` (an\n   * `AlreadyRunningError` carrying its `executionId`) or\n   * `continuation_superseded` naming it. Either way nothing runs twice.\n   */\n  idempotencyKey?: string\n}\n\nexport interface RunWorkflowResult {\n  executionId: string\n  status: \"pending\" | \"running\"\n  /** `true` when an `idempotencyKey` retry found the run already started: `executionId` is that run. */\n  deduped?: boolean\n  /**\n   * With `continueMode: \"from-failed\"`: the execution the run continued from —\n   * its states seed the run. The run asked for (`continueFromExecutionId`), or\n   * the newest later continuation of it that completed part of what it left.\n   * Absent on any other run, and on a `deduped` answer.\n   */\n  continuedFrom?: string\n}\n\n/**\n * A Render final: the Apply EDL render at Final for this run only, and every\n * node after it (Camera Switch first, in multicam). The server works out which\n * nodes run — the same rule as the editor's Render final button.\n */\nexport interface RenderFinalParams {\n  /** The Apply EDL render node to finalize. */\n  renderNodeId: string\n  /**\n   * The execution that stopped at the preview: your own `completed` run of\n   * this workflow. Every node the Render final does not run hands on what it\n   * produced (an Edit Plan hands on its plan with the review applied).\n   */\n  continueFromExecutionId: string\n}\n\n/** What a Render final will run and charge. Nothing is created by the quote. */\nexport interface RenderFinalQuote {\n  renderNodeId: string\n  /** The nodes the run executes, in canvas order. */\n  nodeIds: string[]\n  /** The one-shot override it runs with: `{ [renderNodeId]: { quality: \"final\" } }`. */\n  inputOverrides: Record<string, Record<string, unknown>>\n  /** Estimated credits; `null` in an edition without credits. */\n  estimatedCredits: number | null\n  /**\n   * Whether the payer can cover `estimatedCredits`; `null` in an edition\n   * without credits. When `false`, {@link WorkflowsResource.renderFinal} is\n   * refused with `InsufficientCreditsError` before any execution exists.\n   */\n  sufficient: boolean | null\n  /**\n   * The payer's spendable credits; `null` when it is not yours to see (a\n   * deployment's operator pays) or a workspace budget pays.\n   */\n  available: number | null\n}\n\n/** A person granted access to a workflow. Email is never returned (privacy). */\nexport interface Collaborator {\n  userId: string\n  name?: string | null\n  avatar?: string | null\n  role: CollaboratorRole\n}\n\nexport interface AddCollaboratorInput {\n  /** Provide exactly one of `userId` or `email`. */\n  userId?: string\n  email?: string\n  role: CollaboratorRole\n}\n\n/** A workflow someone else shared with you, plus the role you hold on it. */\nexport interface SharedWorkflow extends Workflow {\n  grantedRole: CollaboratorRole\n}\n\n/** A grant dropped because a move took the workflow out of the workspace the\n *  access came from. */\nexport interface DroppedCollaborator {\n  userId: string\n  name: string | null\n}\n\n/**\n * The people a workflow is shared with — reached as `client.workflows.collaborators`.\n * All four endpoints are served by the organizations feature and exist only when\n * it is enabled server-side; against an install without it they 404\n * (→ `NotFoundError`). The active workspace travels on the request like every\n * other call, so a workspace admin's grants apply automatically.\n */\nexport class WorkflowCollaboratorsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /** List a workflow's collaborators (id, name, avatar, role — never email). */\n  list(workflowId: string): Promise<{ data: Collaborator[] }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`,\n    )\n  }\n\n  /** Add a collaborator by `userId` OR `email` (exactly one), at the given role. */\n  add(\n    workflowId: string,\n    input: AddCollaboratorInput,\n  ): Promise<{ data: { userId: string; role: CollaboratorRole } }> {\n    return this.client.request(\n      \"POST\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`,\n      { body: input },\n    )\n  }\n\n  /** Change a collaborator's role. */\n  update(\n    workflowId: string,\n    userId: string,\n    input: { role: CollaboratorRole },\n  ): Promise<{ data: { userId: string; role: CollaboratorRole } }> {\n    return this.client.request(\n      \"PATCH\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`,\n      { body: input },\n    )\n  }\n\n  /** Remove a collaborator — or yourself. Returns `{ success: true }`. */\n  remove(workflowId: string, userId: string): Promise<{ success: true }> {\n    return this.client.request(\n      \"DELETE\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`,\n    )\n  }\n}\n\nexport class WorkflowsResource {\n  /** The people this workflow is shared with. See {@link WorkflowCollaboratorsResource}. */\n  readonly collaborators: WorkflowCollaboratorsResource\n\n  constructor(private client: NodaroClientCore) {\n    this.collaborators = new WorkflowCollaboratorsResource(client)\n  }\n\n  /** List workflows for a project. Returns metadata only — `nodes`/`edges` are not included. */\n  list(params: ListWorkflowsParams): Promise<{ data: Workflow[] }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/projects/${encodeURIComponent(params.projectId)}/workflows`,\n    )\n  }\n\n  /** Get a workflow including its full nodes/edges/settings. */\n  get(id: string): Promise<{ data: Workflow }> {\n    return this.client.request(\"GET\", `/v1/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Get a PUBLICLY-SHARED workflow by id (`GET /v1/public/workflows/:id`) — the\n   * unauthenticated share-by-link read. Returns the workflow's nodes/edges/\n   * settings ONLY when it's opted into sharing server-side (`settings.studio.shared\n   * === true`); otherwise the route 404s (→ `NotFoundError`). No auth required —\n   * a share viewer has no session; the SDK omits the bearer when no token exists.\n   */\n  getPublic(id: string): Promise<{ data: Workflow }> {\n    return this.client.request(\"GET\", `/v1/public/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Create a workflow under a project. Returns the full record.\n   * NOTE: server route is `POST /v1/projects/:projectId/workflows`.\n   */\n  create(input: CreateWorkflowInput): Promise<{ data: Workflow }> {\n    const { projectId, ...body } = input\n    return this.client.request(\n      \"POST\",\n      `/v1/projects/${encodeURIComponent(projectId)}/workflows`,\n      { body },\n    )\n  }\n\n  /** Patch a workflow. Returns the full updated record. */\n  update(id: string, input: UpdateWorkflowInput): Promise<{ data: Workflow }> {\n    return this.client.request(\n      \"PATCH\",\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      { body: input },\n    )\n  }\n\n  /** Delete a workflow. Returns `{ success: true }`. Throws `NotFoundError`\n   *  when the id doesn't exist or isn't yours (the delete is not silent). */\n  delete(id: string): Promise<{ success: true }> {\n    return this.client.request(\"DELETE\", `/v1/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Run a workflow. Returns the executionId for polling via\n   * `client.executions.get(executionId)`.\n   */\n  run(id: string, params: RunWorkflowParams = {}, options?: RunWorkflowOptions): Promise<RunWorkflowResult> {\n    return this.client.request(\n      \"POST\",\n      `/v1/workflows/${encodeURIComponent(id)}/run`,\n      {\n        body: params,\n        ...(options?.idempotencyKey ? { headers: { \"Idempotency-Key\": options.idempotencyKey } } : {}),\n      },\n    )\n  }\n\n  /**\n   * Render final (`renderFinal` on `POST /v1/workflows/:id/run`): run the\n   * render at Final for this run only, and every node after it, continuing the\n   * execution that stopped at its preview. The server derives the nodes and\n   * the override — send nothing else. Quote it first with\n   * {@link estimateRenderFinal}. Refused with `render_final_node_not_found`,\n   * `render_final_not_a_render`, or a continuation code (see `run`); a run\n   * its payer cannot cover throws `InsufficientCreditsError` (with `required`\n   * and, when it is yours to see, `available`) before any execution exists.\n   */\n  renderFinal(id: string, params: RenderFinalParams): Promise<RunWorkflowResult> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/run`, {\n      body: {\n        renderFinal: { renderNodeId: params.renderNodeId },\n        continueFromExecutionId: params.continueFromExecutionId,\n      },\n    })\n  }\n\n  /**\n   * Quote a Render final (`POST /v1/workflows/:id/render-final/estimate`): the\n   * nodes it will run, the override it runs with and its estimated credits.\n   * Nothing is created or charged.\n   */\n  estimateRenderFinal(id: string, params: RenderFinalParams): Promise<{ data: RenderFinalQuote }> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/render-final/estimate`, {\n      body: { renderNodeId: params.renderNodeId, continueFromExecutionId: params.continueFromExecutionId },\n    })\n  }\n\n  /**\n   * Export a workflow as a portable JSON bundle.\n   * Pass `opts.assets = true` to include character/object/location entity data.\n   */\n  export(\n    workflowId: string,\n    opts?: { assets?: boolean },\n  ): Promise<{ data: WorkflowExport }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/export`,\n      { query: { assets: opts?.assets ?? false } },\n    )\n  }\n\n  /**\n   * Import a `WorkflowExport` bundle into the specified project.\n   * Re-creates any bundled assets (characters, objects, creatures, locations)\n   * under your account, and re-points BOTH the entity nodes and every `@`-chip\n   * (`ConnectedReference`) bound in the graph at the rows it created.\n   * Media the bundle references on other hosts is copied onto this instance's\n   * storage where reachable; a bundled entity's images are copied whoever\n   * hosts them, because they are the exporter's bytes and their lifecycle is\n   * not yours. `importReport` says what was copied, what could not be reached\n   * and what was skipped (and why); `assetIdMap` maps each bundled entity id\n   * to the row created for it (for chips you hold outside the graph), and\n   * `assetsSkipped` names the entities your storage quota left uncreated —\n   * the workflow itself still lands.\n   */\n  import(input: WorkflowExport & { projectId: string }): Promise<{ data: Workflow; importReport?: WorkflowImportReport }> {\n    const { projectId, ...workflowJson } = input\n    return this.client.request(\"POST\", \"/v1/workflows/import\", {\n      body: { projectId, workflow_json: workflowJson },\n    })\n  }\n\n  /**\n   * Set a workflow's visibility — `\"private\"` (creator + explicit collaborators)\n   * or `\"workspace\"` (everyone in its workspace). Only the creator or a workspace\n   * admin may change it; anyone else gets HTTP 403. Thin wrapper over `update()`:\n   * the visibility lever lives on `PATCH /v1/workflows/:id`.\n   */\n  setVisibility(id: string, visibility: WorkflowVisibility): Promise<{ data: Workflow }> {\n    return this.client.request(\"PATCH\", `/v1/workflows/${encodeURIComponent(id)}`, {\n      body: { visibility },\n    })\n  }\n\n  /**\n   * Move a workflow to another project (`POST /v1/workflows/:id/move`); its folder\n   * is cleared. When the move takes the workflow out of a workspace, collaborator\n   * grants that came from that workspace are dropped and returned as\n   * `droppedCollaborators`.\n   */\n  move(\n    id: string,\n    params: { projectId: string },\n  ): Promise<{ data: Workflow; droppedCollaborators: DroppedCollaborator[] }> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/move`, {\n      body: params,\n    })\n  }\n\n  /**\n   * Workflows other people shared with you (`GET /v1/workflows/shared-with-me`) —\n   * grants on work that is NOT in a workspace you belong to (workspace work already\n   * shows in that workspace's own lists). Each carries the `grantedRole` you hold.\n   * Empty when the organizations feature is off server-side.\n   */\n  sharedWithMe(): Promise<{ data: SharedWorkflow[] }> {\n    return this.client.request(\"GET\", \"/v1/workflows/shared-with-me\")\n  }\n}\n"]}

package/dist/chunk-ZYPH2FPT.js

@@ -0,0 +1,3 @@
+export { PROMPT_PREFIX_KEY, PROMPT_SUFFIX_KEY } from '@nodaro/shared/nodes';
+//# sourceMappingURL=chunk-ZYPH2FPT.js.map
+//# sourceMappingURL=chunk-ZYPH2FPT.js.map

package/dist/chunk-ZYPH2FPT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-ZYPH2FPT.js","sourcesContent":[]}

package/dist/developer-apps-zSQXWmEG.d.cts

@@ -0,0 +1,294 @@
+import { OAuthScope } from '@nodaro/shared/apps';
+import { MeOrganizations } from '@nodaro/shared/organizations';
+
+/**
+ * Auth provides the token used for `Authorization: Bearer <token>` on each request.
+ * Implementations:
+ *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)
+ *   - CallbackAuth    — caller-supplied async function (BYO logic)
+ *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)
+ */
+interface Auth {
+    /** Returns the current Bearer token, or null if not authenticated. */
+    getToken(): Promise<string | null>;
+}
+declare class StaticTokenAuth implements Auth {
+    private token;
+    constructor(token: string);
+    getToken(): Promise<string>;
+}
+declare class CallbackAuth implements Auth {
+    private fn;
+    constructor(fn: () => string | null | Promise<string | null>);
+    getToken(): Promise<string | null>;
+}
+interface SupabaseLikeClient {
+    auth: {
+        getSession(): Promise<{
+            data: {
+                session: {
+                    access_token: string;
+                } | null;
+            };
+        }>;
+    };
+}
+/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */
+declare function supabaseAuth(supabase: SupabaseLikeClient): Auth;
+
+/**
+ * OAuth scopes that a developer app may request — the server's own list
+ * (`OAUTH_SCOPES` in `@nodaro/shared`), so it cannot fall behind.
+ */
+type DeveloperAppScope = OAuthScope;
+type DeveloperAppStatus = "active" | "suspended" | "pending_review";
+/**
+ * How the app came to exist. `user` is an app someone registered by hand in
+ * the dashboard; the others register themselves (MCP clients via Dynamic
+ * Client Registration, first-party MCP, a connected community instance).
+ * Only `user` apps count toward the per-user registration cap.
+ */
+type DeveloperAppKind = "user" | "dynamic_mcp" | "first_party_mcp" | "community_instance";
+interface DeveloperApp {
+    id: string;
+    name: string;
+    description: string | null;
+    logoUrl: string | null;
+    homepageUrl: string | null;
+    redirectUris: string[];
+    allowedOrigins: string[];
+    scopesRequested: DeveloperAppScope[];
+    clientId: string;
+    status: DeveloperAppStatus;
+    /** Absent from servers older than this field; treat missing as `"user"`. */
+    kind?: DeveloperAppKind | (string & {});
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * One-shot create response — `clientSecret` is returned exactly ONCE here.
+ * Store it securely; subsequent `get`/`list` calls will not include it.
+ */
+interface CreateDeveloperAppResult extends DeveloperApp {
+    clientSecret: string;
+}
+interface CreateDeveloperAppInput {
+    name: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    /** At least 1, at most 10 redirect URIs. Each must be https or http://localhost. */
+    redirectUris: string[];
+    /** Up to 5 bare origins (no path/query/hash), e.g. "https://example.com". */
+    allowedOrigins?: string[];
+    /** At least 1 scope required. */
+    scopesRequested: DeveloperAppScope[];
+}
+interface UpdateDeveloperAppInput {
+    name?: string;
+    description?: string;
+    homepageUrl?: string;
+    logoUrl?: string;
+    redirectUris?: string[];
+    allowedOrigins?: string[];
+    scopesRequested?: DeveloperAppScope[];
+}
+interface RotateSecretResult {
+    /** New client secret. Returned exactly once — old secret is invalidated. */
+    clientSecret: string;
+}
+declare class DeveloperAppsResource {
+    private client;
+    constructor(client: NodaroClientCore);
+    /** List the authenticated user's developer apps. */
+    list(): Promise<{
+        data: DeveloperApp[];
+    }>;
+    /** Get a developer app by ID. */
+    get(id: string): Promise<{
+        data: DeveloperApp;
+    }>;
+    /**
+     * Create a new developer app. Returns the app PLUS a one-time `clientSecret`
+     * — store it now, the secret hash is the only copy kept server-side.
+     */
+    create(input: CreateDeveloperAppInput): Promise<{
+        data: CreateDeveloperAppResult;
+    }>;
+    /** Update a developer app's metadata, redirect URIs, origins, or requested scopes. */
+    update(id: string, input: UpdateDeveloperAppInput): Promise<{
+        data: DeveloperApp;
+    }>;
+    /** Delete a developer app. Returns `{ success: true }`. Throws
+     *  `NotFoundError` when the id doesn't exist or isn't yours. */
+    delete(id: string): Promise<{
+        success: true;
+    }>;
+    /**
+     * Generate a new `clientSecret`. The previous secret is invalidated.
+     * Server returns ONLY the new secret, not the full app record.
+     */
+    rotateSecret(id: string): Promise<RotateSecretResult>;
+}
+
+interface ClientOptions {
+    /** Backend base URL, e.g. "https://nodaro.example.com" or empty string for same-origin. */
+    baseUrl: string;
+    /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */
+    auth: Auth;
+    /** Optional fetch override (for tests or custom transports). */
+    fetch?: typeof fetch;
+    /** Default request timeout in ms. Default 60s. */
+    timeoutMs?: number;
+    /**
+     * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.
+     *
+     * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an
+     * override every CLI invocation would be recorded as an SDK call and the two
+     * surfaces could never be told apart.
+     */
+    clientLabel?: string;
+    /**
+     * The workspace every request acts in — sent as `X-Nodaro-Workspace`.
+     *
+     * It selects which workspace a LIST reads from and where a CREATE lands.
+     * It never authorizes: reading, updating, deleting or running an
+     * identified object is decided by that object's own workspace, so a
+     * forgotten header cannot hide work and a forged one cannot reach anyone
+     * else's. Omit it to work in the caller's personal space.
+     *
+     * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one
+     * client per workspace, no shared mutable selection to get wrong.
+     */
+    workspaceId?: string;
+}
+interface RequestOptions {
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/**
+ * The authenticated user's canonical identity (`GET /v1/me`). A token-
+ * introspection primitive: any valid bearer token (first-party Supabase JWT or
+ * a developer-app OAuth token) resolves to its owner's identity. Mirrors the
+ * `profiles` identity columns server-side — the route is the source of truth.
+ */
+interface UserIdentity {
+    /** Nodaro user id (= the Supabase auth user id). */
+    readonly id: string;
+    readonly email: string;
+    /** Human-readable display name (from `profiles.full_name`); `null` if unset. */
+    readonly displayName: string | null;
+    /** Avatar URL; `null` if unset. */
+    readonly avatarUrl: string | null;
+    /** Subscription tier (e.g. "free", "pro"). */
+    readonly tier: string;
+    /**
+     * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide
+     * whether to render admin surfaces without capability-probing an admin
+     * endpoint; every admin API stays enforced server-side regardless.
+     */
+    readonly isAdmin: boolean;
+}
+/**
+ * An app the user let into their account through OAuth (`GET
+ * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or
+ * a self-hosted install. One entry per grant still in force.
+ */
+interface ConnectedApp {
+    /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */
+    readonly authorizationId: string;
+    /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */
+    readonly name: string | null;
+    /**
+     * How the app came to exist: `user` (a developer app someone registered),
+     * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or
+     * `community_instance` (a self-hosted install).
+     */
+    readonly kind: DeveloperAppKind | (string & {});
+    readonly homepageUrl: string | null;
+    /** The scopes this grant holds. */
+    readonly scopes: readonly DeveloperAppScope[];
+    /** When the user granted access (ISO 8601). */
+    readonly connectedAt: string;
+    /** The latest use of any token issued under the grant; `null` if never used. */
+    readonly lastUsedAt: string | null;
+}
+declare class NodaroClientCore {
+    readonly baseUrl: string;
+    readonly auth: Auth;
+    readonly timeoutMs: number;
+    /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */
+    readonly clientLabel: string;
+    /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */
+    private readonly sendClientHeader;
+    private readonly fetchOverride;
+    /**
+     * Resolved lazily so consumers can swap `globalThis.fetch` after the
+     * client has been constructed (e.g. test mocks). Always rebound to the
+     * global object — native fetch throws "Illegal invocation" when its
+     * `this` is anything else.
+     */
+    get fetch(): typeof fetch;
+    /** The workspace this client acts in; undefined = the personal space. */
+    readonly workspaceId: string | undefined;
+    constructor(opts: ClientOptions);
+    /**
+     * The transport: build the request, send it, throw the typed error on a
+     * non-2xx via {@link throwFromResponse}, then read the body via `read` — all
+     * inside the abort timer, so `timeoutMs` bounds the body download too (a
+     * stalled CSV stream aborts, it does not hang forever). Both the JSON path
+     * ({@link request}) and the text path ({@link requestText}) go through here.
+     */
+    private send;
+    /** Authenticated, bounded binary reads through the normal timeout/error transport. */
+    requestBytes(method: string, path: string, options: RequestOptions & {
+        maxBytes: number;
+    }): Promise<ArrayBuffer>;
+    request<T>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Like {@link request}, for endpoints that answer text (CSV exports). Errors
+     * are still the JSON envelope and throw the same typed errors, and the read is
+     * bounded by the same timeout as the request.
+     */
+    requestText(method: string, path: string, options?: RequestOptions): Promise<string>;
+    /**
+     * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).
+     * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the
+     * token is missing/invalid, and the SDK's other typed errors as usual.
+     *
+     * On an instance with organizations it also carries what the caller belongs
+     * to. THREE states, and collapsing them is wrong in a way users feel: the
+     * organization fields ABSENT means this instance has no organizations at
+     * all; present and empty means the account belongs to none; and
+     * `organizationsUnavailable` means the lookup failed — keep whatever
+     * selection you already had rather than concluding the person was removed
+     * from everything.
+     */
+    me(): Promise<UserIdentity & MeOrganizations>;
+    /**
+     * `GET /v1/me/connected-apps` → every app with access to the signed-in
+     * user's account (see {@link ConnectedApp}), newest grant first.
+     *
+     * **A signed-in browser session only.** The route answers a Supabase
+     * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a
+     * `StaticTokenAuth` holding one) and refuses every other credential with
+     * `UnauthorizedError` ("Sign in required"): an app token or an API key must
+     * not list the grants it lives under. Build your "Connected apps" settings
+     * screen on this; a server-side integration cannot call it.
+     */
+    connectedApps(): Promise<ConnectedApp[]>;
+    /**
+     * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's
+     * access: the grant and every token issued under it, at once (the app's next
+     * call is a 401). Resolves when done.
+     *
+     * A signed-in browser session only, like {@link connectedApps}. Throws
+     * `NotFoundError` when the grant is not the user's or is already revoked.
+     */
+    revokeConnectedApp(authorizationId: string): Promise<void>;
+    private buildUrl;
+}
+
+export { type Auth as A, CallbackAuth as C, type DeveloperApp as D, NodaroClientCore as N, type RotateSecretResult as R, StaticTokenAuth as S, type UpdateDeveloperAppInput as U, type ClientOptions as a, type ConnectedApp as b, type CreateDeveloperAppInput as c, type CreateDeveloperAppResult as d, type DeveloperAppKind as e, type DeveloperAppScope as f, type DeveloperAppStatus as g, DeveloperAppsResource as h, type UserIdentity as i, supabaseAuth as s };