@nodaro/sdk 2.43.0 → 2.44.0

package/dist/{chunk-V3KMBQMK.js.map → chunk-DAGJLS7W.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":[],"mappings":";;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAAC,gBAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,iBAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-V3KMBQMK.js","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":[],"mappings":";;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAAC,gBAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,iBAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-DAGJLS7W.js","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}

package/dist/{chunk-RQH6IKDC.js → chunk-HKDIIFG2.js}

@@ -22,9 +22,11 @@ var CastSwapResource = class {
     return this.client.request("POST", "/v1/cast-swap/estimate", { body: params });
   }
   /**
-   * Quote finishing a draft at Full Quality (`POST
+   * Quote finishing a run at Full Quality (`POST
    * /v1/cast-swap/:jobId/full-quality/estimate`); spends nothing. `jobId` is a
-   * finished DRAFT run (a Cast Swap or trend run made as a draft). The quote
+   * finished Seedance 2.5 DRAFT run, or a finished Kling 4 run at 720p (a Cast
+   * Swap or trend run); the quote's `kind` says whether it is the same take
+   * re-rendered or a new take. The quote
    * does not look for a Full Quality already running: when one is,
    * {@link fullQuality} answers it (`existing: true`) and charges nothing.
    * Refusals: {@link CastSwapFullQualityRefusalCode}.
@@ -33,12 +35,13 @@ var CastSwapResource = class {
     return this.client.request("POST", `/v1/cast-swap/${encodeURIComponent(jobId)}/full-quality/estimate`, { body: {} });
   }
   /**
-   * Finish a draft at Full Quality (`POST /v1/cast-swap/:jobId/full-quality`):
-   * the same take re-rendered at 1080p, with the clip's audio, as a new job
-   * linked to the draft. SPENDS CREDITS: quote it first with
+   * Finish a run at Full Quality (`POST /v1/cast-swap/:jobId/full-quality`):
+   * at 1080p, with the clip's audio, as a new job linked to the run — a
+   * Seedance 2.5 draft's own take re-rendered, or a new Kling 4 take from a
+   * 720p run's inputs (the quote's `kind`). SPENDS CREDITS: quote it first with
    * {@link fullQualityEstimate}. Answers 202 `{ jobId }`, or 200
-   * `{ jobId, existing: true }` when this draft's Full Quality is already
-   * running or done (one per draft; a failed one may be asked again). Follow
+   * `{ jobId, existing: true }` when this run's Full Quality is already
+   * running or done (one per run; a failed one may be asked again). Follow
    * the job with `client.jobs.get(jobId)`. No `Idempotency-Key` is taken: the
    * server keys the job by the draft. The new job keeps the draft's origin.
    * Refusals: {@link CastSwapFullQualityRefusalCode}.
@@ -50,5 +53,5 @@ var CastSwapResource = class {
 };
 
 export { CastSwapResource };
-//# sourceMappingURL=chunk-RQH6IKDC.js.map
-//# sourceMappingURL=chunk-RQH6IKDC.js.map
+//# sourceMappingURL=chunk-HKDIIFG2.js.map
+//# sourceMappingURL=chunk-HKDIIFG2.js.map

package/dist/chunk-HKDIIFG2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/cast-swap.ts"],"names":[],"mappings":";AAwdO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASpB,GAAA,CAAI,QAAwB,OAAA,EAA6E;AACvG,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,eAAA,EAAiB;AAAA,MAClD,IAAA,EAAM,MAAA;AAAA,MACN,GAAI,OAAA,EAAS,cAAA,GAAiB,EAAE,OAAA,EAAS,EAAE,iBAAA,EAAmB,OAAA,CAAQ,cAAA,EAAe,EAAE,GAAI;AAAC,KAC7F,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,SAAS,MAAA,EAAmD;AAC1D,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,0BAA0B,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,oBAAoB,KAAA,EAAqD;AACvE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,CAAA,cAAA,EAAiB,kBAAA,CAAmB,KAAK,CAAC,CAAA,sBAAA,CAAA,EAA0B,EAAE,IAAA,EAAM,IAAI,CAAA;AAAA,EACrH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,WAAA,CAAY,KAAA,EAAe,MAAA,GAAoC,EAAC,EAAuC;AACrG,IAAA,MAAM,IAAA,GAAO,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,MAAA,CAAO,SAAA,EAAU,GAAI,EAAC;AACjF,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,CAAA,cAAA,EAAiB,kBAAA,CAAmB,KAAK,CAAC,CAAA,aAAA,CAAA,EAAiB,EAAE,IAAA,EAAM,CAAA;AAAA,EACxG;AACF","file":"chunk-HKDIIFG2.js","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\n\n/**\n * Cast Swap — replace the people, pets, products and/or the location in a\n * short video with your own references, keeping its motion, framing, timing\n * and sound (the clip's audio is kept, and the result is the clip's length).\n *\n * Before the video, each person, pet and product role's photos are turned\n * into one clean reference picture by an image model. This costs extra\n * credits (`breakdown.references` in the estimate), charged when it runs, even\n * if the video then fails; it adds about a minute, falls back to your own\n * photos if it fails, and is turned off with `prepareReferences: false`.\n * Locations are not prepared.\n *\n * Engines: a run is made on Seedance 2.5 (`engine` left out, or\n * `\"seedance-2-5\"`) or Kling 4 (`\"kling-4\"`). Kling 4 renders 720p (its\n * default) or 1080p and has no draft; it makes a new take guided by the clip\n * and pictures, so its Full Quality is a new take at 1080p rather than the\n * same take re-rendered (`CastSwapFullQualityEstimate.kind`).\n *\n * Cloud edition only: `/v1/cast-swap` is served by the cloud plugin and 404s\n * on self-hosted installs. `run()` answers 202 with a job id; follow it with\n * `client.jobs.get(jobId)` / `client.jobs.getStatus(jobId)` like any other job.\n *\n * Repeats: pass `{ idempotencyKey }` to `run()` and it is sent as the\n * `Idempotency-Key` header. A repeat with the same key within the credit\n * guard's dedup window (about 10 s) answers 200 `{ jobId, deduped: true }` with\n * an `X-Dedup-Hit` header; a later one answers 202 with the first run's\n * `jobId`. Nothing new is started or charged.\n *\n * Refusals (thrown as a `NodaroError` subclass; body `{ error: { code, message } }`), before\n * anything is charged: 400 `validation_error` (the body: no role with images,\n * no reference and no `prePrompt` or `postPrompt`, more roles of a kind\n * than allowed, more than 30 images in all, `draft: true` above 480p, a\n * `prePrompt` or `postPrompt` over 4,000 characters, a `faceMasking` setting\n * out of range); on Kling 4, `draft_unsupported` (`draft: true`),\n * `resolution_unsupported` (480p), `output_format_unsupported` (a MOV edit\n * output) and `too_many_images` (more than 10 images in the run, across every\n * role and fixed reference); `raw_reference_token` (also in a reference's `line`),\n * `invalid_role_mention` (also any `{role:N}` in a reference's `line`),\n * `unsafe_url`, `video_unreadable`, `clip_out_of_range` (4–30 s),\n * `preview_out_of_range`, `no_roles_in_preview` (a preview with every role\n * `inPreview: false`, always refused even with a prompt, or with no role kept\n * in it that has images and no `prePrompt` or `postPrompt`), `prompt_too_long`\n * (the prompt would build too long: a `{role:N}` reads as the role's name when\n * it sends no images; Kling 4's cap is 8,000 characters); 401; 402 `insufficient_credits` (`run()` only); 404\n * (a `sessionId` you may not use, `run()` only); 422 `job_blocked` (`run()`\n * only); 503 `host_too_old` (both); 503 `estimate_unavailable` (`estimate()`\n * only).\n */\n\n/**\n * The video engine a Cast Swap run is made on. Left out = `\"seedance-2-5\"`.\n *\n * - `\"seedance-2-5\"`: 480p (the default, a draft unless `draft: false`), 720p\n *   or 1080p; Full Quality re-renders a draft's own take at 1080p.\n * - `\"kling-4\"`: 720p (the default) or 1080p, never a draft (`draft: true`\n *   answers 400 `draft_unsupported`); Full Quality makes a new take at 1080p\n *   from a completed 720p run's inputs. A preview is still 4 s from\n *   `previewStart`.\n */\nexport type CastSwapEngine = \"seedance-2-5\" | \"kling-4\"\n\n/**\n * Where a Kling 4 run cuts the clip to whole seconds (Kling renders whole\n * seconds; asked for more than the clip, it would stretch the motion):\n * - `\"cut-end\"` (the default): drop the fraction of a second at its end;\n * - `\"cut-start\"`: drop it at its start.\n */\nexport type CastSwapKlingLength = \"cut-end\" | \"cut-start\"\n\n/** Whether a swapped subject takes this trait from the references (`\"new\"`) or keeps the video's (`\"original\"`). */\nexport type CastSwapTraitSource = \"new\" | \"original\"\n\n/**\n * Preview-only settings, on every role kind; a full run (`preview` not `true`)\n * ignores both.\n */\nexport interface CastSwapRolePreviewSettings {\n  /** The name used instead of `name` in a preview. Same rules as `name` (1–200 characters). */\n  previewName?: string\n  /**\n   * `false` leaves this role out of the preview: its reference images are not\n   * sent, not prepared and not charged, and a `{role:N}` naming it reads as its\n   * `previewName`, else its `name`. Default `true`. A preview with every role\n   * left out (always refused, even with a prompt), or with no role kept in it\n   * that has images and no pre / post prompt, answers 400 `no_roles_in_preview`.\n   */\n  inPreview?: boolean\n}\n\n/** A person in the video to recast. */\nexport interface CastSwapPersonRole extends CastSwapRolePreviewSettings {\n  kind: \"person\"\n  /** How the person is told apart in the video, e.g. `\"the woman that attacks\"`. */\n  name: string\n  /** 0–3 images of ONE person. Empty or `null` keeps the original person. */\n  images: string[] | null\n  /** Body from the references or the video. Default `\"new\"`. */\n  body?: CastSwapTraitSource\n  /** Outfit from the references or the video. Default `\"new\"`. */\n  outfit?: CastSwapTraitSource\n  /** Hairstyle and haircut from the references or the video. Default `\"new\"`. */\n  hair?: CastSwapTraitSource\n}\n\n/** The place the video happens in. */\nexport interface CastSwapLocationRole extends CastSwapRolePreviewSettings {\n  kind: \"location\"\n  /** How the place is named. Default `\"the setting\"`. */\n  name?: string\n  /** 0–3 images of ONE place. Empty or `null` keeps the original place. */\n  images: string[] | null\n}\n\n/** An animal in the video to recast. */\nexport interface CastSwapPetRole extends CastSwapRolePreviewSettings {\n  kind: \"pet\"\n  /** How the animal is told apart in the video, e.g. `\"the dog\"`. */\n  name: string\n  /** 0–3 images of ONE animal. Empty or `null` keeps the original animal. */\n  images: string[] | null\n  /** Body (shape, size and build) from the references or the video. Default `\"new\"`. */\n  body?: CastSwapTraitSource\n  /** Coat (fur, colors and markings) from the references or the video. Default `\"new\"`. */\n  coat?: CastSwapTraitSource\n}\n\n/** An object in the video to recast. */\nexport interface CastSwapProductRole extends CastSwapRolePreviewSettings {\n  kind: \"product\"\n  /** How the object is told apart in the video, e.g. `\"the can\"`. */\n  name: string\n  /** 0–3 images of ONE product. Empty or `null` keeps the original object. */\n  images: string[] | null\n  /** Shape and proportions from the references or the video. Default `\"new\"`. */\n  shape?: CastSwapTraitSource\n  /** Finish (colors, materials, label and markings) from the references or the video. Default `\"new\"`. */\n  finish?: CastSwapTraitSource\n}\n\nexport type CastSwapRole = CastSwapPersonRole | CastSwapLocationRole | CastSwapPetRole | CastSwapProductRole\n\n/**\n * A fixed reference: 1–3 images of ONE thing that no role replaces, and the\n * line that says what it is (`\"the glass she drinks from\"`). Sent as given,\n * never prepared; its images count toward the 30.\n */\nexport interface CastSwapReference {\n  /** 1–3 http(s) image URLs of one thing. */\n  images: string[]\n  /**\n   * What it is, 1–500 characters. `{image}` in the line stands for this\n   * reference's first image (`\"Use {image} for the sky\"`); a line without it\n   * gets it appended. A `{role:N}` or a raw `{image:` / `{video:` / `{audio:`\n   * token answers 400.\n   */\n  line: string\n}\n\n/**\n * Margins of the frame, each 0–49 %: a face whose centre lies in a margin is\n * not masked, so only faces inside the inner rectangle are. A margin left out\n * of a zone that is given is 0. (A `zone` left out altogether is 10 % at the\n * left and right: see `CastSwapFaceMasking.zone`.)\n */\nexport interface CastSwapFaceMaskingZone {\n  /** % of the frame's width from the left edge. Default 0 in a zone that is given. */\n  leftPct?: number\n  /** % of the frame's width from the right edge. Default 0 in a zone that is given. */\n  rightPct?: number\n  /** % of the frame's height from the top edge. Default 0. */\n  topPct?: number\n  /** % of the frame's height from the bottom edge. Default 0. */\n  bottomPct?: number\n}\n\n/**\n * Face masking: the faces in the source clip are covered before the video\n * model sees it, keeping their movement and lip timing while the rest of the\n * clip is sent as it is.\n *\n * - `\"off\"` (the same as leaving `faceMasking` out): the clip is sent as it is.\n * - `\"always\"`: the faces are masked before the first attempt. Its credits are\n *   in the quote (`breakdown.masking`, counted in `totalCredits`).\n * - `\"auto\"`: the run starts unmasked; only if the video model refuses the\n *   source clip is it retried once with the faces masked. Any other failure is\n *   not retried. The extra credits, charged only when that retry runs, are the\n *   estimate's `maskingCredits` (not in `totalCredits`).\n *\n * A completed job's output carries `faceMasking: { applied, reason }`:\n * `applied` is whether the video was made from the masked clip, and `reason`\n * is `\"always\"` (masked before the first attempt), `\"input_refused\"` (`auto`\n * retried after the source clip was refused), `\"no_faces\"` (no face was left\n * to mask after the filters: an `always` run continues unmasked; an `auto`\n * run fails with the original refusal instead) or `\"off\"`.\n */\nexport interface CastSwapFaceMasking {\n  mode: \"off\" | \"always\" | \"auto\"\n  /** What covers a masked face: `\"blur\"` (default) or `\"depth\"` (a depth-color view of it). */\n  fill?: \"blur\" | \"depth\"\n  /** Mask only faces at least this % of the frame's height, 0–100. Default 15. */\n  minFaceHeightPct?: number\n  /**\n   * Mask only faces at most this % of the frame's height, 0–100. Default 0 (no\n   * limit). When above 0 it must be at least `minFaceHeightPct` (else 400).\n   */\n  maxFaceHeightPct?: number\n  /**\n   * Leave out faces near the edges of the frame. Default (left out):\n   * `{ leftPct: 10, rightPct: 10, topPct: 0, bottomPct: 0 }`, so people at the\n   * left and right edges are not masked. `null`, or all four margins 0, means\n   * no margins.\n   */\n  zone?: CastSwapFaceMaskingZone | null\n  /** The blur's strength, 0.1–5 % of the frame's width (`fill: \"blur\"`). Default 2. */\n  blurStrengthPct?: number\n  /** How sure the face finder must be, 0.05–0.95: lower finds more faces. Default 0.5. */\n  threshold?: number\n}\n\n/** The body of `POST /v1/cast-swap` and `POST /v1/cast-swap/estimate`. */\nexport interface CastSwapParams {\n  /** The source clip, 4–30 seconds. */\n  videoUrl: string\n  /**\n   * Who and what to swap: at most 6 person roles, 1 location role, 3 pet roles\n   * and 3 product roles, with at most 30 images in all. A role with no images\n   * is skipped (that subject or place stays as in the video). At least one role\n   * with images, or a `prePrompt` or `postPrompt`, is required.\n   */\n  roles: CastSwapRole[]\n  /**\n   * Fixed references (at most 5): things the video should show that no role\n   * replaces, each with the line that names it. Their images count toward the\n   * 30. A reference alone is enough for a run (no role needs images).\n   */\n  references?: CastSwapReference[]\n  /**\n   * Your own words placed at the start of the prompt, before the role\n   * instructions; at most 4,000 characters. Mention a role as `{role:N}`, as in\n   * `postPrompt`; the same 400 refusals apply (an N outside 1..`roles.length`,\n   * a raw `{image:` / `{video:` / `{audio:` token).\n   */\n  prePrompt?: string\n  /**\n   * Extra instructions in your own words, at most 4,000 characters. Mention a\n   * role as `{role:N}`, where N is its 1-based position in `roles`\n   * (`{role:1}` is `roles[0]`; empty roles count).\n   *\n   * The route answers 400, before charging, for an N outside 1..`roles.length`,\n   * for a raw `{image:` / `{video:` / `{audio:` token in the pre or post prompt\n   * or a role's `name`, for a clip outside 4–30 s, and for a preview past the clip's\n   * end (`previewStart + 4` > its length).\n   */\n  postPrompt?: string\n  /** `true` runs on 4 seconds of the clip, starting at `previewStart`: a cheap check of the roles and choices. */\n  preview?: boolean\n  /** Where the preview starts, in seconds. Default 0. */\n  previewStart?: number\n  /**\n   * The video engine (see {@link CastSwapEngine}). Default `\"seedance-2-5\"`.\n   * The job records it in `input_data.engine`, and a completed job's output\n   * in its `engine`. A Cast Swap engine older than Kling 4 support ignores\n   * the field and runs Seedance 2.5: a Kling 4 quote names `engine:\n   * \"kling-4\"`, so check the estimate's `engine` before running.\n   */\n  engine?: CastSwapEngine\n  /**\n   * Kling 4 only (Seedance 2.5 ignores it): which end of the clip is cut to\n   * whole seconds (see {@link CastSwapKlingLength}). Default `\"cut-end\"`.\n   */\n  klingLength?: CastSwapKlingLength\n  /**\n   * The output resolution. Seedance 2.5: `\"480p\"` (default), `\"720p\"` or\n   * `\"1080p\"`. Kling 4: `\"720p\"` (default) or `\"1080p\"`; `\"480p\"` answers 400.\n   */\n  resolution?: \"480p\" | \"720p\" | \"1080p\"\n  /**\n   * Render as a draft (Seedance 2.5 only). Defaults to `true` at 480p and\n   * `false` above it; `true` with `\"720p\"` or `\"1080p\"` answers 400 (draft is\n   * 480p only). Kling 4 has no draft: `true` answers 400 `draft_unsupported`.\n   */\n  draft?: boolean\n  /**\n   * Turn each person, pet and product role's photos into one clean reference\n   * picture before the video (extra credits, shown in `breakdown.references`;\n   * about a minute longer; falls back to your own photos if it fails).\n   * Default `true`.\n   */\n  prepareReferences?: boolean\n  /** Mask the faces in the source clip (see {@link CastSwapFaceMasking}). Default: off. */\n  faceMasking?: CastSwapFaceMasking\n  /**\n   * `\"draft\"` means 480p draft.\n   * @deprecated use `resolution` + `draft`.\n   */\n  quality?: \"draft\"\n  /** A generation session to file the result in. */\n  sessionId?: string\n  /** The client app that sent the run (stored on the job as `input_data.origin`). */\n  origin?: string\n}\n\n/** What a run would cost, in credits. */\nexport interface CastSwapEstimate {\n  /**\n   * The engine the run would use. Sent by an engine that knows Kling 4 on a\n   * Kling 4 quote (`\"kling-4\"`); absent = Seedance 2.5.\n   */\n  engine?: CastSwapEngine\n  /**\n   * What is held when the run starts: `breakdown.castSwap +\n   * breakdown.seedance + breakdown.references` (on Kling 4,\n   * `breakdown.kling` in place of `breakdown.seedance`), plus\n   * `breakdown.masking` with face masking `\"always\"`. The run is charged what it actually costs, which\n   * is expected to be `expectedCredits`.\n   */\n  totalCredits: number\n  /**\n   * The charge the run is expected to come to: `breakdown.castSwap +\n   * breakdown.seedanceExpected + breakdown.references`, plus\n   * `breakdown.masking` with face masking `\"always\"` (the hold, with the video\n   * model's expected charge in place of its hold). Never above `totalCredits`.\n   * With `\"auto\"` the masking is in neither total (see `maskingCredits`).\n   * `totalCredits` is what is held when the run starts; the run is charged\n   * what it actually costs.\n   *\n   * Absent from an older Cast Swap engine: read `totalCredits` then. On\n   * Kling 4 it equals `totalCredits` (Kling renders exactly the length asked\n   * for, so the hold is what it settles at).\n   */\n  expectedCredits?: number\n  /**\n   * The parts of the quote:\n   * - `castSwap`: the run itself;\n   * - `seedance`: what the video model it calls holds (the video's length is\n   *   left to the model, so it is held at the model's longest output);\n   * - `seedanceExpected`: what the video model is expected to be charged (the\n   *   clip in and about as much out), never above `seedance`. It takes\n   *   `seedance`'s place in `expectedCredits`; it is not added to it. Absent\n   *   from an older Cast Swap engine, like `expectedCredits`;\n   * - `kling`: Kling 4 only, in place of `seedance` and `seedanceExpected`:\n   *   what the Kling take costs (held and charged alike);\n   * - `references`: preparing the reference pictures (0 when\n   *   `prepareReferences` is off or there is nothing to prepare);\n   * - `masking`: masking the faces, present only when `faceMasking` is on.\n   *   With `\"always\"` it is in both totals; with `\"auto\"` it equals\n   *   `maskingCredits` and is in neither.\n   *\n   * So the parts sum to more than either total: `seedance` and\n   * `seedanceExpected` are alternatives, and `\"auto\"` masking is outside both.\n   */\n  breakdown: { castSwap: number; seedance?: number; references: number; seedanceExpected?: number; kling?: number; masking?: number }\n  /**\n   * Face masking `\"auto\"` only: the extra credits charged if the source clip\n   * is refused and the run is retried with the faces masked. Not in\n   * `totalCredits` or `expectedCredits`; `run()` needs credits for both the\n   * hold and this (else 402).\n   */\n  maskingCredits?: number\n  /**\n   * `true` when the video is made at Auto length (every Seedance 2.5 run): the\n   * final charge is expected to come out lower than `totalCredits`, at about\n   * `expectedCredits`. `false` on Kling 4.\n   */\n  settlesLower: boolean\n}\n\n/** Per-call options for {@link CastSwapResource.run}. */\nexport interface CastSwapRunOptions {\n  /**\n   * Sent as the `Idempotency-Key` header, unchanged (the SDK checks nothing;\n   * an empty string sends no header, like no key).\n   * The server takes 8–200 characters and answers 400 for any other length.\n   * Reuse the same value when retrying the same run: within about 10 s the\n   * repeat answers 200 `{ jobId, deduped: true }`, later 202 with the first\n   * run's `jobId`. Nothing new is started or charged.\n   */\n  idempotencyKey?: string\n}\n\n/**\n * What a Full Quality version would be: `\"same-take\"` re-renders a Seedance\n * 2.5 draft's own take at 1080p; `\"new-take\"` makes a new Kling 4 take at\n * 1080p from a 720p run's inputs (it will not match the 720p run frame for\n * frame). The 720p run or draft stays either way.\n */\nexport type CastSwapFullQualityKind = \"same-take\" | \"new-take\"\n\n/**\n * What a Full Quality version of a run would cost\n * (`POST /v1/cast-swap/:jobId/full-quality/estimate`): a Seedance 2.5 draft,\n * or a completed Kling 4 run at 720p.\n */\nexport interface CastSwapFullQualityEstimate {\n  /**\n   * Which Full Quality this is ({@link CastSwapFullQualityKind}), so it can\n   * be worded right. Absent from an older Cast Swap engine: `\"same-take\"`.\n   */\n  kind?: CastSwapFullQualityKind\n  /** The quote in credits: `breakdown.castSwap` + `breakdown.seedanceHd` (same take) or `breakdown.kling` (new take). */\n  totalCredits: number\n  /**\n   * `castSwap`: the Full Quality job's own steps; `seedanceHd` (a same take):\n   * the 1080p render of the draft's take (0 when an earlier try of this draft\n   * already finished that render, which is then reused); `kling` (a new take,\n   * in place of `seedanceHd`): the new Kling 4 take at 1080p.\n   */\n  breakdown: { castSwap: number; seedanceHd?: number; kling?: number }\n  /** ISO time until which the run can be finished at Full Quality (7 days after it completed). */\n  availableUntil: string\n}\n\n/** Options for {@link CastSwapResource.fullQuality}. */\nexport interface CastSwapFullQualityParams {\n  /** A generation session to file the Full Quality result in. */\n  sessionId?: string\n}\n\n/** The Full Quality job (`POST /v1/cast-swap/:jobId/full-quality`). */\nexport interface CastSwapFullQualityResult {\n  jobId: string\n  /** `true` when this run's Full Quality was already running or done: that job is answered, nothing new is started or charged. */\n  existing?: boolean\n}\n\n/**\n * The `code` of a Full Quality refusal (`NodaroError.code`), all before\n * anything is charged:\n * - `unauthorized` (401): no authenticated user;\n * - `not_found` (404): not your job, or not a Cast Swap run; also a\n *   `sessionId` you may not use;\n * - `not_completed` (409): the run has not finished;\n * - `not_a_draft` (409): the run is neither a Seedance 2.5 draft nor a\n *   Kling 4 run at 720p (a Kling 4 run at 1080p is already Full Quality);\n * - `draft_expired` (410): more than 7 days after the draft completed, or\n *   the draft can no longer be finished at Full Quality;\n * - `full_quality_pending` (409, `details.retryable: true`): not final — an\n *   earlier try's 1080p render of this draft is being reviewed, or has not\n *   started yet; try again later (once the review ends). The only refusal\n *   that ends on its own;\n * - `full_quality_unavailable` (409): final — nothing kept to re-render, no\n *   readable completion time, or the 1080p finalize refuses this draft; on\n *   the start only, also \"failed too many times\" (every try failed) or no\n *   try can be started for this run;\n * - `insufficient_credits` (402), or in a workspace `budget_exceeded`,\n *   `member_cap_exceeded` or `user_allowance_exceeded`;\n * - `job_blocked` (422): the request was blocked by the job policy;\n * - `job_read_failed` (503, retryable), `estimate_unavailable` (503, try\n *   again shortly), `host_too_old` (503).\n *\n * Open-ended: a code not listed here may still arrive.\n */\nexport type CastSwapFullQualityRefusalCode =\n  | \"unauthorized\"\n  | \"not_found\"\n  | \"not_completed\"\n  | \"not_a_draft\"\n  | \"draft_expired\"\n  | \"full_quality_pending\"\n  | \"full_quality_unavailable\"\n  | \"insufficient_credits\"\n  | \"budget_exceeded\"\n  | \"member_cap_exceeded\"\n  | \"user_allowance_exceeded\"\n  | \"job_blocked\"\n  | \"job_read_failed\"\n  | \"estimate_unavailable\"\n  | \"host_too_old\"\n  | (string & {})\n\nexport class CastSwapResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /**\n   * Start a Cast Swap run (`POST /v1/cast-swap`, 202 `{ jobId }`). Returns the\n   * job to follow. With `options.idempotencyKey` (sent as the\n   * `Idempotency-Key` header; 8–200 characters, else 400) a repeat with the\n   * same key within about 10 s answers 200 `{ jobId, deduped: true }`, a later\n   * one 202 with the first run's `jobId`; nothing new starts.\n   */\n  run(params: CastSwapParams, options?: CastSwapRunOptions): Promise<{ jobId: string; deduped?: boolean }> {\n    return this.client.request(\"POST\", \"/v1/cast-swap\", {\n      body: params,\n      ...(options?.idempotencyKey ? { headers: { \"Idempotency-Key\": options.idempotencyKey } } : {}),\n    })\n  }\n\n  /** Quote a run before starting it (`POST /v1/cast-swap/estimate`); spends nothing. */\n  estimate(params: CastSwapParams): Promise<CastSwapEstimate> {\n    return this.client.request(\"POST\", \"/v1/cast-swap/estimate\", { body: params })\n  }\n\n  /**\n   * Quote finishing a run at Full Quality (`POST\n   * /v1/cast-swap/:jobId/full-quality/estimate`); spends nothing. `jobId` is a\n   * finished Seedance 2.5 DRAFT run, or a finished Kling 4 run at 720p (a Cast\n   * Swap or trend run); the quote's `kind` says whether it is the same take\n   * re-rendered or a new take. The quote\n   * does not look for a Full Quality already running: when one is,\n   * {@link fullQuality} answers it (`existing: true`) and charges nothing.\n   * Refusals: {@link CastSwapFullQualityRefusalCode}.\n   */\n  fullQualityEstimate(jobId: string): Promise<CastSwapFullQualityEstimate> {\n    return this.client.request(\"POST\", `/v1/cast-swap/${encodeURIComponent(jobId)}/full-quality/estimate`, { body: {} })\n  }\n\n  /**\n   * Finish a run at Full Quality (`POST /v1/cast-swap/:jobId/full-quality`):\n   * at 1080p, with the clip's audio, as a new job linked to the run — a\n   * Seedance 2.5 draft's own take re-rendered, or a new Kling 4 take from a\n   * 720p run's inputs (the quote's `kind`). SPENDS CREDITS: quote it first with\n   * {@link fullQualityEstimate}. Answers 202 `{ jobId }`, or 200\n   * `{ jobId, existing: true }` when this run's Full Quality is already\n   * running or done (one per run; a failed one may be asked again). Follow\n   * the job with `client.jobs.get(jobId)`. No `Idempotency-Key` is taken: the\n   * server keys the job by the draft. The new job keeps the draft's origin.\n   * Refusals: {@link CastSwapFullQualityRefusalCode}.\n   */\n  fullQuality(jobId: string, params: CastSwapFullQualityParams = {}): Promise<CastSwapFullQualityResult> {\n    const body = params.sessionId !== undefined ? { sessionId: params.sessionId } : {}\n    return this.client.request(\"POST\", `/v1/cast-swap/${encodeURIComponent(jobId)}/full-quality`, { body })\n  }\n}\n"]}

package/dist/{chunk-BLA44UCM.js → chunk-KFZOJBI5.js}

@@ -28,5 +28,5 @@ var PickerCatalogsResource = class {
 };
 
 export { PickerCatalogsResource };
-//# sourceMappingURL=chunk-BLA44UCM.js.map
-//# sourceMappingURL=chunk-BLA44UCM.js.map
+//# sourceMappingURL=chunk-KFZOJBI5.js.map
+//# sourceMappingURL=chunk-KFZOJBI5.js.map

package/dist/chunk-KFZOJBI5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/picker-catalogs.ts"],"names":[],"mappings":";AAyIO,IAAM,yBAAN,MAA6B;AAAA,EAClC,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA,EAGpB,IAAA,GAAkD;AAChD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,qBAAqB,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA,EAIA,YAAY,MAAA,EAAyD;AACnE,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,sBAAsB,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,GAAA,CAAI,QAAA,EAAkB,IAAA,GAAgC,EAAC,EAAqC;AAC1F,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,IAAI,KAAK,MAAA,EAAQ,EAAA,CAAG,GAAA,CAAI,QAAA,EAAU,KAAK,MAAM,CAAA;AAC7C,IAAA,IAAI,KAAK,QAAA,EAAU,EAAA,CAAG,GAAA,CAAI,UAAA,EAAY,KAAK,QAAQ,CAAA;AACnD,IAAA,IAAI,KAAK,KAAA,EAAO,EAAA,CAAG,GAAA,CAAI,OAAA,EAAS,KAAK,KAAK,CAAA;AAC1C,IAAA,MAAM,KAAA,GAAQ,GAAG,QAAA,EAAS;AAC1B,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,oBAAA,EAAuB,mBAAmB,QAAQ,CAAC,GAAG,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,GAAK,EAAE,CAAA;AAAA,KAChF;AAAA,EACF;AACF","file":"chunk-KFZOJBI5.js","sourcesContent":["import type { CharacterMotionMetadata } from \"@nodaro/shared/types\"\nimport type { NodaroClientCore } from \"../core.js\"\n\n/**\n * Picker-catalog types. Mirrors `@nodaro/shared`'s `ProjectedPickerCatalog` /\n * `PickerCatalogSummary` so the SDK stays dependency-free (same convention as\n * `NodeDescriptor` mirroring node-registry).\n */\nexport interface PickerOption {\n  id: string\n  label: string\n  description?: string\n  category?: string\n  /** The prompt fragment this id injects downstream. Present only when detail=\"full\". */\n  promptHint?: string\n  /**\n   * Short professional term injected by compact hint mode; `label` is for\n   * display. Present at BOTH detail levels — a thin client renders `label`\n   * and injects `term`. Empty for a no-op (\"auto\"/\"none\") entry that injects\n   * nothing.\n   */\n  term?: string\n  icon?: string\n  /** Authored Character Motion prerequisites and sequence state. Missing means unknown. */\n  motion?: CharacterMotionMetadata\n  /**\n   * Per-option parameters — node-data fields that apply only while THIS option\n   * is picked (the Transition catalog's `wipe` → `wipeDirection`). Same shape\n   * as a catalog's `dimensions`, at both detail levels; `auto` leads each list\n   * and means \"send nothing\". Absent on every other option.\n   */\n  params?: PickerDimension[]\n  /**\n   * Absolute URL of the option's picture — a photo, 3D emoji, flag or (Nodaro\n   * Cloud only) rendered look preview — on the installation's own host, or the\n   * Nodaro CDN for look previews. Absent when the option has no picture. Use it\n   * as given: file names carry a content hash, so it can be cached for good.\n   */\n  imageUrl?: string\n  /**\n   * The same picture at several widths, as an HTML `srcset` value\n   * (`<url> 240w, <url> 480w, <url> 960w, <url> 1920w`) — present only for a\n   * render the Nodaro CDN resizes (Nodaro Cloud: the look previews and the\n   * music pickers' pictures). Pass it to `<img srcset>` with a `sizes` so a\n   * large tile stays sharp; `imageUrl` is its 480px member.\n   */\n  imageSrcSet?: string\n}\n\nexport interface PickerDimension {\n  field: string\n  label: string\n  options: PickerOption[]\n}\n\n/** A topic a multi-dim catalog's settings are grouped under in the editor (person, styling). */\nexport interface PickerCatalogSection {\n  /** English topic name, e.g. \"Identity\", \"Beauty & Hair\". */\n  label: string\n  /** Node-data fields of the settings in this topic, in display order. */\n  fields: string[]\n  /** Absolute URL of the topic's round picture. Absent when it has none. */\n  imageUrl?: string\n}\n\nexport interface PickerCatalog {\n  nodeType: string\n  label: string\n  catalogId: string\n  kind: \"single\" | \"multi\"\n  /** single only — the node-data field the chosen id writes to. */\n  valueField?: string\n  defaultValue?: string\n  categoryOrder?: string[]\n  categoryLabels?: Record<string, string>\n  /** single-dim catalogs. */\n  options?: PickerOption[]\n  /** multi-dim catalogs. */\n  fields?: string[]\n  /** Per-field option lists. Multi-dim catalogs always carry these; a\n   *  single-dim catalog carries them when it has secondary parameter\n   *  fields beside its main picker (transition position/duration/intensity). */\n  dimensions?: PickerDimension[]\n  detail?: \"compact\" | \"full\"\n  /** person and styling: the topics their settings are grouped under, in order, each with its picture. */\n  sections?: PickerCatalogSection[]\n}\n\nexport interface PickerCatalogSummary {\n  nodeType: string\n  label: string\n  catalogId: string\n  kind: \"single\" | \"multi\"\n  valueField?: string\n  fields?: string[]\n  optionCount: number\n  /** How many of those options carry an `imageUrl` (0 = no pictures). Absent from servers that predate pictures. */\n  imageCount?: number\n}\n\nexport interface GetPickerCatalogOptions {\n  /** \"compact\" (default) = id, label, category, term, icon, imageUrl; \"full\" additionally includes description + promptHint. */\n  detail?: \"compact\" | \"full\"\n  /** single-dim: filter to one category. */\n  category?: string\n  /** multi-dim: only this dimension field. */\n  field?: string\n}\n\n/** Input for `analyzeText` (POST /v1/text-to-picker). */\nexport interface TextToPickerParams {\n  /** Free-text scene/shot description to analyze. */\n  text: string\n  /** Picker node types to fill. Omit for ALL analyzable pickers (the server\n   *  fans the analysis out per family and merges). */\n  targetPickers?: string[]\n  /** Extra guidance appended to the analyzer system prompt. */\n  instructions?: string\n  /** Originating client app slug (e.g. \"cine\") — attribution only. */\n  origin?: string\n  llmModel?: string\n  reasoningEffort?: string\n}\n\nexport interface TextToPickerResult {\n  jobId: string\n  /** pickerType → dimension → chosen catalog id(s) — same shape as\n   *  describe-to-picker; hydrate pickers from it verbatim. */\n  pickerJson: Record<string, Record<string, string | string[]>>\n  /** Catalog-coverage feedback (attributes the text described that no\n   *  catalog id represents well). Surface as \"we couldn't infer X\". */\n  gaps?: {\n    missingItems: Array<{ picker: string; dimension: string; observed: string }>\n    missingCategories: Array<{ picker: string; suggestedDimension: string; observed: string }>\n  }\n}\n\nexport class PickerCatalogsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /** List every parameter-picker node type + its option count. Cached publicly 5 min. */\n  list(): Promise<{ data: PickerCatalogSummary[] }> {\n    return this.client.request(\"GET\", \"/v1/picker-catalogs\")\n  }\n\n  /** Fill pickers from a free-text description (Cine \"AI Fill\"): returns the\n   *  same pickerJson shape as describe-to-picker, keyed by picker node type. */\n  analyzeText(params: TextToPickerParams): Promise<TextToPickerResult> {\n    return this.client.request(\"POST\", \"/v1/text-to-picker\", { body: params })\n  }\n\n  /** Get one picker's catalog of valid values. */\n  get(nodeType: string, opts: GetPickerCatalogOptions = {}): Promise<{ data: PickerCatalog }> {\n    const qs = new URLSearchParams()\n    if (opts.detail) qs.set(\"detail\", opts.detail)\n    if (opts.category) qs.set(\"category\", opts.category)\n    if (opts.field) qs.set(\"field\", opts.field)\n    const query = qs.toString()\n    return this.client.request(\n      \"GET\",\n      `/v1/picker-catalogs/${encodeURIComponent(nodeType)}${query ? `?${query}` : \"\"}`,\n    )\n  }\n}\n"]}

package/dist/{chunk-TMRRXQQL.cjs → chunk-MPQQC45L.cjs}

@@ -36,7 +36,7 @@ async function readBinaryResponse(response, maxBytes) {
   }
   return bytes.buffer;
 }
-var SDK_VERSION = "2.43.0" ;
+var SDK_VERSION = "2.44.0" ;
 var CLIENT_HEADER = "X-Nodaro-Client";
 var isBrowser = () => typeof window !== "undefined" && typeof window.document !== "undefined";
 var NodaroClientCore = class {
@@ -229,5 +229,5 @@ exports.CallbackAuth = CallbackAuth;
 exports.NodaroClientCore = NodaroClientCore;
 exports.StaticTokenAuth = StaticTokenAuth;
 exports.supabaseAuth = supabaseAuth;
-//# sourceMappingURL=chunk-TMRRXQQL.cjs.map
-//# sourceMappingURL=chunk-TMRRXQQL.cjs.map
+//# sourceMappingURL=chunk-MPQQC45L.cjs.map
+//# sourceMappingURL=chunk-MPQQC45L.cjs.map

package/dist/{chunk-TMRRXQQL.cjs.map → chunk-MPQQC45L.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":["WORKSPACE_HEADER","throwFromResponse"],"mappings":";;;;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAACA,8BAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAAC,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-TMRRXQQL.cjs","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":["WORKSPACE_HEADER","throwFromResponse"],"mappings":";;;;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAACA,8BAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAAC,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-MPQQC45L.cjs","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}

package/dist/{chunk-VADPSFLS.cjs → chunk-QHXLMCBR.cjs}

@@ -100,5 +100,5 @@ var TrendsResource = class {
 };
 
 exports.TrendsResource = TrendsResource;
-//# sourceMappingURL=chunk-VADPSFLS.cjs.map
-//# sourceMappingURL=chunk-VADPSFLS.cjs.map
+//# sourceMappingURL=chunk-QHXLMCBR.cjs.map
+//# sourceMappingURL=chunk-QHXLMCBR.cjs.map

package/dist/chunk-QHXLMCBR.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/trends.ts"],"names":[],"mappings":";;;AA4DA,IAAM,cAAA,GAAmD;AAAA,EACvD,IAAA,EAAM,0BAAA;AAAA,EACN,IAAA,EAAM;AACR,CAAA;AAEA,SAAS,SAAA,CAAU,IAAA,EAAc,IAAA,GAAO,EAAA,EAAY;AAClD,EAAA,IAAI,MAAA,CAAO,MAAA,CAAO,cAAA,EAAgB,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,UAAU,CAAA,CAAA,EAAI,IAAI,6CAA6C,cAAA,CAAe,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAClG;AACA,EAAA,OAAO,CAAA,WAAA,EAAc,kBAAA,CAAmB,IAAI,CAAC,GAAG,IAAI,CAAA,CAAA;AACtD;AA8RO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA,EAGpB,IAAA,CAAK,MAAA,GAA2B,EAAC,EAAkC;AACjE,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,CAAA,GAAI,MAAA,CAAO,CAAA;AAC/B,IAAA,IAAI,MAAA,CAAO,GAAA,EAAK,KAAA,CAAM,GAAA,GAAM,MAAA,CAAO,GAAA;AACnC,IAAA,IAAI,MAAA,CAAO,SAAA,EAAW,KAAA,CAAM,SAAA,GAAY,GAAA;AACxC,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA,CAAO,MAAA;AACzC,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA,CAAO,MAAA;AACzC,IAAA,IAAI,OAAO,KAAA,KAAU,MAAA,QAAiB,KAAA,GAAQ,MAAA,CAAO,OAAO,KAAK,CAAA;AACjE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,YAAA,EAAc,EAAE,OAAO,CAAA;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,IAAA,EAAc,MAAA,GAA8B,EAAC,EAAyB;AAC9E,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA,CAAO,MAAA;AACzC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAA+B,KAAA,EAAO,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,KAAA,EAAO,CAAA;AAC9F,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,QAAA,CAAS,IAAA,EAAc,OAAA,EAAkD;AAC7E,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA;AAAA,MAC5B,MAAA;AAAA,MACA,SAAA,CAAU,MAAM,WAAW,CAAA;AAAA,MAC3B,EAAE,MAAM,OAAA;AAAQ,KAClB;AACA,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,GAAA,CAAI,IAAA,EAAc,OAAA,EAA0B,OAAA,EAAuD;AACvG,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA;AAAA,MAC5B,MAAA;AAAA,MACA,SAAA,CAAU,MAAM,OAAO,CAAA;AAAA,MACvB;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,GAAI,OAAA,EAAS,cAAA,GAAiB,EAAE,OAAA,EAAS,EAAE,iBAAA,EAAmB,OAAA,CAAQ,cAAA,EAAe,EAAE,GAAI;AAAC;AAC9F,KACF;AACA,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CAAK,MAAA,GAA8B,EAAC,EAAiC;AACnE,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA,CAAO,MAAA;AACzC,IAAA,IAAI,OAAO,KAAA,KAAU,MAAA,QAAiB,KAAA,GAAQ,MAAA,CAAO,OAAO,KAAK,CAAA;AACjE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,iBAAA,EAAmB,EAAE,OAAO,CAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,KAAA,EAAkC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAA4B,OAAO,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAE,CAAA;AAC/G,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IAAA,CAAK,MAAA,GAA8B,EAAC,EAAwB;AAChE,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA,CAAO,MAAA;AACzC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,MAAA,CAAO,QAA8B,KAAA,EAAO,iBAAA,EAAmB,EAAE,KAAA,EAAO,CAAA;AAC/F,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA6B;AAC1C,IAAA,MAAM,KAAK,MAAA,CAAO,OAAA,CAAc,OAAO,SAAA,CAAU,IAAA,EAAM,WAAW,CAAC,CAAA;AAAA,EACrE;AAAA;AAAA,EAGA,MAAM,WAAW,IAAA,EAA6B;AAC5C,IAAA,MAAM,KAAK,MAAA,CAAO,OAAA,CAAc,UAAU,SAAA,CAAU,IAAA,EAAM,WAAW,CAAC,CAAA;AAAA,EACxE;AACF","file":"chunk-QHXLMCBR.cjs","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\nimport type { CastSwapEngine } from \"./cast-swap.js\"\n\n/**\n * Trends — ready-made Cast Swap recipes. A trend is a short clip with slots\n * (the people, pets, products and place you can replace); fill its slots with\n * your own pictures and run it to get the clip back with them in it.\n *\n * Cloud edition only: `/v1/trends` 404s on self-hosted installs. Only\n * published trends exist here: a draft, unpublished or unknown slug is a 404\n * on every route. `\"runs\"` and `\"tags\"` are never slugs (`/v1/trends/runs` is\n * the run list, `/v1/trends/tags` the tag list): the slug methods throw a\n * `TypeError` for them before any request. `run()` answers 202 with a job id; follow it with\n * `client.jobs.get(jobId)` / `client.jobs.getStatus(jobId)` like any other\n * job, or read it back as a trend run with `getRun(jobId)` / `runs()`.\n *\n * Repeats: pass `{ idempotencyKey }` to `run()` and it is sent as the\n * `Idempotency-Key` header. A repeat with the same key answers with the first\n * run's `jobId`; nothing new is started or charged.\n *\n * Refusals (thrown as a `NodaroError` subclass; body `{ error: { code, message } }`):\n * - 400 `validation_error` (the body, a query, or a bad `cursor`);\n *   `estimate()` / `run()` only, before anything is charged:\n *   `missing_slot` (a required slot without pictures, or an optional one\n *   left empty that the chosen example has no pictures for), `unknown_slot`,\n *   `invalid_choice` (a chip the slot's kind does not take),\n *   `chip_not_offered` (a chip of the kind that the slot's\n *   {@link TrendDetailSlot.chips} does not list: the trend fixes it),\n *   `example_out_of_range` (`example` names none, or an optional slot is left\n *   empty and the trend has no example to fill it), `preview_unavailable` (the trend offers no\n *   preview), `invalid_slot_mention` (a `{slot:<key>}` in `details` naming no\n *   slot), `prompt_too_long` (shorten `details`), `draft_unsupported`\n *   (`draft: true` on a trend whose `engine` has no draft: Kling 4),\n *   `resolution_unsupported` (a `resolution` not in the trend's\n *   `resolutions`), `too_many_images` (a Kling 4 trend's run would send more\n *   than 10 pictures: send fewer per slot). The slot errors carry the\n *   slot's key as `slot` (in `NodaroError.details`), and `chip_not_offered`\n *   the chip as `chip` too.\n * - 401 `unauthorized`.\n * - 404 `not_found`: the trend is not published (every method), or `run()`'s\n *   `sessionId` is not a session you may use.\n * - 502 `engine_error` (`estimate()` / `run()`).\n * - 503 `engine_unsupported` (this platform version cannot run trends yet),\n *   `trend_unavailable` (`estimate()` / `run()`), `not_available` (this\n *   server has no trend catalog yet).\n * - `estimate()` / `run()` answer the video engine's refusals with the trend\n *   routes' OWN codes and fixed messages — never the engine's text or\n *   `issues`: 400 `trend_run_rejected` (the inputs could not run), or\n *   `clip_out_of_range` / `preview_out_of_range` / `video_unreadable` (this\n *   trend's clip), `unsafe_url` (a picture is not a public http(s) address),\n *   `raw_reference_token` (`details` holds `{image:` / `{video:` /\n *   `{audio:`); 402 `insufficient_credits` (or a workspace cap) as given;\n *   413 `storage_limit_exceeded`; 422 `job_blocked` (the job policy\n *   blocked it); 429 `rate_limited`; 503 `engine_unsupported`,\n *   `estimate_unavailable`; 502 `engine_error` for anything else. `run()`\n *   also answers 400 `validation_error` for an `idempotencyKey` outside\n *   8–200 characters.\n */\n\n/** `/v1/trends/runs` is the run list and `/v1/trends/tags` the tag list, so neither can be a trend's slug. */\nconst RESERVED_SLUGS: Readonly<Record<string, string>> = {\n  runs: \"the run list; use runs()\",\n  tags: \"the tag list; use tags()\",\n}\n\nfunction trendPath(slug: string, rest = \"\"): string {\n  if (Object.hasOwn(RESERVED_SLUGS, slug)) {\n    throw new TypeError(`\"${slug}\" is not a trend slug (it is reserved for ${RESERVED_SLUGS[slug]})`)\n  }\n  return `/v1/trends/${encodeURIComponent(slug)}${rest}`\n}\n\n/** What a slot holds. */\nexport type TrendSlotKind = \"person\" | \"location\" | \"product\" | \"pet\"\n\n/** A chip: make this trait anew from your pictures (`\"new\"`), or keep the clip's (`\"original\"`). */\nexport type TrendChoice = \"new\" | \"original\"\n\n/**\n * The chips a slot can take, by its kind: a person `body` / `outfit` / `hair`,\n * a pet `body` / `coat`, a product `shape` / `finish`, a location none.\n */\nexport interface TrendChips {\n  body?: TrendChoice\n  outfit?: TrendChoice\n  hair?: TrendChoice\n  coat?: TrendChoice\n  shape?: TrendChoice\n  finish?: TrendChoice\n}\n\n/** A chip's name: `body`, `outfit`, `hair`, `coat`, `shape` or `finish`. */\nexport type TrendChipKey = keyof TrendChips\n\nexport type TrendResolution = \"480p\" | \"720p\" | \"1080p\"\n\n/**\n * The video engine a trend runs on ({@link CastSwapEngine}): the trend\n * chooses it, never the person running it.\n */\nexport type TrendEngine = CastSwapEngine\n\n/** A trend in the catalog (`list()`). Text is in the resolved locale. */\nexport interface TrendCard {\n  id: string\n  slug: string\n  name: string\n  description?: string\n  tags: string[]\n  /** e.g. `\"trending\"`, `\"new\"`. */\n  badges: string[]\n  /** The trend's first example (never the clip it recasts). */\n  cover: { videoUrl: string; posterUrl?: string; width: number; height: number }\n  /** How many slots of each kind the trend has. */\n  needs: Record<TrendSlotKind, number>\n  /** The length of a full run, in seconds. */\n  durationSec: number\n  isFavorite: boolean\n}\n\n/** One slot of a trend: what it asks you for. */\nexport interface TrendDetailSlot {\n  /** The key to fill in {@link TrendRunRequest.slots}, and to mention in `details` as `{slot:<key>}`. */\n  key: string\n  label: string\n  kind: TrendSlotKind\n  /** A required slot needs pictures; an optional one left empty takes the chosen example's. */\n  required: boolean\n  hint?: string\n  /**\n   * The chips you may set on this slot, in its kind's order; `[]` = none (show\n   * no chips row). A chip of the kind that is not listed is fixed by the\n   * trend: sending it is refused with `400 chip_not_offered`.\n   */\n  chips: TrendChipKey[]\n  /** The starting value of the chips in {@link chips} (only those). */\n  defaults?: TrendChips\n}\n\n/** A finished run shown on a trend's page, with the pictures it used per slot. */\nexport interface TrendExample {\n  videoUrl: string\n  posterUrl?: string\n  width: number\n  height: number\n  /** Slot key → the pictures this example used for it. */\n  slots: Record<string, string[]>\n}\n\n/** A trend's page (`get()`). */\nexport interface TrendDetail extends TrendCard {\n  /** The published version this page shows. */\n  version: number\n  /** `4` when the trend offers a 4-second preview run, else `null`. */\n  previewSec: 4 | null\n  /** The video engine every run of this trend uses. Absent (an older server) = `\"seedance-2-5\"`. */\n  engine?: TrendEngine\n  /**\n   * The resolutions a run may ask for, the default first. Seedance 2.5:\n   * `[\"480p\", \"720p\", \"1080p\"]`, where 480p is a draft (show it as one);\n   * Kling 4: `[\"720p\", \"1080p\"]`, no draft. Offer exactly these.\n   */\n  resolutions: TrendResolution[]\n  slots: TrendDetailSlot[]\n  examples: TrendExample[]\n}\n\n/** What you put in one slot of a run: 1–3 pictures, and the chips the slot offers ({@link TrendDetailSlot.chips}). */\nexport interface TrendRunSlot extends TrendChips {\n  images?: string[]\n}\n\n/** The body of `estimate()` and `run()`. */\nexport interface TrendRunRequest {\n  /**\n   * Slot key → what you put in it. Every required slot needs pictures; an\n   * optional slot left out takes the chosen example's. 1–3 pictures per slot.\n   */\n  slots: Record<string, TrendRunSlot>\n  /** 1-based example whose pictures fill the optional slots you leave empty. Default 1. */\n  example?: number\n  /** Your own words, at most 1,000 characters. Mention a slot as `{slot:<key>}`. */\n  details?: string\n  /** `true` runs a 4-second preview (only when the trend's `previewSec` is `4`). */\n  preview?: boolean\n  /**\n   * One of the trend's {@link TrendDetail.resolutions}; default its first\n   * (`\"480p\"` on Seedance 2.5, `\"720p\"` on Kling 4). Another answers 400\n   * `resolution_unsupported`.\n   */\n  resolution?: TrendResolution\n  /**\n   * A draft run, only at 480p on a Seedance 2.5 trend. Default `true` at\n   * 480p. `true` on a Kling 4 trend answers 400 `draft_unsupported`.\n   */\n  draft?: boolean\n  /**\n   * A generation session of yours. Accepted (and checked: one you may not use\n   * is a 404), but not yet applied: trend runs are not filed into sessions yet.\n   */\n  sessionId?: string\n  /** Accepted, but not used by the run today. */\n  projectId?: string\n  /**\n   * A full run's own preview: the `jobId` of a completed preview run of this\n   * trend that you started. When the trend masks faces only as needed and that\n   * preview needed it, the full run masks them from the start (the quote\n   * includes it). Any other job is ignored, without an error. Must be a uuid\n   * (else 400 `validation_error`).\n   */\n  previewJobId?: string\n  /**\n   * `run()`: your client app's slug (e.g. `\"tools\"`: lowercase letters,\n   * digits and `-`, 1–40 characters, starting with a letter or digit), as on\n   * any job: the run's job carries it as `input_data.origin`, so\n   * `client.jobs.list({ origin })` finds it. Not a slug is a 400\n   * `validation_error`; without it the run has no origin. `estimate()`\n   * ignores it.\n   */\n  origin?: string\n}\n\n/** What a run would cost, in credits (`estimate()`). */\nexport interface TrendEstimate {\n  /** The charge the run is expected to come to. */\n  expectedCredits: number\n  /** What is reserved when the run starts; the run is charged what it actually costs. */\n  holdCredits: number\n  /**\n   * The parts of the quote, by name. With `maskingCredits`, `masking` is\n   * listed here too but is not part of `holdCredits` or `expectedCredits`.\n   */\n  breakdown: Record<string, number>\n  /**\n   * Only for a trend that masks faces only as needed: the extra credits\n   * charged if the video model refuses the clip and the run is retried with\n   * the faces masked. Not included in `expectedCredits` or `holdCredits`.\n   */\n  maskingCredits?: number\n}\n\n/** Per-call options for {@link TrendsResource.run}. */\nexport interface TrendRunOptions {\n  /**\n   * Sent as the `Idempotency-Key` header, unchanged (an empty string sends no\n   * header). The server takes 8–200 characters and answers 400 for any other\n   * length. Reuse it when retrying the same run.\n   */\n  idempotencyKey?: string\n}\n\n/** One slot of a past run, as it was run. Labels are English. */\nexport interface TrendRunDisplaySlot extends TrendChips {\n  key: string\n  label: string\n  kind: TrendSlotKind\n  images: string[]\n  /** `true` when the slot was left empty and the example's pictures filled it. */\n  fromExample: boolean\n}\n\n/**\n * One of your trend runs (`runs()`, `getRun()`). Stays readable after the\n * trend moves on or is unpublished.\n *\n * A Full Quality version of a draft is a run of its own, with its own status,\n * result and charge: `fullQualityOf` names the draft it was made from, and it\n * stays listed after that draft is deleted.\n */\nexport interface TrendRun {\n  jobId: string\n  status: string\n  progress: number | null\n  /**\n   * Why a failed or cancelled run did not finish; `null` otherwise. `code` is\n   * `safety-block` or `policy-block` when the job was blocked, `credits` when\n   * it ran out of credits partway (it was refunded: ask the person to top up,\n   * then run it again), else `cancelled` or `failed`. `message` is the same\n   * fixed sentence for every code — branch on `code`, not on the text.\n   */\n  error: { code?: string; message: string } | null\n  createdAt: string\n  completedAt: string | null\n  /** The trend and version it ran (name in English). */\n  trend: { id: string; slug: string; version: number; name: string }\n  /** The 1-based example used for empty optional slots. */\n  example: number\n  slots: TrendRunDisplaySlot[]\n  details?: string\n  preview: boolean\n  resolution: string\n  draft: boolean\n  /** The video engine the run was made on. Absent (an older server) = `\"seedance-2-5\"`. */\n  engine?: TrendEngine\n  /** The result, once completed. */\n  videoUrl: string | null\n  posterUrl: string | null\n  creditsCharged: number | null\n  /** A Full Quality version: the job id of the run (a draft, or a Kling 4 720p run) it was made from. `null` for any other run. */\n  fullQualityOf: string | null\n  /**\n   * A draft's (or Kling 4 720p run's) newest Full Quality try, if one was started: a pointer only,\n   * to know an upgrade exists and how it is going. Its video and charge are on\n   * that run, listed on its own (its `fullQualityOf` is this run's `jobId`) —\n   * read it there (`getRun(fullQuality.jobId)`). Older tries of the draft (a\n   * failed or cancelled one tried again) are not listed by `runs()`;\n   * `getRun()` still reads one by its id.\n   */\n  fullQuality: { jobId: string; status: string } | null\n  /**\n   * Until when a completed run can be redone in Full Quality — a Seedance 2.5\n   * draft (the same take at 1080p) or a Kling 4 run at 720p (a new take at\n   * 1080p); `null` otherwise.\n   */\n  fullQualityUntil: string | null\n}\n\nexport interface ListTrendsParams {\n  /** Search text. */\n  q?: string\n  tag?: string\n  /** `true` lists only your favorites. */\n  favorites?: boolean\n  /** A platform language for names and descriptions; default your profile's, then English. */\n  locale?: string\n  /** The previous page's `next`. */\n  cursor?: string\n  /** Page size, 1–60 (server default 30). */\n  limit?: number\n}\n\nexport interface ListTrendRunsParams {\n  /** Only runs of this trend (its slug). */\n  trend?: string\n  /** The previous page's `next`. */\n  cursor?: string\n  /** Page size, 1–60 (server default 30). */\n  limit?: number\n}\n\n/** A tag in use on the published catalog (`tags()`). */\nexport interface TrendTag {\n  /** The tag itself: pass it as `list({ tag })`. */\n  tag: string\n  /** The tag's label in the resolved locale; the tag itself when it has none. */\n  label: string\n  /** How many published trends carry it. */\n  count: number\n}\n\nexport interface TrendPage<T> {\n  data: T[]\n  /** Pass back as `cursor` for the next page; `null` on the last one. */\n  next: string | null\n}\n\nexport class TrendsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /** The published catalog in its curated order (`GET /v1/trends`), a page at a time. */\n  list(params: ListTrendsParams = {}): Promise<TrendPage<TrendCard>> {\n    const query: Record<string, string> = {}\n    if (params.q) query.q = params.q\n    if (params.tag) query.tag = params.tag\n    if (params.favorites) query.favorites = \"1\"\n    if (params.locale) query.locale = params.locale\n    if (params.cursor) query.cursor = params.cursor\n    if (params.limit !== undefined) query.limit = String(params.limit)\n    return this.client.request(\"GET\", \"/v1/trends\", { query })\n  }\n\n  /** A published trend's page (`GET /v1/trends/:slug`). */\n  async get(slug: string, params: { locale?: string } = {}): Promise<TrendDetail> {\n    const query: Record<string, string> = {}\n    if (params.locale) query.locale = params.locale\n    const res = await this.client.request<{ data: TrendDetail }>(\"GET\", trendPath(slug), { query })\n    return res.data\n  }\n\n  /** Quote a run before starting it (`POST /v1/trends/:slug/estimate`); spends nothing. */\n  async estimate(slug: string, request: TrendRunRequest): Promise<TrendEstimate> {\n    const res = await this.client.request<{ data: TrendEstimate }>(\n      \"POST\",\n      trendPath(slug, \"/estimate\"),\n      { body: request },\n    )\n    return res.data\n  }\n\n  /**\n   * Start a run (`POST /v1/trends/:slug/runs`, 202). Returns the job to follow.\n   * With `options.idempotencyKey` (sent as the `Idempotency-Key` header) a\n   * repeat with the same key answers with the first run's `jobId`.\n   */\n  async run(slug: string, request: TrendRunRequest, options?: TrendRunOptions): Promise<{ jobId: string }> {\n    const res = await this.client.request<{ data: { jobId: string } }>(\n      \"POST\",\n      trendPath(slug, \"/runs\"),\n      {\n        body: request,\n        ...(options?.idempotencyKey ? { headers: { \"Idempotency-Key\": options.idempotencyKey } } : {}),\n      },\n    )\n    return res.data\n  }\n\n  /**\n   * Your trend runs, newest first (`GET /v1/trends/runs`). A Full Quality\n   * version of a draft is listed as its own run (`fullQualityOf`).\n   */\n  runs(params: ListTrendRunsParams = {}): Promise<TrendPage<TrendRun>> {\n    const query: Record<string, string> = {}\n    if (params.trend) query.trend = params.trend\n    if (params.cursor) query.cursor = params.cursor\n    if (params.limit !== undefined) query.limit = String(params.limit)\n    return this.client.request(\"GET\", \"/v1/trends/runs\", { query })\n  }\n\n  /**\n   * One of your trend runs by its job id (`GET /v1/trends/runs/:jobId`), in\n   * the same shape as `runs()`. A job that is not your own trend run is a\n   * `NotFoundError`.\n   */\n  async getRun(jobId: string): Promise<TrendRun> {\n    const res = await this.client.request<{ data: TrendRun }>(\"GET\", `/v1/trends/runs/${encodeURIComponent(jobId)}`)\n    return res.data\n  }\n\n  /**\n   * The tags in use on the published catalog, each with its label in the\n   * resolved locale (`GET /v1/trends/tags`), most used first.\n   */\n  async tags(params: { locale?: string } = {}): Promise<TrendTag[]> {\n    const query: Record<string, string> = {}\n    if (params.locale) query.locale = params.locale\n    const res = await this.client.request<{ data: TrendTag[] }>(\"GET\", \"/v1/trends/tags\", { query })\n    return res.data\n  }\n\n  /** Add a trend to your favorites (`PUT /v1/trends/:slug/favorite`). */\n  async favorite(slug: string): Promise<void> {\n    await this.client.request<void>(\"PUT\", trendPath(slug, \"/favorite\"))\n  }\n\n  /** Remove a trend from your favorites (`DELETE /v1/trends/:slug/favorite`). */\n  async unfavorite(slug: string): Promise<void> {\n    await this.client.request<void>(\"DELETE\", trendPath(slug, \"/favorite\"))\n  }\n}\n"]}

package/dist/{chunk-JUON5NXA.js → chunk-RETNLKOC.js}

@@ -193,8 +193,19 @@ var WorkflowsResource = class {
   sharedWithMe() {
     return this.client.request("GET", "/v1/workflows/shared-with-me");
   }
+  /**
+   * Your MCP conversations of one month (`GET /v1/mcp-conversations`): each is a
+   * flow an assistant built from its steps, newest first. A conversation is a
+   * workflow, so open, rename, export or delete it with the other methods here.
+   */
+  listMcpConversations(params = {}) {
+    const query = {};
+    if (params.month) query.month = params.month;
+    if (params.sources?.length) query.sources = params.sources.join(",");
+    return this.client.request("GET", "/v1/mcp-conversations", { query });
+  }
 };
 
 export { WorkflowsResource };
-//# sourceMappingURL=chunk-JUON5NXA.js.map
-//# sourceMappingURL=chunk-JUON5NXA.js.map
+//# sourceMappingURL=chunk-RETNLKOC.js.map
+//# sourceMappingURL=chunk-RETNLKOC.js.map

package/dist/chunk-RETNLKOC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resources/workflows.ts"],"names":[],"mappings":";AAyQO,IAAM,gCAAN,MAAoC;AAAA,EACzC,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAA3B,MAAA;AAAA;AAAA,EAGpB,KAAK,UAAA,EAAuD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,cAAA;AAAA,KACjD;AAAA,EACF;AAAA;AAAA,EAGA,GAAA,CACE,YACA,KAAA,EAC+D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,cAAA,CAAA;AAAA,MAC/C,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CACE,UAAA,EACA,MAAA,EACA,KAAA,EAC+D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,OAAA;AAAA,MACA,iBAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,eAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAC,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CAAO,YAAoB,MAAA,EAA4C;AACrE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,QAAA;AAAA,MACA,iBAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,eAAA,EAAkB,kBAAA,CAAmB,MAAM,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AACF,CAAA;AA4CO,IAAM,oBAAN,MAAwB;AAAA,EAI7B,YAAoB,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAClB,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,6BAAA,CAA8B,MAAM,CAAA;AAAA,EAC/D;AAAA,EAFoB,MAAA;AAAA;AAAA,EAFX,aAAA;AAAA;AAAA,EAOT,KAAK,MAAA,EAA4D;AAC/D,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,aAAA,EAAgB,kBAAA,CAAmB,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA;AAAA,KACtD;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,EAAA,EAAyC;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,UAAU,EAAA,EAAyC;AACjD,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,wBAAwB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,KAAA,EAAyD;AAC9D,IAAA,MAAM,EAAE,SAAA,EAAW,GAAG,IAAA,EAAK,GAAI,KAAA;AAC/B,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,aAAA,EAAgB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAA;AAAA,MAC7C,EAAE,IAAA;AAAK,KACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAA,CAAO,IAAY,KAAA,EAAyD;AAC1E,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,OAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAA;AAAA,MACvC,EAAE,MAAM,KAAA;AAAM,KAChB;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,OAAO,EAAA,EAAwC;AAC7C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,QAAA,EAAU,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAA,CAAI,EAAA,EAAY,MAAA,GAA4B,IAAI,OAAA,EAA0D;AACxG,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,IAAA,CAAA;AAAA,MACvC;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,GAAI,OAAA,EAAS,cAAA,GAAiB,EAAE,OAAA,EAAS,EAAE,iBAAA,EAAmB,OAAA,CAAQ,cAAA,EAAe,EAAE,GAAI;AAAC;AAC9F,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,WAAA,CAAY,IAAY,MAAA,EAAuD;AAC7E,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,IAAA,CAAA,EAAQ;AAAA,MAChF,IAAA,EAAM;AAAA,QACJ,WAAA,EAAa,EAAE,YAAA,EAAc,MAAA,CAAO,YAAA,EAAa;AAAA,QACjD,yBAAyB,MAAA,CAAO;AAAA;AAClC,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAA,CAAoB,IAAY,MAAA,EAAgE;AAC9F,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,sBAAA,CAAA,EAA0B;AAAA,MAClG,MAAM,EAAE,YAAA,EAAc,OAAO,YAAA,EAAc,uBAAA,EAAyB,OAAO,uBAAA;AAAwB,KACpG,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CACE,YACA,IAAA,EACmC;AACnC,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,MACjB,KAAA;AAAA,MACA,CAAA,cAAA,EAAiB,kBAAA,CAAmB,UAAU,CAAC,CAAA,OAAA,CAAA;AAAA,MAC/C,EAAE,KAAA,EAAO,EAAE,QAAQ,IAAA,EAAM,MAAA,IAAU,OAAM;AAAE,KAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,KAAA,EAAiH;AACtH,IAAA,MAAM,EAAE,SAAA,EAAW,GAAG,YAAA,EAAa,GAAI,KAAA;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,sBAAA,EAAwB;AAAA,MACzD,IAAA,EAAM,EAAE,SAAA,EAAW,aAAA,EAAe,YAAA;AAAa,KAChD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAA,CAAc,IAAY,UAAA,EAA6D;AACrF,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,OAAA,EAAS,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAA,EAAI;AAAA,MAC7E,IAAA,EAAM,EAAE,UAAA;AAAW,KACpB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAA,CACE,IACA,MAAA,EAC0E;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,CAAQ,MAAA,EAAQ,iBAAiB,kBAAA,CAAmB,EAAE,CAAC,CAAA,KAAA,CAAA,EAAS;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAA,GAAoD;AAClD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,8BAA8B,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAA,CAAqB,MAAA,GAAqC,EAAC,EAAiC;AAC1F,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,KAAA,CAAM,KAAA,GAAQ,MAAA,CAAO,KAAA;AACvC,IAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ,KAAA,CAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AACnE,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,uBAAA,EAAyB,EAAE,OAAO,CAAA;AAAA,EACtE;AACF","file":"chunk-RETNLKOC.js","sourcesContent":["import type { NodaroClientCore } from \"../core.js\"\nimport type {\n  GenericNode,\n  GenericEdge,\n} from \"@nodaro/shared/types\"\nimport type {\n  WorkflowExport,\n  WorkflowImportReport,\n} from \"@nodaro/shared/workflow\"\nimport type {\n  WorkflowVisibility,\n  CollaboratorRole,\n} from \"@nodaro/shared/organizations\"\n\n/**\n * Workflow metadata + (when fetched as a single record) full nodes/edges/settings.\n *\n * The list endpoint returns metadata only; `get`, `create`, and `update` return the\n * full record. `nodes`, `edges`, `settings`, and `sourcePrompt` are present only on\n * full records and omitted in list responses.\n */\nexport interface Workflow {\n  id: string\n  projectId: string | null\n  userId: string\n  name: string\n  description?: string | null\n  folderId?: string | null\n  isTemplate?: boolean\n  version?: number\n  thumbnailUrl?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string | null\n  createdAt: string\n  updatedAt: string\n}\n\nexport interface ListWorkflowsParams {\n  /** Required — list endpoint is `/v1/projects/:projectId/workflows`. */\n  projectId: string\n}\n\nexport interface CreateWorkflowInput {\n  /** Required — workflow is created under this project. */\n  projectId: string\n  name: string\n  description?: string\n  folderId?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string\n}\n\nexport interface UpdateWorkflowInput {\n  name?: string\n  description?: string\n  folderId?: string | null\n  nodes?: GenericNode[]\n  edges?: GenericEdge[]\n  settings?: Record<string, unknown>\n  sourcePrompt?: string\n  thumbnailUrl?: string | null\n  /**\n   * Optimistic concurrency: the `updatedAt` your copy of the workflow was\n   * loaded with. When the row has since been written by another tab/device,\n   * the update is rejected with HTTP 409 `workflow_conflict`\n   * (`WorkflowConflictError`) carrying the current record — re-read/merge and\n   * retry instead of last-writer-wins clobbering the other writer's changes.\n   * Omit for the legacy unconditional replace.\n   */\n  expectedUpdatedAt?: string\n  /**\n   * Optimistic concurrency by monotonic version — preferred over\n   * `expectedUpdatedAt` (integer bumped by the DB on every content change).\n   */\n  expectedVersion?: number\n}\n\nexport interface RunWorkflowParams {\n  /**\n   * Optional subset of node IDs to execute. Omit to run the full workflow.\n   * With `continueMode: \"from-failed\"`, the nodes to consider (default: the\n   * nodes the run's chain was first started on, plus every node left failed or\n   * held back; see `continueMode`); the run executes only those the failed run\n   * did not complete. Every id sent counts as named: a node of work no run of\n   * the chain ever ran (each only handed on its saved results) runs and is\n   * priced, while a source, trigger, parameter picker or container keeps what\n   * the run handed on and a node set to skip never runs.\n   */\n  nodeIds?: string[]\n  /**\n   * Per-node field overrides for this run only, `{ [nodeId]: { field: value } }`,\n   * shallow-merged over each node's saved data (the node's saved results are\n   * not used). A run through the API has nobody to review a Preview render, so\n   * a workflow whose Apply EDL render is set to Preview is refused\n   * (`preview_review_required`) unless the run sets it to Final:\n   * `{ [renderNodeId]: { quality: \"final\" } }`. A node with Review before\n   * render on (Tighten Episode, Trailer) is refused the same way (turn its\n   * review off). A failed execution records what held it —\n   * `preview_review_required` / `preview_render_nested` (a render),\n   * `…_review_on` (a review-on node) or `…_mixed` (both); match all six with\n   * `isPreviewRefusalCode` from `@nodaro/shared`. A review-on Tighten Episode\n   * fed by a List is refused with `use_case_review_list_driven`; a Trailer fed\n   * by a List, with `use_case_list_driven`.\n   */\n  inputOverrides?: Record<string, Record<string, unknown>>\n  /**\n   * Continue from an earlier execution of this workflow — Render final after a\n   * run that stopped at its preview, or (with `continueMode: \"from-failed\"`) a\n   * failed run from where it stopped. The run executes `nodeIds` only\n   * (required with this field, except with `continueMode`); every other node\n   * hands on what that execution produced, not the workflow's saved results,\n   * and an Edit Plan hands on its plan with the person's review applied. The\n   * execution must be your own `completed` run of this workflow (`failed`,\n   * with `continueMode`), not of a published app version. Refused with\n   * `continuation_subset_required`, `continuation_not_found` (404),\n   * `continuation_workflow_mismatch`, `continuation_version_mismatch` or\n   * `continuation_not_completed` (409). A continuation its payer cannot cover\n   * (with or without `continueMode`, priced on the nodes it runs) throws\n   * `InsufficientCreditsError` before any execution exists, checked as a\n   * {@link WorkflowsResource.renderFinal} is.\n   */\n  continueFromExecutionId?: string\n  /**\n   * `\"from-failed\"`: continue a FAILED run (`continueFromExecutionId`) from\n   * where it stopped. It runs every node that run did not complete — of\n   * `nodeIds`, which default to the nodes the run was started on (a run\n   * started on named nodes is continued on those, a run of every node on every\n   * node; a continuation of a continuation keeps those of the first run of its\n   * chain) plus every node the run left failed or held back — and hands on\n   * what it completed,\n   * never run or charged again. That is per node: a node that failed runs\n   * again in full, every list item included. When a later continuation of it\n   * completed only part of what it left (a narrower `nodeIds`), the run builds\n   * on the newest such one: it is seeded from that run and runs only what is\n   * still left ({@link RunWorkflowResult.continuedFrom} names it). A node\n   * `nodeIds` names that no run of the chain ever ran runs too, and is priced\n   * (see `nodeIds`). A Render\n   * final, or a run of named nodes, continuing the newest of those counts as\n   * one of them too. Not combinable with {@link renderFinal}. Refused with\n   * `continuation_not_failed` (409) for a run that did not fail,\n   * `continuation_superseded` (409) when a later continuation supersedes it —\n   * the message names that run: one that failed (continue that one instead),\n   * or one that completed all this run left (the work is done, and its results\n   * are on that run) — `continuation_preview_pending` (409, a\n   * `ContinuationPreviewPendingError`) when the newest later continuation\n   * stopped at a Preview review of a render or of a Tighten Episode (the error\n   * names that run, what holds it, and in `next` the run that finishes it:\n   * `client.workflows.run(workflowId, error.next)` first — for a single render,\n   * its {@link renderFinal}), and\n   * `continuation_subset_required` (409) when nothing is left to run. Send an\n   * {@link RunWorkflowOptions.idempotencyKey} with each continuation.\n   */\n  continueMode?: \"from-failed\"\n}\n\n/** Per-call options for {@link WorkflowsResource.run}. */\nexport interface RunWorkflowOptions {\n  /**\n   * Sent as the `Idempotency-Key` header (at least 8 characters; the server\n   * ignores a shorter one). Reuse the same value when retrying the same\n   * request: the server answers the run it already started (`deduped: true`)\n   * instead of starting a second one — or, once that run is under way or has\n   * superseded the one it continued, refuses with `already_running` (an\n   * `AlreadyRunningError` carrying its `executionId`) or\n   * `continuation_superseded` naming it. Either way nothing runs twice.\n   */\n  idempotencyKey?: string\n}\n\nexport interface RunWorkflowResult {\n  executionId: string\n  status: \"pending\" | \"running\"\n  /** `true` when an `idempotencyKey` retry found the run already started: `executionId` is that run. */\n  deduped?: boolean\n  /**\n   * With `continueMode: \"from-failed\"`: the execution the run continued from —\n   * its states seed the run. The run asked for (`continueFromExecutionId`), or\n   * the newest later continuation of it that completed part of what it left.\n   * Absent on any other run, and on a `deduped` answer.\n   */\n  continuedFrom?: string\n}\n\n/**\n * A Render final: the Apply EDL render at Final for this run only, and every\n * node after it (Camera Switch first, in multicam). The server works out which\n * nodes run — the same rule as the editor's Render final button.\n */\nexport interface RenderFinalParams {\n  /** The Apply EDL render node to finalize. */\n  renderNodeId: string\n  /**\n   * The execution that stopped at the preview: your own `completed` run of\n   * this workflow. Every node the Render final does not run hands on what it\n   * produced (an Edit Plan hands on its plan with the review applied).\n   */\n  continueFromExecutionId: string\n}\n\n/** What a Render final will run and charge. Nothing is created by the quote. */\nexport interface RenderFinalQuote {\n  renderNodeId: string\n  /** The nodes the run executes, in canvas order. */\n  nodeIds: string[]\n  /** The one-shot override it runs with: `{ [renderNodeId]: { quality: \"final\" } }`. */\n  inputOverrides: Record<string, Record<string, unknown>>\n  /** Estimated credits; `null` in an edition without credits. */\n  estimatedCredits: number | null\n  /**\n   * Present (`true`) when `estimatedCredits` includes an LLM node's estimate:\n   * an LLM call is charged its actual usage after it runs, so show `~N`.\n   * Absent for a fixed price.\n   */\n  estimatedCreditsIsEstimate?: true\n  /**\n   * Whether the payer can cover `estimatedCredits`; `null` in an edition\n   * without credits. When `false`, {@link WorkflowsResource.renderFinal} is\n   * refused with `InsufficientCreditsError` before any execution exists.\n   */\n  sufficient: boolean | null\n  /**\n   * The payer's spendable credits; `null` when it is not yours to see (a\n   * deployment's operator pays) or a workspace budget pays.\n   */\n  available: number | null\n}\n\n/** A person granted access to a workflow. Email is never returned (privacy). */\nexport interface Collaborator {\n  userId: string\n  name?: string | null\n  avatar?: string | null\n  role: CollaboratorRole\n}\n\nexport interface AddCollaboratorInput {\n  /** Provide exactly one of `userId` or `email`. */\n  userId?: string\n  email?: string\n  role: CollaboratorRole\n}\n\n/** A workflow someone else shared with you, plus the role you hold on it. */\nexport interface SharedWorkflow extends Workflow {\n  grantedRole: CollaboratorRole\n}\n\n/** A grant dropped because a move took the workflow out of the workspace the\n *  access came from. */\nexport interface DroppedCollaborator {\n  userId: string\n  name: string | null\n}\n\n/**\n * The people a workflow is shared with — reached as `client.workflows.collaborators`.\n * All four endpoints are served by the organizations feature and exist only when\n * it is enabled server-side; against an install without it they 404\n * (→ `NotFoundError`). The active workspace travels on the request like every\n * other call, so a workspace admin's grants apply automatically.\n */\nexport class WorkflowCollaboratorsResource {\n  constructor(private client: NodaroClientCore) {}\n\n  /** List a workflow's collaborators (id, name, avatar, role — never email). */\n  list(workflowId: string): Promise<{ data: Collaborator[] }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`,\n    )\n  }\n\n  /** Add a collaborator by `userId` OR `email` (exactly one), at the given role. */\n  add(\n    workflowId: string,\n    input: AddCollaboratorInput,\n  ): Promise<{ data: { userId: string; role: CollaboratorRole } }> {\n    return this.client.request(\n      \"POST\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators`,\n      { body: input },\n    )\n  }\n\n  /** Change a collaborator's role. */\n  update(\n    workflowId: string,\n    userId: string,\n    input: { role: CollaboratorRole },\n  ): Promise<{ data: { userId: string; role: CollaboratorRole } }> {\n    return this.client.request(\n      \"PATCH\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`,\n      { body: input },\n    )\n  }\n\n  /** Remove a collaborator — or yourself. Returns `{ success: true }`. */\n  remove(workflowId: string, userId: string): Promise<{ success: true }> {\n    return this.client.request(\n      \"DELETE\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/collaborators/${encodeURIComponent(userId)}`,\n    )\n  }\n}\n\n/** One MCP conversation: a flow its assistant built step by step (`GET /v1/mcp-conversations`). */\nexport interface McpConversation {\n  /** The conversation's workflow id — open it with {@link WorkflowsResource.get}. */\n  id: string\n  projectId: string\n  name: string\n  /** The source: \"claude\", \"claude-code\", \"chatgpt\", or another client's name in lower case. */\n  client: string\n  clientLabel: string\n  /** The connection's own name, as the connector was named. */\n  clientName: string\n  startedAt: string\n  lastActivityAt: string\n  /** Still receiving steps: its last step is less than 30 minutes old. */\n  live: boolean\n  /** The user's first request, when the assistant passed it. */\n  firstRequest: string | null\n  nodeCount: number\n  counts: { image: number; video: number; audio: number }\n  /** Credits charged for its jobs; null where credits are not billed. */\n  credits: number | null\n  cover: { url: string; kind: \"image\" | \"video\"; setByUser: boolean } | null\n  updatedAt: string\n}\n\nexport interface ListMcpConversationsParams {\n  /** \"YYYY-MM\". Default: the latest month that has conversations. */\n  month?: string\n  /** Keep only these sources (\"claude\", \"claude-code\", \"chatgpt\", …). */\n  sources?: readonly string[]\n}\n\nexport interface McpConversationList {\n  /** The month listed. */\n  month: string\n  /** Every month that has conversations, newest first, with its count. */\n  months: Array<{ month: string; conversations: number }>\n  /** The month's sources, with the connection names each one folds in. */\n  sources: Array<{ client: string; label: string; conversations: number; connections: Array<{ clientName: string; conversations: number }> }>\n  data: McpConversation[]\n}\n\nexport class WorkflowsResource {\n  /** The people this workflow is shared with. See {@link WorkflowCollaboratorsResource}. */\n  readonly collaborators: WorkflowCollaboratorsResource\n\n  constructor(private client: NodaroClientCore) {\n    this.collaborators = new WorkflowCollaboratorsResource(client)\n  }\n\n  /** List workflows for a project. Returns metadata only — `nodes`/`edges` are not included. */\n  list(params: ListWorkflowsParams): Promise<{ data: Workflow[] }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/projects/${encodeURIComponent(params.projectId)}/workflows`,\n    )\n  }\n\n  /** Get a workflow including its full nodes/edges/settings. */\n  get(id: string): Promise<{ data: Workflow }> {\n    return this.client.request(\"GET\", `/v1/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Get a PUBLICLY-SHARED workflow by id (`GET /v1/public/workflows/:id`) — the\n   * unauthenticated share-by-link read. Returns the workflow's nodes/edges/\n   * settings ONLY when it's opted into sharing server-side (`settings.studio.shared\n   * === true`); otherwise the route 404s (→ `NotFoundError`). No auth required —\n   * a share viewer has no session; the SDK omits the bearer when no token exists.\n   */\n  getPublic(id: string): Promise<{ data: Workflow }> {\n    return this.client.request(\"GET\", `/v1/public/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Create a workflow under a project. Returns the full record.\n   * NOTE: server route is `POST /v1/projects/:projectId/workflows`.\n   */\n  create(input: CreateWorkflowInput): Promise<{ data: Workflow }> {\n    const { projectId, ...body } = input\n    return this.client.request(\n      \"POST\",\n      `/v1/projects/${encodeURIComponent(projectId)}/workflows`,\n      { body },\n    )\n  }\n\n  /** Patch a workflow. Returns the full updated record. */\n  update(id: string, input: UpdateWorkflowInput): Promise<{ data: Workflow }> {\n    return this.client.request(\n      \"PATCH\",\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      { body: input },\n    )\n  }\n\n  /** Delete a workflow. Returns `{ success: true }`. Throws `NotFoundError`\n   *  when the id doesn't exist or isn't yours (the delete is not silent). */\n  delete(id: string): Promise<{ success: true }> {\n    return this.client.request(\"DELETE\", `/v1/workflows/${encodeURIComponent(id)}`)\n  }\n\n  /**\n   * Run a workflow. Returns the executionId for polling via\n   * `client.executions.get(executionId)`.\n   */\n  run(id: string, params: RunWorkflowParams = {}, options?: RunWorkflowOptions): Promise<RunWorkflowResult> {\n    return this.client.request(\n      \"POST\",\n      `/v1/workflows/${encodeURIComponent(id)}/run`,\n      {\n        body: params,\n        ...(options?.idempotencyKey ? { headers: { \"Idempotency-Key\": options.idempotencyKey } } : {}),\n      },\n    )\n  }\n\n  /**\n   * Render final (`renderFinal` on `POST /v1/workflows/:id/run`): run the\n   * render at Final for this run only, and every node after it, continuing the\n   * execution that stopped at its preview. The server derives the nodes and\n   * the override — send nothing else. Quote it first with\n   * {@link estimateRenderFinal}. Refused with `render_final_node_not_found`,\n   * `render_final_not_a_render`, or a continuation code (see `run`); a run\n   * its payer cannot cover throws `InsufficientCreditsError` (with `required`\n   * and, when it is yours to see, `available`) before any execution exists.\n   */\n  renderFinal(id: string, params: RenderFinalParams): Promise<RunWorkflowResult> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/run`, {\n      body: {\n        renderFinal: { renderNodeId: params.renderNodeId },\n        continueFromExecutionId: params.continueFromExecutionId,\n      },\n    })\n  }\n\n  /**\n   * Quote a Render final (`POST /v1/workflows/:id/render-final/estimate`): the\n   * nodes it will run, the override it runs with and its estimated credits.\n   * Nothing is created or charged.\n   */\n  estimateRenderFinal(id: string, params: RenderFinalParams): Promise<{ data: RenderFinalQuote }> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/render-final/estimate`, {\n      body: { renderNodeId: params.renderNodeId, continueFromExecutionId: params.continueFromExecutionId },\n    })\n  }\n\n  /**\n   * Export a workflow as a portable JSON bundle.\n   * Pass `opts.assets = true` to include character/object/location entity data.\n   */\n  export(\n    workflowId: string,\n    opts?: { assets?: boolean },\n  ): Promise<{ data: WorkflowExport }> {\n    return this.client.request(\n      \"GET\",\n      `/v1/workflows/${encodeURIComponent(workflowId)}/export`,\n      { query: { assets: opts?.assets ?? false } },\n    )\n  }\n\n  /**\n   * Import a `WorkflowExport` bundle into the specified project.\n   * Re-creates any bundled assets (characters, objects, creatures, locations)\n   * under your account, and re-points BOTH the entity nodes and every `@`-chip\n   * (`ConnectedReference`) bound in the graph at the rows it created.\n   * Media the bundle references on other hosts is copied onto this instance's\n   * storage where reachable; a bundled entity's images are copied whoever\n   * hosts them, because they are the exporter's bytes and their lifecycle is\n   * not yours. `importReport` says what was copied, what could not be reached\n   * and what was skipped (and why); `assetIdMap` maps each bundled entity id\n   * to the row created for it (for chips you hold outside the graph), and\n   * `assetsSkipped` names the entities your storage quota left uncreated —\n   * the workflow itself still lands.\n   */\n  import(input: WorkflowExport & { projectId: string }): Promise<{ data: Workflow; importReport?: WorkflowImportReport }> {\n    const { projectId, ...workflowJson } = input\n    return this.client.request(\"POST\", \"/v1/workflows/import\", {\n      body: { projectId, workflow_json: workflowJson },\n    })\n  }\n\n  /**\n   * Set a workflow's visibility — `\"private\"` (creator + explicit collaborators)\n   * or `\"workspace\"` (everyone in its workspace). Only the creator or a workspace\n   * admin may change it; anyone else gets HTTP 403. Thin wrapper over `update()`:\n   * the visibility lever lives on `PATCH /v1/workflows/:id`.\n   */\n  setVisibility(id: string, visibility: WorkflowVisibility): Promise<{ data: Workflow }> {\n    return this.client.request(\"PATCH\", `/v1/workflows/${encodeURIComponent(id)}`, {\n      body: { visibility },\n    })\n  }\n\n  /**\n   * Move a workflow to another project (`POST /v1/workflows/:id/move`); its folder\n   * is cleared. When the move takes the workflow out of a workspace, collaborator\n   * grants that came from that workspace are dropped and returned as\n   * `droppedCollaborators`.\n   */\n  move(\n    id: string,\n    params: { projectId: string },\n  ): Promise<{ data: Workflow; droppedCollaborators: DroppedCollaborator[] }> {\n    return this.client.request(\"POST\", `/v1/workflows/${encodeURIComponent(id)}/move`, {\n      body: params,\n    })\n  }\n\n  /**\n   * Workflows other people shared with you (`GET /v1/workflows/shared-with-me`) —\n   * grants on work that is NOT in a workspace you belong to (workspace work already\n   * shows in that workspace's own lists). Each carries the `grantedRole` you hold.\n   * Empty when the organizations feature is off server-side.\n   */\n  sharedWithMe(): Promise<{ data: SharedWorkflow[] }> {\n    return this.client.request(\"GET\", \"/v1/workflows/shared-with-me\")\n  }\n\n  /**\n   * Your MCP conversations of one month (`GET /v1/mcp-conversations`): each is a\n   * flow an assistant built from its steps, newest first. A conversation is a\n   * workflow, so open, rename, export or delete it with the other methods here.\n   */\n  listMcpConversations(params: ListMcpConversationsParams = {}): Promise<McpConversationList> {\n    const query: Record<string, string> = {}\n    if (params.month) query.month = params.month\n    if (params.sources?.length) query.sources = params.sources.join(\",\")\n    return this.client.request(\"GET\", \"/v1/mcp-conversations\", { query })\n  }\n}\n"]}

package/dist/{chunk-VHSMOBU7.cjs → chunk-VYEGCEZ3.cjs}

@@ -195,8 +195,19 @@ var WorkflowsResource = class {
   sharedWithMe() {
     return this.client.request("GET", "/v1/workflows/shared-with-me");
   }
+  /**
+   * Your MCP conversations of one month (`GET /v1/mcp-conversations`): each is a
+   * flow an assistant built from its steps, newest first. A conversation is a
+   * workflow, so open, rename, export or delete it with the other methods here.
+   */
+  listMcpConversations(params = {}) {
+    const query = {};
+    if (params.month) query.month = params.month;
+    if (params.sources?.length) query.sources = params.sources.join(",");
+    return this.client.request("GET", "/v1/mcp-conversations", { query });
+  }
 };
 
 exports.WorkflowsResource = WorkflowsResource;
-//# sourceMappingURL=chunk-VHSMOBU7.cjs.map
-//# sourceMappingURL=chunk-VHSMOBU7.cjs.map
+//# sourceMappingURL=chunk-VYEGCEZ3.cjs.map
+//# sourceMappingURL=chunk-VYEGCEZ3.cjs.map