@nodaro/sdk 2.44.0 → 2.46.0

package/dist/{chunk-MPQQC45L.cjs.map → chunk-ZJCHIJND.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":["WORKSPACE_HEADER","throwFromResponse"],"mappings":";;;;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAACA,8BAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAAC,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-MPQQC45L.cjs","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../src/binary-response.ts","../src/core.ts","../src/auth.ts"],"names":["WORKSPACE_HEADER","throwFromResponse"],"mappings":";;;;;;AACA,eAAsB,kBAAA,CAAmB,UAAoB,QAAA,EAAwC;AACnG,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AACxD,EAAA,IAAI,UAAA,KAAe,IAAA,KAAS,CAAC,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAAK,MAAA,CAAO,UAAU,CAAA,GAAI,QAAA,CAAA,EAAW;AACvF,IAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,IAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,IAAI,YAAY,CAAC,CAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,MAAA,IAAI,KAAK,IAAA,EAAM;AACf,MAAA,MAAA,IAAU,KAAK,KAAA,CAAM,UAAA;AACrB,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,CAAA,SAAE;AAAU,IAAA,MAAA,CAAO,WAAA,EAAY;AAAA,EAAE;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAAE,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AAAG,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAAW;AACnF,EAAA,OAAO,KAAA,CAAM,MAAA;AACf;ACAA,IAAM,WAAA,GAAoD,QAAA,CAAkB;AAUrE,IAAM,aAAA,GAAgB,iBAAA;AAoB7B,IAAM,YAAY,MAAe,OAAO,WAAW,WAAA,IAAe,OAAO,OAAO,QAAA,KAAa,WAAA;AA0FtF,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEQ,gBAAA;AAAA,EACA,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,IAAI,KAAA,GAAsB;AACxB,IAAA,OAAO,IAAA,CAAK,aAAA,IAAiB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGS,WAAA;AAAA,EAET,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC7C,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,KAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,CAAA,IAAA,EAAO,WAAW,CAAA,CAAA;AACzD,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAGxB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,WAAA,KAAgB,MAAA,IAAa,CAAC,SAAA,EAAU;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,IAAA,CACZ,MAAA,EACA,IAAA,EACA,SACA,IAAA,EACY;AACZ,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,QAAQ,KAAK,CAAA;AAE7C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAS;AAKvC,IAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,IAAe,QAAQ,IAAA,YAAgB,QAAA;AAC7D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAI,UAAA,GAAa,EAAC,GAAI,EAAE,gBAAgB,kBAAA,EAAmB;AAAA,MAC3D,GAAI,IAAA,CAAK,gBAAA,GAAmB,EAAE,CAAC,aAAa,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA;AAAA;AAAA,MAGrE,GAAI,IAAA,CAAK,WAAA,GAAc,EAAE,CAACA,8BAAgB,GAAG,IAAA,CAAK,WAAA,EAAY,GAAI,EAAC;AAAA,MACnE,GAAI,OAAA,CAAQ,OAAA,IAAW;AAAC,KAC1B;AACA,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,eAAe,CAAA,GAAI,UAAU,KAAK,CAAA,CAAA;AAErD,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,IAAA,MAAM,YAAY,UAAA,CAAW,MAAM,GAAG,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAC7D,IAAA,MAAM,QAAQ,MAAM,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACnD,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM;AAEnC,IAAA,IAAI;AACF,MAAA,EAAA,CAAG,OAAO,cAAA,EAAe;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EACE,OAAA,CAAQ,IAAA,KAAS,KAAA,CAAA,GACb,KAAA,CAAA,GACA,UAAA,GACG,OAAA,CAAQ,IAAA,GACT,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACnC,QAAQ,EAAA,CAAG;AAAA,OACZ,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAI,UAAmC,EAAC;AACxC,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,MAAM,IAAI,IAAA,EAAK;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAAC,mCAAA,CAAkB,GAAA,CAAI,QAAQ,OAAO,CAAA;AAAA,MACvC;AAEA,MAAA,OAAO,MAAM,KAAK,GAAG,CAAA;AAAA,IACvB,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,SAAS,CAAA;AACtB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAsE;AACrH,IAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,qCAAqC,CAAA;AAC1H,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,QAAA,KAAa,kBAAA,CAAmB,QAAA,EAAU,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EACtG;AAAA,EAEA,MAAM,OAAA,CAAW,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAe;AACvF,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,MAAK,MAAA;AAAA,MAAQ,IAAA;AAAA,MAAM,OAAA;AAAA,MAAS,OAAO,GAAA;AAAA;AAAA,QAE7C,IAAI,MAAA,KAAW,GAAA,GAAO,MAAA,GAAoB,MAAM,IAAI,IAAA;AAAK;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAoB;AAC7F,IAAA,OAAO,IAAA,CAAK,KAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,CAAC,GAAA,KAAQ,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,EAAA,GAA8C;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkD,OAAO,QAAQ,CAAA;AACxF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aAAA,GAAyC;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAkC,OAAO,uBAAuB,CAAA;AACvF,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAmB,eAAA,EAAwC;AAC/D,IAAA,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAQ,yBAAyB,kBAAA,CAAmB,eAAe,CAAC,CAAA,OAAA,CAAS,CAAA;AAAA,EAClG;AAAA,EAEQ,QAAA,CAAS,MAAc,KAAA,EAAuE;AACpG,IAAA,MAAM,IAAA,GAAO,KAAK,OAAA,KAAY,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,MAAA,GAAS,oBAAA,CAAA;AACvF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAE9B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,GAAU,GAAA,CAAI,UAAS,GAAI,GAAA,CAAI,WAAW,GAAA,CAAI,MAAA;AACnE,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,IAAI,IAAI,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA,GAAU,SAAS,IAAI,CAAA;AACxD,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,IAAI,CAAA,KAAM,QAAW,CAAA,CAAE,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,MACtD;AACA,MAAA,OAAO,KAAK,OAAA,GAAU,CAAA,CAAE,UAAS,GAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA;AAAA,IACtD;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;ACjUO,IAAM,kBAAN,MAAsC;AAAA,EAC3C,YAAoB,KAAA,EAAe;AAAf,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgB;AAAA,EAAhB,KAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAN,MAAmC;AAAA,EACxC,YAAoB,EAAA,EAAkD;AAAlD,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAmD;AAAA,EAAnD,EAAA;AAAA,EACpB,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,EAAA,EAAG;AAAA,EACjB;AACF;AASO,SAAS,aAAa,QAAA,EAAoC;AAC/D,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW;AACf,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,QAAA,CAAS,KAAK,UAAA,EAAW;AAChD,MAAA,OAAO,IAAA,CAAK,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC;AAAA,GACF;AACF","file":"chunk-ZJCHIJND.cjs","sourcesContent":["/** Bound decoded response bytes even when Content-Length is absent or compressed. */\nexport async function readBinaryResponse(response: Response, maxBytes: number): Promise<ArrayBuffer> {\n  const advertised = response.headers.get(\"content-length\")\n  if (advertised !== null && (!/^\\d+$/.test(advertised) || Number(advertised) > maxBytes)) {\n    await response.body?.cancel()\n    throw new Error(\"Binary response exceeds its declared size limit\")\n  }\n  if (!response.body) return new ArrayBuffer(0)\n  const reader = response.body.getReader()\n  const chunks: Uint8Array[] = []\n  let length = 0\n  try {\n    while (true) {\n      const next = await reader.read()\n      if (next.done) break\n      length += next.value.byteLength\n      if (length > maxBytes) {\n        await reader.cancel()\n        throw new Error(\"Binary response exceeds its declared size limit\")\n      }\n      chunks.push(next.value)\n    }\n  } finally { reader.releaseLock() }\n  const bytes = new Uint8Array(length)\n  let offset = 0\n  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength }\n  return bytes.buffer\n}\n","/**\n * The client core: configuration, auth, the request transport and the\n * account-identity calls — everything a resource needs, and none of the\n * resources themselves.\n *\n * {@link NodaroClient} (`createClient`) extends it with every resource. An app\n * that uses only a few resources can extend it with just those, so it loads\n * (and its tests depend on) only the resource modules it actually uses:\n *\n *   class AppClient extends NodaroClientCore {\n *     readonly jobs = new JobsResource(this)\n *     readonly nodes = new NodesResource(this) // needs `jobs` on the same client\n *   }\n *\n * A resource that calls another one through the client says so in its\n * constructor type (`NodesResource` takes a core that also has `jobs`), so a\n * client missing it fails to compile rather than at run time.\n */\nimport { readBinaryResponse } from \"./binary-response.js\"\nimport { throwFromResponse } from \"./errors.js\"\nimport type { Auth } from \"./auth.js\"\nimport type { DeveloperAppKind, DeveloperAppScope } from \"./resources/developer-apps.js\"\nimport { WORKSPACE_HEADER, type MeOrganizations } from \"@nodaro/shared/organizations\"\n\n/** Replaced at build time by tsup `define` from package.json. The fallback\n *  keeps `tsx`/vitest runs of the source working, where no define applies. */\ndeclare const __SDK_VERSION__: string | undefined\nconst SDK_VERSION = typeof __SDK_VERSION__ === \"string\" ? __SDK_VERSION__ : \"0.0.0-dev\"\n\n/**\n * Identifies the calling package to the backend, which records it as the job's\n * provenance (`jobs.source` / `source_detail`) so an operator can tell a CLI\n * run from an SDK integration from a browser session.\n *\n * Only `sdk/…` and `cli/…` are honoured server-side; anything else is ignored\n * rather than trusted, since this is an unauthenticated header.\n */\nexport const CLIENT_HEADER = \"X-Nodaro-Client\"\n\n/**\n * In a browser the header is redundant AND a liability, so it is not sent.\n *\n * Redundant: the browser already sends `Origin`, which names the actual product\n * (`studio.nodaro.ai`) rather than merely the library it used — and the backend\n * deliberately prefers Origin over this header, so a browser-sent value is\n * discarded on arrival.\n *\n * A liability: `X-Nodaro-Client` is not a CORS-safelisted request header, so a\n * browser sending it requires an exact match in the server's\n * `Access-Control-Allow-Headers`. Any deployment whose backend predates that\n * allowlist entry would fail the PREFLIGHT — breaking every API call from the\n * app, not just its provenance. Self-hosted and lagging deployments make that a\n * real risk, and nothing in a browser app would reveal the cause.\n *\n * An EXPLICIT `clientLabel` is always sent regardless: a caller that names\n * itself has opted in deliberately, and that intent outranks this default.\n */\nconst isBrowser = (): boolean => typeof window !== \"undefined\" && typeof window.document !== \"undefined\"\n\nexport interface ClientOptions {\n  /** Backend base URL, e.g. \"https://nodaro.example.com\" or empty string for same-origin. */\n  baseUrl: string\n  /** Auth provider. Use StaticTokenAuth, supabaseAuth, or CallbackAuth. */\n  auth: Auth\n  /** Optional fetch override (for tests or custom transports). */\n  fetch?: typeof fetch\n  /** Default request timeout in ms. Default 60s. */\n  timeoutMs?: number\n  /**\n   * Overrides the `X-Nodaro-Client` label. Defaults to `sdk/<version>`.\n   *\n   * Exists for `@nodaro/cli`, which is a wrapper AROUND this SDK: without an\n   * override every CLI invocation would be recorded as an SDK call and the two\n   * surfaces could never be told apart.\n   */\n  clientLabel?: string\n  /**\n   * The workspace every request acts in — sent as `X-Nodaro-Workspace`.\n   *\n   * It selects which workspace a LIST reads from and where a CREATE lands.\n   * It never authorizes: reading, updating, deleting or running an\n   * identified object is decided by that object's own workspace, so a\n   * forgotten header cannot hide work and a forged one cannot reach anyone\n   * else's. Omit it to work in the caller's personal space.\n   *\n   * Prefer {@link NodaroClient.withWorkspace} for anything short-lived — one\n   * client per workspace, no shared mutable selection to get wrong.\n   */\n  workspaceId?: string\n}\n\ninterface RequestOptions {\n  body?: unknown\n  query?: Record<string, string | number | boolean | undefined>\n  headers?: Record<string, string>\n  signal?: AbortSignal\n}\n\n/**\n * The authenticated user's canonical identity (`GET /v1/me`). A token-\n * introspection primitive: any valid bearer token (first-party Supabase JWT or\n * a developer-app OAuth token) resolves to its owner's identity. Mirrors the\n * `profiles` identity columns server-side — the route is the source of truth.\n */\nexport interface UserIdentity {\n  /** Nodaro user id (= the Supabase auth user id). */\n  readonly id: string\n  readonly email: string\n  /** Human-readable display name (from `profiles.full_name`); `null` if unset. */\n  readonly displayName: string | null\n  /** Avatar URL; `null` if unset. */\n  readonly avatarUrl: string | null\n  /** Subscription tier (e.g. \"free\", \"pro\"). */\n  readonly tier: string\n  /**\n   * Whether the user holds an admin role. DESCRIPTIVE only — use it to decide\n   * whether to render admin surfaces without capability-probing an admin\n   * endpoint; every admin API stays enforced server-side regardless.\n   */\n  readonly isAdmin: boolean\n}\n\n/**\n * An app the user let into their account through OAuth (`GET\n * /v1/me/connected-apps`): a developer app, an AI assistant's MCP connector, or\n * a self-hosted install. One entry per grant still in force.\n */\nexport interface ConnectedApp {\n  /** The grant's id — what {@link NodaroClient.revokeConnectedApp} takes. */\n  readonly authorizationId: string\n  /** The app's name; `null` if it has none. A `dynamic_mcp` client chose its own. */\n  readonly name: string | null\n  /**\n   * How the app came to exist: `user` (a developer app someone registered),\n   * `first_party_mcp`, `dynamic_mcp` (an MCP client that registered itself) or\n   * `community_instance` (a self-hosted install).\n   */\n  readonly kind: DeveloperAppKind | (string & {})\n  readonly homepageUrl: string | null\n  /** The scopes this grant holds. */\n  readonly scopes: readonly DeveloperAppScope[]\n  /** When the user granted access (ISO 8601). */\n  readonly connectedAt: string\n  /** The latest use of any token issued under the grant; `null` if never used. */\n  readonly lastUsedAt: string | null\n}\n\nexport class NodaroClientCore {\n  readonly baseUrl: string\n  readonly auth: Auth\n  readonly timeoutMs: number\n  /** Value sent as `X-Nodaro-Client`; recorded by the backend as job provenance. */\n  readonly clientLabel: string\n  /** Whether to actually send it — see the note on {@link CLIENT_HEADER}. */\n  private readonly sendClientHeader: boolean\n  private readonly fetchOverride: typeof fetch | undefined\n\n  /**\n   * Resolved lazily so consumers can swap `globalThis.fetch` after the\n   * client has been constructed (e.g. test mocks). Always rebound to the\n   * global object — native fetch throws \"Illegal invocation\" when its\n   * `this` is anything else.\n   */\n  get fetch(): typeof fetch {\n    return this.fetchOverride ?? globalThis.fetch.bind(globalThis)\n  }\n\n  /** The workspace this client acts in; undefined = the personal space. */\n  readonly workspaceId: string | undefined\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/$/, \"\")  // strip trailing slash\n    this.auth = opts.auth\n    this.fetchOverride = opts.fetch\n    this.timeoutMs = opts.timeoutMs ?? 60_000\n    this.clientLabel = opts.clientLabel ?? `sdk/${SDK_VERSION}`\n    this.workspaceId = opts.workspaceId\n    // Explicit label = deliberate opt-in, always sent. The default is suppressed\n    // in browsers — see the note on CLIENT_HEADER.\n    this.sendClientHeader = opts.clientLabel !== undefined || !isBrowser()\n  }\n\n  /**\n   * The transport: build the request, send it, throw the typed error on a\n   * non-2xx via {@link throwFromResponse}, then read the body via `read` — all\n   * inside the abort timer, so `timeoutMs` bounds the body download too (a\n   * stalled CSV stream aborts, it does not hang forever). Both the JSON path\n   * ({@link request}) and the text path ({@link requestText}) go through here.\n   */\n  private async send<T>(\n    method: string,\n    path: string,\n    options: RequestOptions,\n    read: (res: Response) => Promise<T>,\n  ): Promise<T> {\n    const url = this.buildUrl(path, options.query)\n\n    const token = await this.auth.getToken()\n    // A `FormData` body is a multipart upload: let the runtime set\n    // `Content-Type: multipart/form-data; boundary=…` itself (a manual JSON\n    // content-type corrupts the boundary), and send the body as-is rather than\n    // JSON-stringifying it. Every other body stays JSON, exactly as before.\n    const isFormData =\n      typeof FormData !== \"undefined\" && options.body instanceof FormData\n    const headers: Record<string, string> = {\n      ...(isFormData ? {} : { \"Content-Type\": \"application/json\" }),\n      ...(this.sendClientHeader ? { [CLIENT_HEADER]: this.clientLabel } : {}),\n      // Before per-request headers: a resource that needs to reach outside\n      // this client's workspace says so explicitly and wins.\n      ...(this.workspaceId ? { [WORKSPACE_HEADER]: this.workspaceId } : {}),\n      ...(options.headers ?? {}),\n    }\n    if (token) headers[\"Authorization\"] = `Bearer ${token}`\n\n    const ac = new AbortController()\n    const timeoutId = setTimeout(() => ac.abort(), this.timeoutMs)\n    const abort = () => ac.abort(options.signal?.reason)\n    options.signal?.addEventListener(\"abort\", abort, { once: true })\n    if (options.signal?.aborted) abort()\n\n    try {\n      ac.signal.throwIfAborted()\n      const res = await this.fetch(url, {\n        method,\n        headers,\n        body:\n          options.body === undefined\n            ? undefined\n            : isFormData\n              ? (options.body as FormData)\n              : JSON.stringify(options.body),\n        signal: ac.signal,\n      })\n\n      if (!res.ok) {\n        let errBody: Record<string, unknown> = {}\n        try {\n          errBody = await res.json() as Record<string, unknown>\n        } catch {\n          // Empty/non-JSON body — fall through with empty errBody\n        }\n        throwFromResponse(res.status, errBody)\n      }\n\n      return await read(res)\n    } finally {\n      clearTimeout(timeoutId)\n      options.signal?.removeEventListener(\"abort\", abort)\n    }\n  }\n\n  /** Authenticated, bounded binary reads through the normal timeout/error transport. */\n  async requestBytes(method: string, path: string, options: RequestOptions & { maxBytes: number }): Promise<ArrayBuffer> {\n    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1) throw new Error(\"maxBytes must be a positive integer\")\n    return this.send(method, path, options, (response) => readBinaryResponse(response, options.maxBytes))\n  }\n\n  async request<T>(method: string, path: string, options: RequestOptions = {}): Promise<T> {\n    return this.send(method, path, options, async (res) =>\n      // 204 No Content\n      res.status === 204 ? (undefined as T) : ((await res.json()) as T),\n    )\n  }\n\n  /**\n   * Like {@link request}, for endpoints that answer text (CSV exports). Errors\n   * are still the JSON envelope and throw the same typed errors, and the read is\n   * bounded by the same timeout as the request.\n   */\n  async requestText(method: string, path: string, options: RequestOptions = {}): Promise<string> {\n    return this.send(method, path, options, (res) => res.text())\n  }\n\n  /**\n   * `GET /v1/me` → the authenticated user's identity (see {@link UserIdentity}).\n   * Unwraps the `{ data }` envelope. Throws `UnauthorizedError` (401) when the\n   * token is missing/invalid, and the SDK's other typed errors as usual.\n   *\n   * On an instance with organizations it also carries what the caller belongs\n   * to. THREE states, and collapsing them is wrong in a way users feel: the\n   * organization fields ABSENT means this instance has no organizations at\n   * all; present and empty means the account belongs to none; and\n   * `organizationsUnavailable` means the lookup failed — keep whatever\n   * selection you already had rather than concluding the person was removed\n   * from everything.\n   */\n  async me(): Promise<UserIdentity & MeOrganizations> {\n    const res = await this.request<{ data: UserIdentity & MeOrganizations }>(\"GET\", \"/v1/me\")\n    return res.data\n  }\n\n  /**\n   * `GET /v1/me/connected-apps` → every app with access to the signed-in\n   * user's account (see {@link ConnectedApp}), newest grant first.\n   *\n   * **A signed-in browser session only.** The route answers a Supabase\n   * session token (`supabaseAuth(…)`, `createSharedSupabaseClient`, or a\n   * `StaticTokenAuth` holding one) and refuses every other credential with\n   * `UnauthorizedError` (\"Sign in required\"): an app token or an API key must\n   * not list the grants it lives under. Build your \"Connected apps\" settings\n   * screen on this; a server-side integration cannot call it.\n   */\n  async connectedApps(): Promise<ConnectedApp[]> {\n    const res = await this.request<{ apps: ConnectedApp[] }>(\"GET\", \"/v1/me/connected-apps\")\n    return res.apps\n  }\n\n  /**\n   * `POST /v1/me/connected-apps/:authorizationId/revoke` — ends an app's\n   * access: the grant and every token issued under it, at once (the app's next\n   * call is a 401). Resolves when done.\n   *\n   * A signed-in browser session only, like {@link connectedApps}. Throws\n   * `NotFoundError` when the grant is not the user's or is already revoked.\n   */\n  async revokeConnectedApp(authorizationId: string): Promise<void> {\n    await this.request(\"POST\", `/v1/me/connected-apps/${encodeURIComponent(authorizationId)}/revoke`)\n  }\n\n  private buildUrl(path: string, query?: Record<string, string | number | boolean | undefined>): string {\n    const base = this.baseUrl || (typeof window !== \"undefined\" ? window.location.origin : \"http://placeholder\")\n    const url = new URL(path, base)\n    // If baseUrl was empty, strip the placeholder origin\n    const fullUrl = this.baseUrl ? url.toString() : url.pathname + url.search\n    if (query) {\n      const u = new URL(this.baseUrl ? fullUrl : fullUrl, base)\n      for (const [k, v] of Object.entries(query)) {\n        if (v !== undefined) u.searchParams.set(k, String(v))\n      }\n      return this.baseUrl ? u.toString() : u.pathname + u.search\n    }\n    return fullUrl\n  }\n}\n","/**\n * Auth provides the token used for `Authorization: Bearer <token>` on each request.\n * Implementations:\n *   - StaticTokenAuth — fixed string (server-side, OAuth access token, API token)\n *   - CallbackAuth    — caller-supplied async function (BYO logic)\n *   - supabaseAuth    — pulls JWT from a Supabase client live (browser frontends)\n */\nexport interface Auth {\n  /** Returns the current Bearer token, or null if not authenticated. */\n  getToken(): Promise<string | null>\n}\n\nexport class StaticTokenAuth implements Auth {\n  constructor(private token: string) {}\n  async getToken() {\n    return this.token\n  }\n}\n\nexport class CallbackAuth implements Auth {\n  constructor(private fn: () => string | null | Promise<string | null>) {}\n  async getToken() {\n    return this.fn()\n  }\n}\n\ninterface SupabaseLikeClient {\n  auth: {\n    getSession(): Promise<{ data: { session: { access_token: string } | null } }>\n  }\n}\n\n/** Pulls a JWT from a Supabase v2 client. Caller supplies their own supabase. */\nexport function supabaseAuth(supabase: SupabaseLikeClient): Auth {\n  return {\n    async getToken() {\n      const { data } = await supabase.auth.getSession()\n      return data.session?.access_token ?? null\n    },\n  }\n}\n"]}

package/dist/entries/apps.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
 require('../chunk-NJVSKUL2.cjs');
-var chunkOIYMTGYN_cjs = require('../chunk-OIYMTGYN.cjs');
+var chunkJOXZ4ZIF_cjs = require('../chunk-JOXZ4ZIF.cjs');
 
 
 
 Object.defineProperty(exports, "AppsResource", {
   enumerable: true,
-  get: function () { return chunkOIYMTGYN_cjs.AppsResource; }
+  get: function () { return chunkJOXZ4ZIF_cjs.AppsResource; }
 });
 //# sourceMappingURL=apps.cjs.map
 //# sourceMappingURL=apps.cjs.map

package/dist/entries/apps.d.cts

@@ -20,7 +20,7 @@ interface PublishedApp {
     /** The listed price per run; when `perMinuteCredits` is above 0, its fixed part. */
     estimatedCredits?: number | null;
     /** The listed price holds a metered LLM call's ESTIMATE (its model's typical
-     *  call, charged its actual usage per token): show it `~N`. Absent for a
+     *  call, charged its actual usage per token): show it `≈N`. Absent for a
      *  fixed price, and on a deployment running the tier-pricing rollback. */
     estimatedCreditsIsEstimate?: true;
     /**

package/dist/entries/apps.d.ts

@@ -20,7 +20,7 @@ interface PublishedApp {
     /** The listed price per run; when `perMinuteCredits` is above 0, its fixed part. */
     estimatedCredits?: number | null;
     /** The listed price holds a metered LLM call's ESTIMATE (its model's typical
-     *  call, charged its actual usage per token): show it `~N`. Absent for a
+     *  call, charged its actual usage per token): show it `≈N`. Absent for a
      *  fixed price, and on a deployment running the tier-pricing rollback. */
     estimatedCreditsIsEstimate?: true;
     /**

package/dist/entries/apps.js

@@ -1,4 +1,4 @@
 import '../chunk-3PPSGM5X.js';
-export { AppsResource } from '../chunk-FQNCIP6K.js';
+export { AppsResource } from '../chunk-7LODCIQK.js';
 //# sourceMappingURL=apps.js.map
 //# sourceMappingURL=apps.js.map

package/dist/entries/cast-swap.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
 require('../chunk-RQSGS7ZK.cjs');
-var chunk55ZX6TE3_cjs = require('../chunk-55ZX6TE3.cjs');
+var chunk66M54BUO_cjs = require('../chunk-66M54BUO.cjs');
 
 
 
 Object.defineProperty(exports, "CastSwapResource", {
   enumerable: true,
-  get: function () { return chunk55ZX6TE3_cjs.CastSwapResource; }
+  get: function () { return chunk66M54BUO_cjs.CastSwapResource; }
 });
 //# sourceMappingURL=cast-swap.cjs.map
 //# sourceMappingURL=cast-swap.cjs.map

package/dist/entries/cast-swap.d.cts

@@ -3,9 +3,10 @@ import '@nodaro/shared/apps';
 import '@nodaro/shared/organizations';
 
 /**
- * Cast Swap — replace the people, pets, products and/or the location in a
- * short video with your own references, keeping its motion, framing, timing
- * and sound (the clip's audio is kept, and the result is the clip's length).
+ * Nodaro Motion (the `castSwap` resource; routes `/v1/cast-swap`) — replace
+ * the people, pets, products and/or the location in a short video with your
+ * own references, keeping its motion, framing, timing and sound (the clip's
+ * audio is kept, and the result is the clip's length).
  *
  * Before the video, each person, pet and product role's photos are turned
  * into one clean reference picture by an image model. This costs extra
@@ -14,11 +15,16 @@ import '@nodaro/shared/organizations';
  * photos if it fails, and is turned off with `prepareReferences: false`.
  * Locations are not prepared.
  *
- * Engines: a run is made on Seedance 2.5 (`engine` left out, or
- * `"seedance-2-5"`) or Kling 4 (`"kling-4"`). Kling 4 renders 720p (its
- * default) or 1080p and has no draft; it makes a new take guided by the clip
- * and pictures, so its Full Quality is a new take at 1080p rather than the
- * same take re-rendered (`CastSwapFullQualityEstimate.kind`).
+ * Engines: a run is made on Nodaro Motion Pro (`engine` left out, or
+ * `"motion-pro"`) or Nodaro Motion Lite (`"motion-lite"`). Lite renders 720p
+ * (its default) or 1080p and has no draft; it makes a new take guided by the
+ * clip and pictures, so its Full Quality is a new take at 1080p rather than
+ * the same take re-rendered (`CastSwapFullQualityEstimate.kind`).
+ *
+ * How the clip is prepared for the video model (for one, whether faces are
+ * hidden first, and whether a refused clip is retried) is set by Nodaro for
+ * each engine; a run cannot change it. `faceMasking` is no longer read
+ * (deprecated: accepted and ignored).
  *
  * Cloud edition only: `/v1/cast-swap` is served by the cloud plugin and 404s
  * on self-hosted installs. `run()` answers 202 with a job id; follow it with
@@ -34,40 +40,50 @@ import '@nodaro/shared/organizations';
  * anything is charged: 400 `validation_error` (the body: no role with images,
  * no reference and no `prePrompt` or `postPrompt`, more roles of a kind
  * than allowed, more than 30 images in all, `draft: true` above 480p, a
- * `prePrompt` or `postPrompt` over 4,000 characters, a `faceMasking` setting
- * out of range); on Kling 4, `draft_unsupported` (`draft: true`),
- * `resolution_unsupported` (480p), `output_format_unsupported` (a MOV edit
- * output) and `too_many_images` (more than 10 images in the run, across every
- * role and fixed reference); `raw_reference_token` (also in a reference's `line`),
+ * `prePrompt` or `postPrompt` over 4,000 characters); on Nodaro Motion Lite,
+ * `draft_unsupported` (`draft: true`), `resolution_unsupported` (480p),
+ * `output_format_unsupported` (a MOV edit output) and `too_many_images` (more
+ * than 10 images in the run, across every role and fixed reference);
+ * `raw_reference_token` (also in a reference's `line`),
  * `invalid_role_mention` (also any `{role:N}` in a reference's `line`),
  * `unsafe_url`, `video_unreadable`, `clip_out_of_range` (4–30 s),
  * `preview_out_of_range`, `no_roles_in_preview` (a preview with every role
  * `inPreview: false`, always refused even with a prompt, or with no role kept
  * in it that has images and no `prePrompt` or `postPrompt`), `prompt_too_long`
  * (the prompt would build too long: a `{role:N}` reads as the role's name when
- * it sends no images; Kling 4's cap is 8,000 characters); 401; 402 `insufficient_credits` (`run()` only); 404
+ * it sends no images; Nodaro Motion Lite's cap is 8,000 characters); 401; 402 `insufficient_credits` (`run()` only); 404
  * (a `sessionId` you may not use, `run()` only); 422 `job_blocked` (`run()`
  * only); 503 `host_too_old` (both); 503 `estimate_unavailable` (`estimate()`
  * only).
  */
 /**
- * The video engine a Cast Swap run is made on. Left out = `"seedance-2-5"`.
+ * The engine a Nodaro Motion run is made on, by its public id. Left out =
+ * `"motion-pro"`.
  *
- * - `"seedance-2-5"`: 480p (the default, a draft unless `draft: false`), 720p
- *   or 1080p; Full Quality re-renders a draft's own take at 1080p.
- * - `"kling-4"`: 720p (the default) or 1080p, never a draft (`draft: true`
- *   answers 400 `draft_unsupported`); Full Quality makes a new take at 1080p
- *   from a completed 720p run's inputs. A preview is still 4 s from
- *   `previewStart`.
+ * - `"motion-pro"` (Nodaro Motion Pro): 480p (the default, a draft unless
+ *   `draft: false`), 720p or 1080p; Full Quality re-renders a draft's own take
+ *   at 1080p.
+ * - `"motion-lite"` (Nodaro Motion Lite): 720p (the default) or 1080p, never a
+ *   draft (`draft: true` answers 400 `draft_unsupported`); Full Quality makes a
+ *   new take at 1080p from a completed 720p run's inputs. A preview is still
+ *   4 s from `previewStart`.
+ */
+type CastSwapEngine = "motion-pro" | "motion-lite";
+/**
+ * The engine ids an older client sent (`"seedance-2-5"` = `"motion-pro"`,
+ * `"kling-4"` = `"motion-lite"`). Still accepted in a request; never returned.
+ * @deprecated use {@link CastSwapEngine}.
  */
-type CastSwapEngine = "seedance-2-5" | "kling-4";
+type CastSwapEngineLegacyId = "seedance-2-5" | "kling-4";
 /**
- * Where a Kling 4 run cuts the clip to whole seconds (Kling renders whole
- * seconds; asked for more than the clip, it would stretch the motion):
+ * Where a Nodaro Motion Lite run cuts the clip to whole seconds (Lite renders
+ * whole seconds; asked for more than the clip, it would stretch the motion):
  * - `"cut-end"` (the default): drop the fraction of a second at its end;
  * - `"cut-start"`: drop it at its start.
  */
-type CastSwapKlingLength = "cut-end" | "cut-start";
+type CastSwapMotionLength = "cut-end" | "cut-start";
+/** @deprecated use {@link CastSwapMotionLength}. */
+type CastSwapKlingLength = CastSwapMotionLength;
 /** Whether a swapped subject takes this trait from the references (`"new"`) or keeps the video's (`"original"`). */
 type CastSwapTraitSource = "new" | "original";
 /**
@@ -150,62 +166,26 @@ interface CastSwapReference {
     line: string;
 }
 /**
- * Margins of the frame, each 0–49 %: a face whose centre lies in a margin is
- * not masked, so only faces inside the inner rectangle are. A margin left out
- * of a zone that is given is 0. (A `zone` left out altogether is 10 % at the
- * left and right: see `CastSwapFaceMasking.zone`.)
+ * @deprecated Nodaro sets this per engine; a run's `faceMasking` is ignored.
  */
 interface CastSwapFaceMaskingZone {
-    /** % of the frame's width from the left edge. Default 0 in a zone that is given. */
     leftPct?: number;
-    /** % of the frame's width from the right edge. Default 0 in a zone that is given. */
     rightPct?: number;
-    /** % of the frame's height from the top edge. Default 0. */
     topPct?: number;
-    /** % of the frame's height from the bottom edge. Default 0. */
     bottomPct?: number;
 }
 /**
- * Face masking: the faces in the source clip are covered before the video
- * model sees it, keeping their movement and lip timing while the rest of the
- * clip is sent as it is.
- *
- * - `"off"` (the same as leaving `faceMasking` out): the clip is sent as it is.
- * - `"always"`: the faces are masked before the first attempt. Its credits are
- *   in the quote (`breakdown.masking`, counted in `totalCredits`).
- * - `"auto"`: the run starts unmasked; only if the video model refuses the
- *   source clip is it retried once with the faces masked. Any other failure is
- *   not retried. The extra credits, charged only when that retry runs, are the
- *   estimate's `maskingCredits` (not in `totalCredits`).
- *
- * A completed job's output carries `faceMasking: { applied, reason }`:
- * `applied` is whether the video was made from the masked clip, and `reason`
- * is `"always"` (masked before the first attempt), `"input_refused"` (`auto`
- * retried after the source clip was refused), `"no_faces"` (no face was left
- * to mask after the filters: an `always` run continues unmasked; an `auto`
- * run fails with the original refusal instead) or `"off"`.
+ * @deprecated Nodaro sets how the clip is prepared for the video model, per
+ * engine; a run cannot change it. A `faceMasking` sent is accepted and
+ * ignored (no error), so older code keeps working unchanged.
  */
 interface CastSwapFaceMasking {
     mode: "off" | "always" | "auto";
-    /** What covers a masked face: `"blur"` (default) or `"depth"` (a depth-color view of it). */
     fill?: "blur" | "depth";
-    /** Mask only faces at least this % of the frame's height, 0–100. Default 15. */
     minFaceHeightPct?: number;
-    /**
-     * Mask only faces at most this % of the frame's height, 0–100. Default 0 (no
-     * limit). When above 0 it must be at least `minFaceHeightPct` (else 400).
-     */
     maxFaceHeightPct?: number;
-    /**
-     * Leave out faces near the edges of the frame. Default (left out):
-     * `{ leftPct: 10, rightPct: 10, topPct: 0, bottomPct: 0 }`, so people at the
-     * left and right edges are not masked. `null`, or all four margins 0, means
-     * no margins.
-     */
     zone?: CastSwapFaceMaskingZone | null;
-    /** The blur's strength, 0.1–5 % of the frame's width (`fill: "blur"`). Default 2. */
     blurStrengthPct?: number;
-    /** How sure the face finder must be, 0.05–0.95: lower finds more faces. Default 0.5. */
     threshold?: number;
 }
 /** The body of `POST /v1/cast-swap` and `POST /v1/cast-swap/estimate`. */
@@ -248,27 +228,30 @@ interface CastSwapParams {
     /** Where the preview starts, in seconds. Default 0. */
     previewStart?: number;
     /**
-     * The video engine (see {@link CastSwapEngine}). Default `"seedance-2-5"`.
-     * The job records it in `input_data.engine`, and a completed job's output
-     * in its `engine`. A Cast Swap engine older than Kling 4 support ignores
-     * the field and runs Seedance 2.5: a Kling 4 quote names `engine:
-     * "kling-4"`, so check the estimate's `engine` before running.
+     * The engine (see {@link CastSwapEngine}). Default `"motion-pro"`. The job
+     * records it in `input_data.engine`, and a completed job's output in its
+     * `engine`. The ids an older client sent ({@link CastSwapEngineLegacyId})
+     * are still accepted.
      */
-    engine?: CastSwapEngine;
+    engine?: CastSwapEngine | CastSwapEngineLegacyId;
     /**
-     * Kling 4 only (Seedance 2.5 ignores it): which end of the clip is cut to
-     * whole seconds (see {@link CastSwapKlingLength}). Default `"cut-end"`.
+     * Nodaro Motion Lite only (Pro ignores it): which end of the clip is cut to
+     * whole seconds (see {@link CastSwapMotionLength}). Default `"cut-end"`.
      */
+    motionLength?: CastSwapMotionLength;
+    /** @deprecated use {@link motionLength} (still accepted). */
     klingLength?: CastSwapKlingLength;
     /**
-     * The output resolution. Seedance 2.5: `"480p"` (default), `"720p"` or
-     * `"1080p"`. Kling 4: `"720p"` (default) or `"1080p"`; `"480p"` answers 400.
+     * The output resolution. Nodaro Motion Pro: `"480p"` (default), `"720p"` or
+     * `"1080p"`. Nodaro Motion Lite: `"720p"` (default) or `"1080p"`; `"480p"`
+     * answers 400.
      */
     resolution?: "480p" | "720p" | "1080p";
     /**
-     * Render as a draft (Seedance 2.5 only). Defaults to `true` at 480p and
+     * Render as a draft (Nodaro Motion Pro only). Defaults to `true` at 480p and
      * `false` above it; `true` with `"720p"` or `"1080p"` answers 400 (draft is
-     * 480p only). Kling 4 has no draft: `true` answers 400 `draft_unsupported`.
+     * 480p only). Nodaro Motion Lite has no draft: `true` answers 400
+     * `draft_unsupported`.
      */
     draft?: boolean;
     /**
@@ -278,7 +261,11 @@ interface CastSwapParams {
      * Default `true`.
      */
     prepareReferences?: boolean;
-    /** Mask the faces in the source clip (see {@link CastSwapFaceMasking}). Default: off. */
+    /**
+     * Ignored: Nodaro sets how the clip is prepared, per engine. Accepted (no
+     * error) so older code keeps working.
+     * @deprecated leave it out.
+     */
     faceMasking?: CastSwapFaceMasking;
     /**
      * `"draft"` means 480p draft.
@@ -293,71 +280,58 @@ interface CastSwapParams {
 /** What a run would cost, in credits. */
 interface CastSwapEstimate {
     /**
-     * The engine the run would use. Sent by an engine that knows Kling 4 on a
-     * Kling 4 quote (`"kling-4"`); absent = Seedance 2.5.
+     * The engine the run would use, by its public id (absent from an older
+     * server = `"motion-pro"`).
      */
     engine?: CastSwapEngine;
     /**
-     * What is held when the run starts: `breakdown.castSwap +
-     * breakdown.seedance + breakdown.references` (on Kling 4,
-     * `breakdown.kling` in place of `breakdown.seedance`), plus
-     * `breakdown.masking` with face masking `"always"`. The run is charged what it actually costs, which
-     * is expected to be `expectedCredits`.
+     * What is held when the run starts. The run is charged what it actually
+     * costs, which is expected to be `expectedCredits`.
      */
     totalCredits: number;
     /**
-     * The charge the run is expected to come to: `breakdown.castSwap +
-     * breakdown.seedanceExpected + breakdown.references`, plus
-     * `breakdown.masking` with face masking `"always"` (the hold, with the video
-     * model's expected charge in place of its hold). Never above `totalCredits`.
-     * With `"auto"` the masking is in neither total (see `maskingCredits`).
-     * `totalCredits` is what is held when the run starts; the run is charged
-     * what it actually costs.
-     *
-     * Absent from an older Cast Swap engine: read `totalCredits` then. On
-     * Kling 4 it equals `totalCredits` (Kling renders exactly the length asked
-     * for, so the hold is what it settles at).
+     * The charge the run is expected to come to. Never above `totalCredits`
+     * (on Nodaro Motion Lite it equals it: Lite renders exactly the length
+     * asked for, so the hold is what it settles at). Absent from an older
+     * server: read `totalCredits` then.
      */
     expectedCredits?: number;
     /**
-     * The parts of the quote:
+     * The parts of the quote, by name, for display only:
      * - `castSwap`: the run itself;
-     * - `seedance`: what the video model it calls holds (the video's length is
-     *   left to the model, so it is held at the model's longest output);
-     * - `seedanceExpected`: what the video model is expected to be charged (the
-     *   clip in and about as much out), never above `seedance`. It takes
-     *   `seedance`'s place in `expectedCredits`; it is not added to it. Absent
-     *   from an older Cast Swap engine, like `expectedCredits`;
-     * - `kling`: Kling 4 only, in place of `seedance` and `seedanceExpected`:
-     *   what the Kling take costs (held and charged alike);
      * - `references`: preparing the reference pictures (0 when
      *   `prepareReferences` is off or there is nothing to prepare);
-     * - `masking`: masking the faces, present only when `faceMasking` is on.
-     *   With `"always"` it is in both totals; with `"auto"` it equals
-     *   `maskingCredits` and is in neither.
+     * - `motion`: what the video holds (on Nodaro Motion Lite, what it costs);
+     * - `motionExpected`: what the video is expected to be charged, never above
+     *   `motion` (Nodaro Motion Pro);
+     * - `privacy`: preparing the clip, when the engine's setting does. In both
+     *   totals when it always runs; outside both when it is the retry
+     *   (`privacyCredits`).
      *
-     * So the parts sum to more than either total: `seedance` and
-     * `seedanceExpected` are alternatives, and `"auto"` masking is outside both.
+     * `motion` and `motionExpected` are alternatives, so the parts sum to more
+     * than either total: read `totalCredits` and `expectedCredits`, never the
+     * sum. Other parts may appear.
      */
     breakdown: {
         castSwap: number;
-        seedance?: number;
         references: number;
-        seedanceExpected?: number;
-        kling?: number;
-        masking?: number;
-    };
+        motion?: number;
+        motionExpected?: number;
+        privacy?: number;
+    } & Record<string, number>;
     /**
-     * Face masking `"auto"` only: the extra credits charged if the source clip
-     * is refused and the run is retried with the faces masked. Not in
-     * `totalCredits` or `expectedCredits`; `run()` needs credits for both the
-     * hold and this (else 402).
+     * The extra credits charged only if the video model refuses the clip and
+     * the run is retried (Nodaro's setting for the engine decides whether it
+     * does). Not in `totalCredits` or `expectedCredits`; `run()` needs credits
+     * for both the hold and this (else 402).
      */
+    privacyCredits?: number;
+    /** @deprecated read {@link privacyCredits} (an older server answered this name). */
     maskingCredits?: number;
     /**
-     * `true` when the video is made at Auto length (every Seedance 2.5 run): the
-     * final charge is expected to come out lower than `totalCredits`, at about
-     * `expectedCredits`. `false` on Kling 4.
+     * `true` when the video is made at Auto length (every Nodaro Motion Pro
+     * run): the final charge is expected to come out lower than `totalCredits`,
+     * at about `expectedCredits`. `false` on Nodaro Motion Lite.
      */
     settlesLower: boolean;
 }
@@ -374,36 +348,36 @@ interface CastSwapRunOptions {
     idempotencyKey?: string;
 }
 /**
- * What a Full Quality version would be: `"same-take"` re-renders a Seedance
- * 2.5 draft's own take at 1080p; `"new-take"` makes a new Kling 4 take at
+ * What a Full Quality version would be: `"same-take"` re-renders a Nodaro
+ * Motion Pro draft's own take at 1080p; `"new-take"` makes a new Nodaro Motion Lite take at
  * 1080p from a 720p run's inputs (it will not match the 720p run frame for
  * frame). The 720p run or draft stays either way.
  */
 type CastSwapFullQualityKind = "same-take" | "new-take";
 /**
  * What a Full Quality version of a run would cost
- * (`POST /v1/cast-swap/:jobId/full-quality/estimate`): a Seedance 2.5 draft,
- * or a completed Kling 4 run at 720p.
+ * (`POST /v1/cast-swap/:jobId/full-quality/estimate`): a Nodaro Motion Pro
+ * draft, or a completed Nodaro Motion Lite run at 720p.
  */
 interface CastSwapFullQualityEstimate {
     /**
      * Which Full Quality this is ({@link CastSwapFullQualityKind}), so it can
-     * be worded right. Absent from an older Cast Swap engine: `"same-take"`.
+     * be worded right. Absent from an older server: `"same-take"`.
      */
     kind?: CastSwapFullQualityKind;
-    /** The quote in credits: `breakdown.castSwap` + `breakdown.seedanceHd` (same take) or `breakdown.kling` (new take). */
+    /** The quote in credits: `breakdown.castSwap` plus the 1080p render (same take) or the new take. */
     totalCredits: number;
     /**
-     * `castSwap`: the Full Quality job's own steps; `seedanceHd` (a same take):
-     * the 1080p render of the draft's take (0 when an earlier try of this draft
-     * already finished that render, which is then reused); `kling` (a new take,
-     * in place of `seedanceHd`): the new Kling 4 take at 1080p.
+     * The parts of the quote, by name, for display only: `castSwap` (the Full
+     * Quality job's own steps), and `motionHd` (a same take: the 1080p render,
+     * 0 when an earlier try of this draft already finished that render, which
+     * is then reused) or `motion` (a new take).
      */
     breakdown: {
         castSwap: number;
-        seedanceHd?: number;
-        kling?: number;
-    };
+        motionHd?: number;
+        motion?: number;
+    } & Record<string, number>;
     /** ISO time until which the run can be finished at Full Quality (7 days after it completed). */
     availableUntil: string;
 }
@@ -422,11 +396,11 @@ interface CastSwapFullQualityResult {
  * The `code` of a Full Quality refusal (`NodaroError.code`), all before
  * anything is charged:
  * - `unauthorized` (401): no authenticated user;
- * - `not_found` (404): not your job, or not a Cast Swap run; also a
+ * - `not_found` (404): not your job, or not a Nodaro Motion run; also a
  *   `sessionId` you may not use;
  * - `not_completed` (409): the run has not finished;
- * - `not_a_draft` (409): the run is neither a Seedance 2.5 draft nor a
- *   Kling 4 run at 720p (a Kling 4 run at 1080p is already Full Quality);
+ * - `not_a_draft` (409): the run is neither a Nodaro Motion Pro draft nor a
+ *   Nodaro Motion Lite run at 720p (a Lite run at 1080p is already Full Quality);
  * - `draft_expired` (410): more than 7 days after the draft completed, or
  *   the draft can no longer be finished at Full Quality;
  * - `full_quality_pending` (409, `details.retryable: true`): not final — an
@@ -450,7 +424,7 @@ declare class CastSwapResource {
     private client;
     constructor(client: NodaroClientCore);
     /**
-     * Start a Cast Swap run (`POST /v1/cast-swap`, 202 `{ jobId }`). Returns the
+     * Start a Nodaro Motion run (`POST /v1/cast-swap`, 202 `{ jobId }`). Returns the
      * job to follow. With `options.idempotencyKey` (sent as the
      * `Idempotency-Key` header; 8–200 characters, else 400) a repeat with the
      * same key within about 10 s answers 200 `{ jobId, deduped: true }`, a later
@@ -465,8 +439,8 @@ declare class CastSwapResource {
     /**
      * Quote finishing a run at Full Quality (`POST
      * /v1/cast-swap/:jobId/full-quality/estimate`); spends nothing. `jobId` is a
-     * finished Seedance 2.5 DRAFT run, or a finished Kling 4 run at 720p (a Cast
-     * Swap or trend run); the quote's `kind` says whether it is the same take
+     * finished Nodaro Motion Pro DRAFT run, or a finished Nodaro Motion Lite
+     * run at 720p (a Nodaro Motion or trend run); the quote's `kind` says whether it is the same take
      * re-rendered or a new take. The quote
      * does not look for a Full Quality already running: when one is,
      * {@link fullQuality} answers it (`existing: true`) and charges nothing.
@@ -476,7 +450,7 @@ declare class CastSwapResource {
     /**
      * Finish a run at Full Quality (`POST /v1/cast-swap/:jobId/full-quality`):
      * at 1080p, with the clip's audio, as a new job linked to the run — a
-     * Seedance 2.5 draft's own take re-rendered, or a new Kling 4 take from a
+     * Nodaro Motion Pro draft's own take re-rendered, or a new Nodaro Motion Lite take from a
      * 720p run's inputs (the quote's `kind`). SPENDS CREDITS: quote it first with
      * {@link fullQualityEstimate}. Answers 202 `{ jobId }`, or 200
      * `{ jobId, existing: true }` when this run's Full Quality is already
@@ -488,4 +462,4 @@ declare class CastSwapResource {
     fullQuality(jobId: string, params?: CastSwapFullQualityParams): Promise<CastSwapFullQualityResult>;
 }
 
-export { type CastSwapEngine, type CastSwapEstimate, type CastSwapFaceMasking, type CastSwapFaceMaskingZone, type CastSwapFullQualityEstimate, type CastSwapFullQualityKind, type CastSwapFullQualityParams, type CastSwapFullQualityRefusalCode, type CastSwapFullQualityResult, type CastSwapKlingLength, type CastSwapLocationRole, type CastSwapParams, type CastSwapPersonRole, type CastSwapPetRole, type CastSwapProductRole, type CastSwapReference, CastSwapResource, type CastSwapRole, type CastSwapRolePreviewSettings, type CastSwapRunOptions, type CastSwapTraitSource };
+export { type CastSwapEngine, type CastSwapEngineLegacyId, type CastSwapEstimate, type CastSwapFaceMasking, type CastSwapFaceMaskingZone, type CastSwapFullQualityEstimate, type CastSwapFullQualityKind, type CastSwapFullQualityParams, type CastSwapFullQualityRefusalCode, type CastSwapFullQualityResult, type CastSwapKlingLength, type CastSwapLocationRole, type CastSwapMotionLength, type CastSwapParams, type CastSwapPersonRole, type CastSwapPetRole, type CastSwapProductRole, type CastSwapReference, CastSwapResource, type CastSwapRole, type CastSwapRolePreviewSettings, type CastSwapRunOptions, type CastSwapTraitSource };