@tangle-network/hub-sdk 0.2.0 → 0.2.1

package/README.md

@@ -0,0 +1,140 @@
+# @tangle-network/hub-sdk
+
+Typed SDK for the Tangle Hub `/v1/hub/*` surface. Status, connections, tools
+discovery and invocation, capability tokens, policies, approvals, audit.
+
+## Install
+
+```sh
+pnpm add @tangle-network/hub-sdk
+```
+
+## Quick start
+
+```ts
+import { HubClient } from "@tangle-network/hub-sdk";
+
+const hub = HubClient.fromEnv();
+const { principal, connections } = await hub.status();
+```
+
+`HubClient.fromEnv()` reads everything it needs from environment variables.
+SaaS vs on-prem flips via env only — there is no per-client default URL.
+
+## Environment variables
+
+| Variable                       | Required | Meaning                                                                                       |
+| ------------------------------ | -------- | --------------------------------------------------------------------------------------------- |
+| `TANGLE_HUB_URL`               | Yes      | Hub root URL. Either the platform root (`https://api.tangle.tools`) or the full Hub URL including `/v1/hub` — both are accepted; the SDK normalizes. |
+| `TANGLE_API_KEY`               | One of   | Long-lived API key (Bearer). User / API key principal.                                        |
+| `TANGLE_HUB_CAPABILITY_TOKEN`  | One of   | Short-lived capability token (Bearer). Sandbox-runtime principal. Auto-minted server-side per action. |
+
+The two auth credentials are mutually exclusive — set exactly one. This
+mirrors the platform-api `hubSandboxEnvironmentSchema` rule
+(`exactly-one-api-key-or-capability-token`).
+
+### Examples
+
+SaaS:
+
+```sh
+export TANGLE_HUB_URL=https://api.tangle.tools
+export TANGLE_API_KEY=sk-tan-...
+```
+
+On-prem:
+
+```sh
+export TANGLE_HUB_URL=https://hub.acme.internal
+export TANGLE_API_KEY=sk-tan-...
+```
+
+Inside a sandbox (capability-token principal):
+
+```sh
+export TANGLE_HUB_URL=https://api.tangle.tools/v1/hub
+export TANGLE_HUB_CAPABILITY_TOKEN=hubcap_...
+```
+
+## Fail-loud configuration
+
+`HubClient.fromEnv()` (and the standalone resolvers `resolveHubBaseUrl()` /
+`resolveHubAuth()`) **never default**. Missing or malformed configuration
+throws `HubSdkError` synchronously, before any request is issued:
+
+| Code                  | Cause                                                                            |
+| --------------------- | -------------------------------------------------------------------------------- |
+| `HUB_CONFIG_MISSING`  | `TANGLE_HUB_URL` unset/empty, **or** neither auth credential is set.             |
+| `HUB_CONFIG_INVALID`  | `TANGLE_HUB_URL` is not a valid URL, **or** both auth credentials are set.       |
+
+```ts
+try {
+  const hub = HubClient.fromEnv();
+} catch (error) {
+  if (error instanceof HubSdkError && error.code === "HUB_CONFIG_MISSING") {
+    // Surface the missing env var to the operator. Do not retry, do not default.
+  }
+  throw error;
+}
+```
+
+This matches the repository's "No fallbacks. Fail loud." doctrine: required
+config has no silent default.
+
+## Bypassing env auth resolve
+
+Pass `apiKey` or `authHeaders` explicitly to skip the auth-env-var check
+(useful when credentials come from a vault, OIDC exchange, or a custom
+session token). `TANGLE_HUB_URL` is still required.
+
+```ts
+const hub = HubClient.fromEnv({
+  apiKey: await vault.read("hub/api-key"),
+});
+
+const hub = HubClient.fromEnv({
+  authHeaders: async () => ({ Authorization: `Bearer ${await sessionToken()}` }),
+});
+```
+
+## Constructing without env vars
+
+`new HubClient({...})` remains supported for callers that resolve config
+themselves (CLI flags, web app config, tests). `fromEnv` is sugar with a
+fail-loud contract on top.
+
+```ts
+const hub = new HubClient({
+  baseUrl: "https://api.tangle.tools",
+  apiKey: "sk-tan-...",
+});
+```
+
+## Browsers, Workers, edge runtimes
+
+`fromEnv()` reads `globalThis.process?.env` — undefined in browsers and many
+edge runtimes. Pass an explicit `env` map there:
+
+```ts
+const hub = HubClient.fromEnv({
+  env: {
+    TANGLE_HUB_URL: import.meta.env.VITE_TANGLE_HUB_URL,
+    TANGLE_API_KEY: await session.apiKey(),
+  },
+  fetch: globalThis.fetch,
+});
+```
+
+## Exports
+
+- `HubClient`, `HubClient.fromEnv(options?)`
+- `HubConnectionsClient`, `HubPermissionsClient`, `HubTokensClient`,
+  `HubToolsClient`, `HubApprovalsClient`, `HubAuditClient`
+- `HubSdkError` — typed `code: HubErrorCode`, redacted `details`, optional
+  HTTP `status`
+- `HUB_URL_ENV_VAR`, `HUB_API_KEY_ENV_VAR`, `HUB_CAPABILITY_TOKEN_ENV_VAR` —
+  string constants for the env-var names (mirrored by the platform-api
+  `hub-sandbox-contract.ts` `z.literal(...)`)
+- `resolveHubBaseUrl(env?)`, `resolveHubAuth(env?)` — standalone resolvers
+  with the same fail-loud contract as `fromEnv`
+- All request/response types from the `/v1/hub/*` contract

package/dist/index.d.ts

@@ -14,7 +14,7 @@ interface HubErrorBody {
   message: string;
   details?: unknown;
 }
-type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_CONFIG_MISSING" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED";
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED";
 interface HubStatusResponse {
   contract: unknown;
   principal: HubPrincipal;
@@ -84,6 +84,23 @@ interface HubConnectionDeleteRequest {
 interface HubConnectionDeleteResponse {
   connection: HubConnection;
 }
+interface HubConnectionHealthRequest {
+  connectionId: string;
+}
+type HubConnectionHealthStatus = "healthy" | "reconnect_required" | "unhealthy" | "rate_limited";
+interface HubConnectionHealthError {
+  code: string;
+  message: string;
+}
+interface HubConnectionHealthInfo {
+  status: HubConnectionHealthStatus;
+  checkedAt: string;
+  error?: HubConnectionHealthError;
+}
+interface HubConnectionHealthResponse {
+  connection: HubConnection;
+  health: HubConnectionHealthInfo;
+}
 interface HubToolSource {
   sourceId: string;
   providerId: string;
@@ -182,6 +199,31 @@ interface HubPolicyResponse {
 interface HubPolicyListResponse {
   policies: HubPolicy[];
 }
+type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
+interface HubApproval {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  inputHash: string;
+  requesterPrincipal: Record<string, unknown>;
+  status: HubApprovalStatus;
+  requestedAt: string;
+  expiresAt: string;
+  resolvedAt: string | null;
+}
+interface HubApprovalCapabilityToken {
+  tokenId: string;
+  token: string;
+  expiresAt: string;
+}
+interface HubApprovalDecisionResponse {
+  approval: HubApproval;
+  capabilityToken?: HubApprovalCapabilityToken;
+}
+interface HubApprovalListResponse {
+  approvals: HubApproval[];
+}
 interface HubAuditEvent {
   id: string;
   action: string;
@@ -190,6 +232,15 @@ interface HubAuditEvent {
   metadata: unknown;
   createdAt: string;
 }
+interface HubAuditListRequest {
+  provider?: string;
+  action?: string;
+  status?: string;
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+}
 interface HubAuditResponse {
   events: HubAuditEvent[];
   nextCursor: string | null;
@@ -199,6 +250,54 @@ interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
     code: "HUB_NOT_IMPLEMENTED";
   };
 }
+interface HubGithubAppMintInstallationTokenRequest {
+  /** HTTPS or SSH GitHub URL — alternative to installationId. */
+  repoUrl?: string;
+  /** Explicit installation id — alternative to repoUrl. */
+  installationId?: number;
+  /**
+   * Permission narrowing. The hub MAY refuse a permission broader than the
+   * grant authorized; absent, defaults to `{ contents: "read" }` (the
+   * conservative clone-only floor the autonomous-improvement loop needs).
+   */
+  permissions?: Record<string, "read" | "write" | "admin">;
+  /** Hint passed to GitHub. Server caps at the configured maximum. */
+  ttlSeconds?: number;
+}
+interface HubGithubAppMintInstallationTokenResponse {
+  token: string;
+  expiresAt: string;
+  installationId: number;
+  owner: string;
+  repo: string;
+}
+interface HubGithubAppInstallation {
+  installationId: number;
+  /** Org/user login the App is installed on (lowercased). */
+  accountLogin: string;
+  accountType: string | null;
+  /** "all" ⇒ every repo under the account; "selected" ⇒ only repoFullNames. */
+  repositorySelection: "all" | "selected";
+  /** Lowercased "owner/repo" — empty when repositorySelection = "all". */
+  repoFullNames: string[];
+  suspended: boolean;
+}
+interface HubGithubAppInstallationResponse {
+  installation: HubGithubAppInstallation;
+}
+interface HubGithubAppListReposResponse {
+  installationId: number;
+  /** Lowercased "owner/repo" — covers the full registry view of the install. */
+  repoFullNames: string[];
+}
+interface HubGithubAppIsRepoInstalledRequest {
+  owner: string;
+  repo: string;
+}
+interface HubGithubAppIsRepoInstalledResponse {
+  installed: boolean;
+  installationId: number | null;
+}
 //#endregion
 //#region src/client.d.ts
 type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
@@ -216,6 +315,18 @@ declare class HubSdkError extends Error {
     status?: number;
   });
 }
+declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
+declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
+declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
+type HubEnv = Record<string, string | undefined>;
+interface HubClientFromEnvOptions {
+  env?: HubEnv;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
+}
+declare function resolveHubBaseUrl(env?: HubEnv): string;
+declare function resolveHubAuth(env?: HubEnv): string;
 declare class HubClient {
   readonly baseUrl: string;
   readonly fetch: typeof fetch;
@@ -225,7 +336,11 @@ declare class HubClient {
   readonly permissions: HubPermissionsClient;
   readonly tokens: HubTokensClient;
   readonly tools: HubToolsClient;
+  readonly approvals: HubApprovalsClient;
+  readonly audit: HubAuditClient;
+  readonly githubApp: HubGithubAppClient;
   constructor(options: HubClientOptions);
+  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
   status(): Promise<HubStatusResponse>;
   private request;
   private buildHeaders;
@@ -256,24 +371,55 @@ interface HubToolSearchOptions {
 }
 interface HubToolInvokeOptions {
   connectionId?: string;
+  approve?: boolean;
 }
 declare class HubToolsClient {
   private readonly request;
   constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
   search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
+  sources(): Promise<HubToolSourcesResponse>;
   describe(path: string): Promise<HubToolsDescribeResponse>;
   invoke<TResult = unknown>(path: string, input: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
   private buildExecInit;
 }
+interface HubConnectionStartOptions {
+  returnUrl?: string;
+  cli?: boolean;
+}
 declare class HubConnectionsClient {
   private readonly request;
   constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
   list(): Promise<HubConnectionsResponse>;
+  start(provider: string, options?: HubConnectionStartOptions): Promise<HubOAuthStartResponse>;
   revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
+  health(connectionId: string): Promise<HubConnectionHealthResponse>;
+}
+declare class HubApprovalsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(): Promise<HubApprovalListResponse>;
+  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+}
+declare class HubGithubAppClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  mintInstallationToken(input: HubGithubAppMintInstallationTokenRequest): Promise<HubGithubAppMintInstallationTokenResponse>;
+  getInstallation(installationId: number): Promise<HubGithubAppInstallationResponse>;
+  listRepos(installationId: number): Promise<HubGithubAppListReposResponse>;
+  isRepoInstalled(input: {
+    owner: string;
+    repo: string;
+  }): Promise<HubGithubAppIsRepoInstalledResponse>;
+}
+declare class HubAuditClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(options?: HubAuditListRequest): Promise<HubAuditResponse>;
 }
 //#endregion
 //#region src/redaction.d.ts
 declare function redactHubValue(value: unknown): unknown;
 //#endregion
-export { type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, HubClient, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, HubConnectionsClient, type HubConnectionsResponse, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubExecRequest, type HubExecResponse, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, redactHubValue };
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListReposResponse, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, redactHubValue, resolveHubAuth, resolveHubBaseUrl };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/client.ts","../src/redaction.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,OAAA;EACA,IAAA,EAAM,KAAA;AAAA;AAAA,UAGS,gBAAA;EACf,OAAA;EACA,KAAA,EAAO,YAAA;AAAA;AAAA,KAGG,WAAA,UAAqB,kBAAA,CAAmB,KAAA,IAAS,gBAAA;AAAA,UAE5C,YAAA;EACf,IAAA,EAAM,YAAA;EACN,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,YAAA;AAAA,UAmBK,iBAAA;EACf,QAAA;EACA,SAAA,EAAW,YAAA;EACX,WAAA,EAAa,oBAAA;AAAA;AAAA,UAGE,YAAA;EACf,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,QAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,oBAAA;EACf,sBAAA;EACA,sBAAA;AAAA;AAAA,UAGe,aAAA;EACf,EAAA;EACA,UAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,sBAAA;EACf,WAAA,EAAa,aAAA;AAAA;AAAA,UAGE,oBAAA;EACf,QAAA;EACA,SAAA;EACA,GAAA;AAAA;AAAA,UAGe,4BAAA;EACf,QAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;AAAA;AAAA,UAGe,0BAAA;EACf,QAAA;EACA,KAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,KAGU,qBAAA,GACR,4BAAA,GACA,0BAAA;AAAA,UAEa,qBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,wBAAA;EACf,YAAA;EACA,QAAA;EACA,GAAA;EACA,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,YAAA;AAAA;AAAA,UAGe,2BAAA;EACf,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,aAAA;EACf,QAAA;EACA,UAAA;EACA,WAAA;EACA,SAAA;EACA,gBAAA;EACA,MAAA;EACA,UAAA;AAAA;AAAA,UAGe,OAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;EACA,YAAA;EACA,kBAAA;EACA,gBAAA;EACA,4BAAA;EACA,WAAA;AAAA;AAAA,UAGe,sBAAA;EACf,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,qBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,sBAAA;EACf,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,uBAAA;EACf,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,IAAA,EAAM,OAAA;AAAA;AAAA,UAGS,cAAA;EACf,IAAA;EACA,KAAA;EACA,YAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA,EAAQ,OAAA;AAAA;AAAA,UAGO,mBAAA;EACf,YAAA;EACA,QAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,UAAA;EACA,YAAA;EACA,iBAAA;EACA,UAAA;EACA,SAAA;EACA,MAAA;EACA,aAAA,EAAe,gBAAA;EACf,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,UAGO,sBAAA;EACf,OAAA;EACA,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGE,iBAAA;AAAA,UAEK,sBAAA;EACf,YAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;AAAA;AAAA,UAGK,oBAAA;EACf,YAAA;AAAA;AAAA,UAGe,SAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,MAAA,EAAQ,SAAA;AAAA;AAAA,UAGO,qBAAA;EACf,QAAA,EAAU,SAAA;AAAA;AAAA,UAGK,aAAA;EACf,EAAA;EACA,MAAA;EACA,YAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA,EAAQ,aAAA;EACR,UAAA;AAAA;AAAA,UAGe,6BAAA,SAAsC,gBAAA;EACrD,KAAA,EAAO,gBAAA;IAA8B,IAAA;EAAA;AAAA;;;KC9O3B,cAAA,SAAuB,WAAA,GAAc,OAAA,CAAQ,WAAA;AAAA,UAExC,gBAAA;EACf,OAAA;EACA,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,cAGJ,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,YAAA;EAAA,SACN,OAAA;EAAA,SACA,MAAA;cAEG,KAAA,EAAO,YAAA,EAAc,OAAA;IAAW,MAAA;EAAA;AAAA;AAAA,cASjC,SAAA;EAAA,SACF,OAAA;EAAA,SACA,KAAA,SAAc,KAAA;EAAA,SACd,MAAA;EAAA,SACA,WAAA,GAAc,cAAA;EAAA,SACd,WAAA,EAAa,oBAAA;EAAA,SACb,WAAA,EAAa,oBAAA;EAAA,SACb,MAAA,EAAQ,eAAA;EAAA,SACR,KAAA,EAAO,cAAA;cAEJ,OAAA,EAAS,gBAAA;EAef,MAAA,CAAA,GAAU,OAAA,CAAQ,iBAAA;EAAA,QAIV,OAAA;EAAA,QAiBA,YAAA;AAAA;AAAA,UAsBC,mBAAA;EACf,cAAA;AAAA;AAAA,cAGW,eAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA;IACT,UAAA;IACA,YAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,oBAAA;EAQN,IAAA,CACJ,OAAA,GAAS,mBAAA,GACR,OAAA,CAAQ,qBAAA;EAuBL,MAAA,CAAO,OAAA,WAAkB,OAAA,CAAQ,sBAAA;AAAA;AAAA,cAY5B,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,YAAA,WAAuB,OAAA,CAAQ,qBAAA;EAOpC,GAAA,CAAI,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,iBAAA;AAAA;AAAA,UASnC,oBAAA;EACf,QAAA;AAAA;AAAA,UAGe,oBAAA;EACf,YAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,MAAA,CACJ,KAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,sBAAA;EAQL,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,wBAAA;EAQhC,MAAA,mBAAA,CACJ,IAAA,UACA,KAAA,WACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,eAAA,CAAgB,OAAA;EAAA,QAgCnB,aAAA;AAAA;AAAA,cAiBG,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,sBAAA;EAMhB,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;AAAA;;;iBCpS9B,cAAA,CAAe,KAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/client.ts","../src/redaction.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,OAAA;EACA,IAAA,EAAM,KAAA;AAAA;AAAA,UAGS,gBAAA;EACf,OAAA;EACA,KAAA,EAAO,YAAA;AAAA;AAAA,KAGG,WAAA,UAAqB,kBAAA,CAAmB,KAAA,IAAS,gBAAA;AAAA,UAE5C,YAAA;EACf,IAAA,EAAM,YAAA;EACN,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,YAAA;AAAA,UAoBK,iBAAA;EACf,QAAA;EACA,SAAA,EAAW,YAAA;EACX,WAAA,EAAa,oBAAA;AAAA;AAAA,UAGE,YAAA;EACf,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,QAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,oBAAA;EACf,sBAAA;EACA,sBAAA;AAAA;AAAA,UAGe,aAAA;EACf,EAAA;EACA,UAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,sBAAA;EACf,WAAA,EAAa,aAAA;AAAA;AAAA,UAGE,oBAAA;EACf,QAAA;EACA,SAAA;EACA,GAAA;AAAA;AAAA,UAGe,4BAAA;EACf,QAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;AAAA;AAAA,UAGe,0BAAA;EACf,QAAA;EACA,KAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,KAGU,qBAAA,GACR,4BAAA,GACA,0BAAA;AAAA,UAEa,qBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,wBAAA;EACf,YAAA;EACA,QAAA;EACA,GAAA;EACA,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,YAAA;AAAA;AAAA,UAGe,2BAAA;EACf,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,0BAAA;EACf,YAAA;AAAA;AAAA,KAGU,yBAAA;AAAA,UAMK,wBAAA;EACf,IAAA;EACA,OAAA;AAAA;AAAA,UAGe,uBAAA;EACf,MAAA,EAAQ,yBAAA;EACR,SAAA;EACA,KAAA,GAAQ,wBAAA;AAAA;AAAA,UAGO,2BAAA;EACf,UAAA,EAAY,aAAA;EACZ,MAAA,EAAQ,uBAAA;AAAA;AAAA,UAGO,aAAA;EACf,QAAA;EACA,UAAA;EACA,WAAA;EACA,SAAA;EACA,gBAAA;EACA,MAAA;EACA,UAAA;AAAA;AAAA,UAGe,OAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;EACA,YAAA;EACA,kBAAA;EACA,gBAAA;EACA,4BAAA;EACA,WAAA;AAAA;AAAA,UAGe,sBAAA;EACf,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,qBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,sBAAA;EACf,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,uBAAA;EACf,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,IAAA,EAAM,OAAA;AAAA;AAAA,UAGS,cAAA;EACf,IAAA;EACA,KAAA;EACA,YAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA,EAAQ,OAAA;AAAA;AAAA,UAGO,mBAAA;EACf,YAAA;EACA,QAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,UAAA;EACA,YAAA;EACA,iBAAA;EACA,UAAA;EACA,SAAA;EACA,MAAA;EACA,aAAA,EAAe,gBAAA;EACf,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,UAGO,sBAAA;EACf,OAAA;EACA,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGE,iBAAA;AAAA,UAEK,sBAAA;EACf,YAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;AAAA;AAAA,UAGK,oBAAA;EACf,YAAA;AAAA;AAAA,UAGe,SAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,MAAA,EAAQ,SAAA;AAAA;AAAA,UAGO,qBAAA;EACf,QAAA,EAAU,SAAA;AAAA;AAAA,KAGA,iBAAA;AAAA,UAOK,WAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,SAAA;EACA,kBAAA,EAAoB,MAAA;EACpB,MAAA,EAAQ,iBAAA;EACR,WAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,0BAAA;EACf,OAAA;EACA,KAAA;EACA,SAAA;AAAA;AAAA,UAGe,2BAAA;EACf,QAAA,EAAU,WAAA;EACV,eAAA,GAAkB,0BAAA;AAAA;AAAA,UAGH,uBAAA;EACf,SAAA,EAAW,WAAA;AAAA;AAAA,UAGI,aAAA;EACf,EAAA;EACA,MAAA;EACA,YAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,QAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA,EAAQ,aAAA;EACR,UAAA;AAAA;AAAA,UAGe,6BAAA,SAAsC,gBAAA;EACrD,KAAA,EAAO,gBAAA;IAA8B,IAAA;EAAA;AAAA;AAAA,UAetB,wCAAA;EA5Jf;EA8JA,OAAA;EA3Je;EA6Jf,cAAA;;;;AAzJF;;EA+JE,WAAA,GAAc,MAAA;EA/Je;EAiK7B,UAAA;AAAA;AAAA,UAGe,yCAAA;EACf,KAAA;EACA,SAAA;EACA,cAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,cAAA;EAtKQ;EAwKR,YAAA;EACA,WAAA;EAtKe;EAwKf,mBAAA;;EAEA,aAAA;EACA,SAAA;AAAA;AAAA,UAGe,gCAAA;EACf,YAAA,EAAc,wBAAA;AAAA;AAAA,UAGC,6BAAA;EACf,cAAA;EA5KmC;EA8KnC,aAAA;AAAA;AAAA,UAGe,kCAAA;EACf,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,mCAAA;EACf,SAAA;EACA,cAAA;AAAA;;;KC7WU,cAAA,SAAuB,WAAA,GAAc,OAAA,CAAQ,WAAA;AAAA,UAExC,gBAAA;EACf,OAAA;EACA,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,cAGJ,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,YAAA;EAAA,SACN,OAAA;EAAA,SACA,MAAA;cAEG,KAAA,EAAO,YAAA,EAAc,OAAA;IAAW,MAAA;EAAA;AAAA;AAAA,cAYjC,eAAA;AAAA,cACA,mBAAA;AAAA,cACA,4BAAA;AAAA,KAGD,MAAA,GAAS,MAAA;AAAA,UAEJ,uBAAA;EACf,GAAA,GAAM,MAAA;EACN,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,iBAOD,iBAAA,CAAkB,GAAA,GAAK,MAAA;AAAA,iBA2BvB,cAAA,CAAe,GAAA,GAAK,MAAA;AAAA,cAyCvB,SAAA;EAAA,SACF,OAAA;EAAA,SACA,KAAA,SAAc,KAAA;EAAA,SACd,MAAA;EAAA,SACA,WAAA,GAAc,cAAA;EAAA,SACd,WAAA,EAAa,oBAAA;EAAA,SACb,WAAA,EAAa,oBAAA;EAAA,SACb,MAAA,EAAQ,eAAA;EAAA,SACR,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;EAAA,SACX,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;cAER,OAAA,EAAS,gBAAA;EAAA,OA4Bd,OAAA,CAAQ,OAAA,GAAS,uBAAA,GAA+B,SAAA;EAajD,MAAA,CAAA,GAAU,OAAA,CAAQ,iBAAA;EAAA,QAIV,OAAA;EAAA,QAiBA,YAAA;AAAA;AAAA,UAsBC,mBAAA;EACf,cAAA;AAAA;AAAA,cAGW,eAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA;IACT,UAAA;IACA,YAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,oBAAA;EAQN,IAAA,CACJ,OAAA,GAAS,mBAAA,GACR,OAAA,CAAQ,qBAAA;EAuBL,MAAA,CAAO,OAAA,WAAkB,OAAA,CAAQ,sBAAA;AAAA;AAAA,cAY5B,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,YAAA,WAAuB,OAAA,CAAQ,qBAAA;EAOpC,GAAA,CAAI,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,iBAAA;AAAA;AAAA,UASnC,oBAAA;EACf,QAAA;AAAA;AAAA,UAGe,oBAAA;EACf,YAAA;EACA,OAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,MAAA,CACJ,KAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,sBAAA;EAQL,OAAA,CAAA,GAAW,OAAA,CAAQ,sBAAA;EAMnB,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,wBAAA;EAQhC,MAAA,mBAAA,CACJ,IAAA,UACA,KAAA,WACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,eAAA,CAAgB,OAAA;EAAA,QAuDnB,aAAA;AAAA;AAAA,UAuDO,yBAAA;EACf,SAAA;EACA,GAAA;AAAA;AAAA,cAGW,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,sBAAA;EAMhB,KAAA,CACJ,QAAA,UACA,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,qBAAA;EAcL,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;EAOtC,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAQjC,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,uBAAA;EAMhB,OAAA,CAAQ,UAAA,WAAqB,OAAA,CAAQ,2BAAA;EAOrC,IAAA,CAAK,UAAA,WAAqB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAa7B,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,qBAAA,CACJ,KAAA,EAAO,wCAAA,GACN,OAAA,CAAQ,yCAAA;EAWL,eAAA,CACJ,cAAA,WACC,OAAA,CAAQ,gCAAA;EAOL,SAAA,CACJ,cAAA,WACC,OAAA,CAAQ,6BAAA;EAOL,eAAA,CAAgB,KAAA;IACpB,KAAA;IACA,IAAA;EAAA,IACE,OAAA,CAAQ,mCAAA;AAAA;AAAA,cAYD,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA,GAAS,mBAAA,GAA2B,OAAA,CAAQ,gBAAA;AAAA;;;iBC/mBzC,cAAA,CAAe,KAAA"}

package/dist/index.js

@@ -21,7 +21,51 @@ var HubSdkError = class extends Error {
 		this.status = options.status;
 	}
 };
-var HubClient = class {
+const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
+const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
+const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
+function resolveHubBaseUrl(env = readProcessEnv()) {
+	const raw = env[HUB_URL_ENV_VAR];
+	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `${HUB_URL_ENV_VAR} is required`,
+		details: { envVar: HUB_URL_ENV_VAR }
+	});
+	const trimmed = raw.trim();
+	try {
+		new URL(trimmed);
+	} catch {
+		throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
+			details: { envVar: HUB_URL_ENV_VAR }
+		});
+	}
+	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
+}
+function resolveHubAuth(env = readProcessEnv()) {
+	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
+	if (present.length === 0) throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	if (present.length > 1) throw new HubSdkError({
+		code: "HUB_CONFIG_INVALID",
+		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	return present[0];
+}
+function nonEmpty(value) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+function readProcessEnv() {
+	return globalThis.process?.env ?? {};
+}
+var HubClient = class HubClient {
 	baseUrl;
 	fetch;
 	apiKey;
@@ -30,6 +74,9 @@ var HubClient = class {
 	permissions;
 	tokens;
 	tools;
+	approvals;
+	audit;
+	githubApp;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
 		this.apiKey = options.apiKey;
@@ -39,6 +86,18 @@ var HubClient = class {
 		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
 		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
 		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
+		this.audit = new HubAuditClient((path, init) => this.request(path, init));
+		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
+	}
+	static fromEnv(options = {}) {
+		const env = options.env ?? readProcessEnv();
+		return new HubClient({
+			baseUrl: resolveHubBaseUrl(env),
+			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
+			authHeaders: options.authHeaders,
+			fetch: options.fetch
+		});
 	}
 	async status() {
 		return this.request("/v1/hub/status", { method: "GET" });
@@ -125,6 +184,9 @@ var HubToolsClient = class {
 			headers: { "Content-Type": "application/json" }
 		});
 	}
+	async sources() {
+		return this.request("/v1/hub/tools/sources", { method: "GET" });
+	}
 	async describe(path) {
 		return this.request("/v1/hub/tools/describe", {
 			method: "POST",
@@ -138,6 +200,24 @@ var HubToolsClient = class {
 			return await this.request("/v1/hub/exec", execInit);
 		} catch (error) {
 			if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) throw error;
+			if (options.approve) {
+				const approvalId = getApprovalId(error);
+				if (!approvalId) throw error;
+				const approved = await this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+				validateApprovedExecution(approved, path, options.connectionId);
+				if (!approved.capabilityToken?.token) throw new HubSdkError({
+					code: "HUB_CONFIG_MISSING",
+					message: "Hub approval did not return a capability token",
+					details: { approvalId }
+				});
+				return this.request("/v1/hub/exec", {
+					...execInit,
+					headers: {
+						"Content-Type": "application/json",
+						Authorization: `Bearer ${approved.capabilityToken.token}`
+					}
+				});
+			}
 		}
 		const minted = await this.request("/v1/hub/tokens", {
 			method: "POST",
@@ -171,6 +251,30 @@ var HubToolsClient = class {
 function requiresCapabilityToken(error) {
 	return error.code === "HUB_APPROVAL_REQUIRED";
 }
+function getApprovalId(error) {
+	const id = error.details?.approval?.id;
+	return typeof id === "string" ? id : void 0;
+}
+function validateApprovedExecution(approved, path, connectionId) {
+	if (approved.approval.actionPath !== path) throw new HubSdkError({
+		code: "HUB_POLICY_DENIED",
+		message: "Hub approval action does not match requested execution",
+		details: {
+			approvalId: approved.approval.id,
+			expectedActionPath: path,
+			approvalActionPath: approved.approval.actionPath
+		}
+	});
+	if (connectionId !== void 0 && approved.approval.connectionId !== connectionId) throw new HubSdkError({
+		code: "HUB_POLICY_DENIED",
+		message: "Hub approval connection does not match requested execution",
+		details: {
+			approvalId: approved.approval.id,
+			expectedConnectionId: connectionId,
+			approvalConnectionId: approved.approval.connectionId
+		}
+	});
+}
 var HubConnectionsClient = class {
 	constructor(request) {
 		this.request = request;
@@ -178,11 +282,80 @@ var HubConnectionsClient = class {
 	async list() {
 		return this.request("/v1/hub/connections", { method: "GET" });
 	}
+	async start(provider, options = {}) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, {
+			method: "POST",
+			body: JSON.stringify({
+				returnUrl: options.returnUrl,
+				cli: options.cli
+			}),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
 	async revoke(connectionId) {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
 	}
+	async health(connectionId) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
+	}
+};
+var HubApprovalsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/approvals", { method: "GET" });
+	}
+	async approve(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	}
+	async deny(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	}
+};
+var HubGithubAppClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async mintInstallationToken(input) {
+		return this.request("/v1/hub/github-app/mint-installation-token", {
+			method: "POST",
+			body: JSON.stringify(input),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async getInstallation(installationId) {
+		return this.request(`/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}`, { method: "GET" });
+	}
+	async listRepos(installationId) {
+		return this.request(`/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/repos`, { method: "GET" });
+	}
+	async isRepoInstalled(input) {
+		const params = new URLSearchParams({
+			owner: input.owner,
+			repo: input.repo
+		});
+		return this.request(`/v1/hub/github-app/is-repo-installed?${params.toString()}`, { method: "GET" });
+	}
+};
+var HubAuditClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list(options = {}) {
+		const searchParams = new URLSearchParams();
+		if (options.provider !== void 0) searchParams.set("provider", options.provider);
+		if (options.action !== void 0) searchParams.set("action", options.action);
+		if (options.status !== void 0) searchParams.set("status", options.status);
+		if (options.since !== void 0) searchParams.set("since", options.since);
+		if (options.until !== void 0) searchParams.set("until", options.until);
+		if (options.cursor !== void 0) searchParams.set("cursor", options.cursor);
+		if (options.limit !== void 0) searchParams.set("limit", String(options.limit));
+		const query = searchParams.toString();
+		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
+	}
 };
 //#endregion
-export { HubClient, HubConnectionsClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, redactHubValue };
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubApprovalsClient, HubAuditClient, HubClient, HubConnectionsClient, HubGithubAppClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, redactHubValue, resolveHubAuth, resolveHubBaseUrl };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts","../src/client.ts"],"sourcesContent":["const SECRET_KEY_PATTERN =\n  /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;\nconst SECRET_VALUE_PATTERN =\n  /\\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\\b/g;\n\nexport function redactHubValue(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    return value.replace(SECRET_VALUE_PATTERN, \"[REDACTED]\");\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactHubValue(item));\n  }\n\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entryValue]) => [\n        key,\n        SECRET_KEY_PATTERN.test(key)\n          ? \"[REDACTED]\"\n          : redactHubValue(entryValue),\n      ]),\n    );\n  }\n\n  return value;\n}\n","import { redactHubValue } from \"./redaction.js\";\nimport type {\n  HubConnectionDeleteResponse,\n  HubConnectionsResponse,\n  HubEnvelope,\n  HubErrorBody,\n  HubExecResponse,\n  HubPolicyListResponse,\n  HubPolicyResponse,\n  HubPolicyUpdateRequest,\n  HubStatusResponse,\n  HubTokenMintResponse,\n  HubTokenRevokeResponse,\n  HubTokensListResponse,\n  HubToolsDescribeResponse,\n  HubToolsSearchResponse,\n} from \"./types.js\";\n\nexport type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;\n\nexport interface HubClientOptions {\n  baseUrl: string;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\nexport class HubSdkError extends Error {\n  readonly code: HubErrorBody[\"code\"];\n  readonly details?: unknown;\n  readonly status?: number;\n\n  constructor(error: HubErrorBody, options: { status?: number } = {}) {\n    super(String(redactHubValue(error.message)));\n    this.name = \"HubSdkError\";\n    this.code = error.code;\n    this.details = redactHubValue(error.details);\n    this.status = options.status;\n  }\n}\n\nexport class HubClient {\n  readonly baseUrl: string;\n  readonly fetch: typeof fetch;\n  readonly apiKey?: string;\n  readonly authHeaders?: HubAuthHeaders;\n  readonly connections: HubConnectionsClient;\n  readonly permissions: HubPermissionsClient;\n  readonly tokens: HubTokensClient;\n  readonly tools: HubToolsClient;\n\n  constructor(options: HubClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = options.apiKey;\n    this.authHeaders = options.authHeaders;\n    this.fetch = options.fetch ?? fetch;\n    this.connections = new HubConnectionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.permissions = new HubPermissionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.tokens = new HubTokensClient((path, init) => this.request(path, init));\n    this.tools = new HubToolsClient((path, init) => this.request(path, init));\n  }\n\n  async status(): Promise<HubStatusResponse> {\n    return this.request<HubStatusResponse>(\"/v1/hub/status\", { method: \"GET\" });\n  }\n\n  private async request<TData>(\n    path: string,\n    init: RequestInit,\n  ): Promise<TData> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n    const envelope = (await response.json()) as HubEnvelope<TData>;\n\n    if (!envelope.success) {\n      throw new HubSdkError(envelope.error, { status: response.status });\n    }\n\n    return envelope.data;\n  }\n\n  private async buildHeaders(headers: HeadersInit | undefined) {\n    const mergedHeaders = new Headers(headers);\n    mergedHeaders.set(\"Accept\", \"application/json\");\n\n    if (this.apiKey) {\n      mergedHeaders.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    }\n\n    if (this.authHeaders) {\n      for (const [key, value] of new Headers(await this.authHeaders())) {\n        mergedHeaders.set(key, value);\n      }\n    }\n\n    for (const [key, value] of new Headers(headers)) {\n      mergedHeaders.set(key, value);\n    }\n\n    return mergedHeaders;\n  }\n}\n\nexport interface HubTokenListOptions {\n  includeExpired?: boolean;\n}\n\nexport class HubTokensClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mint(options: {\n    actionPath: string;\n    connectionId?: string;\n    provider?: string;\n    ttlSeconds?: number;\n  }): Promise<HubTokenMintResponse> {\n    return this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify(options),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async list(\n    options: HubTokenListOptions = {},\n  ): Promise<HubTokensListResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.includeExpired) searchParams.set(\"includeExpired\", \"true\");\n    const query = searchParams.toString();\n    const response = await this.request<HubTokensListResponse>(\n      `/v1/hub/tokens${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n    return {\n      tokens: response.tokens.map((token) => ({\n        id: token.id,\n        providerId: token.providerId,\n        connectionId: token.connectionId,\n        connectionDisplay: token.connectionDisplay,\n        actionPath: token.actionPath,\n        expiresAt: token.expiresAt,\n        status: token.status,\n        principalKind: token.principalKind,\n        createdAt: token.createdAt,\n      })),\n    };\n  }\n\n  async revoke(tokenId: string): Promise<HubTokenRevokeResponse> {\n    const response = await this.request<HubTokenRevokeResponse>(\n      `/v1/hub/tokens/${encodeURIComponent(tokenId)}`,\n      { method: \"DELETE\" },\n    );\n    return {\n      tokenId: response.tokenId,\n      status: response.status,\n    };\n  }\n}\n\nexport class HubPermissionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(connectionId: string): Promise<HubPolicyListResponse> {\n    return this.request<HubPolicyListResponse>(\n      `/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse> {\n    return this.request<HubPolicyResponse>(\"/v1/hub/policies\", {\n      method: \"PUT\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n}\n\nexport interface HubToolSearchOptions {\n  provider?: string;\n}\n\nexport interface HubToolInvokeOptions {\n  connectionId?: string;\n}\n\nexport class HubToolsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async search(\n    query: string,\n    options: HubToolSearchOptions = {},\n  ): Promise<HubToolsSearchResponse> {\n    return this.request<HubToolsSearchResponse>(\"/v1/hub/tools/search\", {\n      method: \"POST\",\n      body: JSON.stringify({ query, provider: options.provider }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async describe(path: string): Promise<HubToolsDescribeResponse> {\n    return this.request<HubToolsDescribeResponse>(\"/v1/hub/tools/describe\", {\n      method: \"POST\",\n      body: JSON.stringify({ path }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async invoke<TResult = unknown>(\n    path: string,\n    input: unknown,\n    options: HubToolInvokeOptions = {},\n  ): Promise<HubExecResponse<TResult>> {\n    const execInit = this.buildExecInit(path, input, options.connectionId);\n    try {\n      return await this.request<HubExecResponse<TResult>>(\n        \"/v1/hub/exec\",\n        execInit,\n      );\n    } catch (error) {\n      if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) {\n        throw error;\n      }\n    }\n\n    const minted = await this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        actionPath: path,\n        connectionId: options.connectionId,\n        provider: options.connectionId ? undefined : path.split(\".\")[0],\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n\n    return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n      ...execInit,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${minted.token}`,\n      },\n    });\n  }\n\n  private buildExecInit(\n    path: string,\n    input: unknown,\n    connectionId: string | undefined,\n  ): RequestInit {\n    return {\n      method: \"POST\",\n      body: JSON.stringify({ path, input, connectionId }),\n      headers: { \"Content-Type\": \"application/json\" },\n    };\n  }\n}\n\nfunction requiresCapabilityToken(error: HubSdkError): boolean {\n  return error.code === \"HUB_APPROVAL_REQUIRED\";\n}\n\nexport class HubConnectionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubConnectionsResponse> {\n    return this.request<HubConnectionsResponse>(\"/v1/hub/connections\", {\n      method: \"GET\",\n    });\n  }\n\n  async revoke(connectionId: string): Promise<HubConnectionDeleteResponse> {\n    return this.request<HubConnectionDeleteResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n}\n"],"mappings":";AAAA,MAAM,qBACJ;AACF,MAAM,uBACJ;AAEF,SAAgB,eAAe,OAAyB;AACtD,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,QAAQ,sBAAsB,aAAa;AAG1D,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,KAAK,CAAC;AAGlD,KAAI,SAAS,OAAO,UAAU,SAC5B,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAC/C,KACA,mBAAmB,KAAK,IAAI,GACxB,eACA,eAAe,WAAW,CAC/B,CAAC,CACH;AAGH,QAAO;;;;ACET,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YAAY,OAAqB,UAA+B,EAAE,EAAE;AAClE,QAAM,OAAO,eAAe,MAAM,QAAQ,CAAC,CAAC;AAC5C,OAAK,OAAO;AACZ,OAAK,OAAO,MAAM;AAClB,OAAK,UAAU,eAAe,MAAM,QAAQ;AAC5C,OAAK,SAAS,QAAQ;;;AAI1B,IAAa,YAAb,MAAuB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA2B;AACrC,OAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,SAAS,QAAQ;AACtB,OAAK,cAAc,QAAQ;AAC3B,OAAK,QAAQ,QAAQ,SAAS;AAC9B,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,SAAS,IAAI,iBAAiB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC3E,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;;CAG3E,MAAM,SAAqC;AACzC,SAAO,KAAK,QAA2B,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;CAG7E,MAAc,QACZ,MACA,MACgB;EAChB,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EACF,MAAM,WAAY,MAAM,SAAS,MAAM;AAEvC,MAAI,CAAC,SAAS,QACZ,OAAM,IAAI,YAAY,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,CAAC;AAGpE,SAAO,SAAS;;CAGlB,MAAc,aAAa,SAAkC;EAC3D,MAAM,gBAAgB,IAAI,QAAQ,QAAQ;AAC1C,gBAAc,IAAI,UAAU,mBAAmB;AAE/C,MAAI,KAAK,OACP,eAAc,IAAI,iBAAiB,UAAU,KAAK,SAAS;AAG7D,MAAI,KAAK,YACP,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,MAAM,KAAK,aAAa,CAAC,CAC9D,eAAc,IAAI,KAAK,MAAM;AAIjC,OAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,QAAQ,CAC7C,eAAc,IAAI,KAAK,MAAM;AAG/B,SAAO;;;AAQX,IAAa,kBAAb,MAA6B;CAC3B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,SAKuB;AAChC,SAAO,KAAK,QAA8B,kBAAkB;GAC1D,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ;GAC7B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,KACJ,UAA+B,EAAE,EACD;EAChC,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,eAAgB,cAAa,IAAI,kBAAkB,OAAO;EACtE,MAAM,QAAQ,aAAa,UAAU;AAKrC,SAAO,EACL,SAAQ,MALa,KAAK,QAC1B,iBAAiB,QAAQ,IAAI,UAAU,MACvC,EAAE,QAAQ,OAAO,CAClB,EAEkB,OAAO,KAAK,WAAW;GACtC,IAAI,MAAM;GACV,YAAY,MAAM;GAClB,cAAc,MAAM;GACpB,mBAAmB,MAAM;GACzB,YAAY,MAAM;GAClB,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,eAAe,MAAM;GACrB,WAAW,MAAM;GAClB,EAAE,EACJ;;CAGH,MAAM,OAAO,SAAkD;EAC7D,MAAM,WAAW,MAAM,KAAK,QAC1B,kBAAkB,mBAAmB,QAAQ,IAC7C,EAAE,QAAQ,UAAU,CACrB;AACD,SAAO;GACL,SAAS,SAAS;GAClB,QAAQ,SAAS;GAClB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,cAAsD;AAC/D,SAAO,KAAK,QACV,iCAAiC,mBAAmB,aAAa,IACjE,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,IAAI,OAA2D;AACnE,SAAO,KAAK,QAA2B,oBAAoB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;AAYN,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OACJ,OACA,UAAgC,EAAE,EACD;AACjC,SAAO,KAAK,QAAgC,wBAAwB;GAClE,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAO,UAAU,QAAQ;IAAU,CAAC;GAC3D,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,SAAS,MAAiD;AAC9D,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OACJ,MACA,OACA,UAAgC,EAAE,EACC;EACnC,MAAM,WAAW,KAAK,cAAc,MAAM,OAAO,QAAQ,aAAa;AACtE,MAAI;AACF,UAAO,MAAM,KAAK,QAChB,gBACA,SACD;WACM,OAAO;AACd,OAAI,EAAE,iBAAiB,gBAAgB,CAAC,wBAAwB,MAAM,CACpE,OAAM;;EAIV,MAAM,SAAS,MAAM,KAAK,QAA8B,kBAAkB;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,cAAc,QAAQ;IACtB,UAAU,QAAQ,eAAe,KAAA,IAAY,KAAK,MAAM,IAAI,CAAC;IAC9D,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;AAEF,SAAO,KAAK,QAAkC,gBAAgB;GAC5D,GAAG;GACH,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,OAAO;IACjC;GACF,CAAC;;CAGJ,cACE,MACA,OACA,cACa;AACb,SAAO;GACL,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAM;IAAO;IAAc,CAAC;GACnD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD;;;AAIL,SAAS,wBAAwB,OAA6B;AAC5D,QAAO,MAAM,SAAS;;AAGxB,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAwC;AAC5C,SAAO,KAAK,QAAgC,uBAAuB,EACjE,QAAQ,OACT,CAAC;;CAGJ,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,IACvD,EAAE,QAAQ,UAAU,CACrB"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts","../src/client.ts"],"sourcesContent":["const SECRET_KEY_PATTERN =\n  /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;\nconst SECRET_VALUE_PATTERN =\n  /\\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\\b/g;\n\nexport function redactHubValue(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    return value.replace(SECRET_VALUE_PATTERN, \"[REDACTED]\");\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactHubValue(item));\n  }\n\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entryValue]) => [\n        key,\n        SECRET_KEY_PATTERN.test(key)\n          ? \"[REDACTED]\"\n          : redactHubValue(entryValue),\n      ]),\n    );\n  }\n\n  return value;\n}\n","import { redactHubValue } from \"./redaction.js\";\nimport type {\n  HubApprovalDecisionResponse,\n  HubApprovalListResponse,\n  HubAuditListRequest,\n  HubAuditResponse,\n  HubConnectionDeleteResponse,\n  HubConnectionHealthResponse,\n  HubConnectionsResponse,\n  HubEnvelope,\n  HubErrorBody,\n  HubExecResponse,\n  HubGithubAppInstallationResponse,\n  HubGithubAppIsRepoInstalledResponse,\n  HubGithubAppListReposResponse,\n  HubGithubAppMintInstallationTokenRequest,\n  HubGithubAppMintInstallationTokenResponse,\n  HubOAuthStartResponse,\n  HubPolicyListResponse,\n  HubPolicyResponse,\n  HubPolicyUpdateRequest,\n  HubStatusResponse,\n  HubTokenMintResponse,\n  HubTokenRevokeResponse,\n  HubTokensListResponse,\n  HubToolSourcesResponse,\n  HubToolsDescribeResponse,\n  HubToolsSearchResponse,\n} from \"./types.js\";\n\nexport type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;\n\nexport interface HubClientOptions {\n  baseUrl: string;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\nexport class HubSdkError extends Error {\n  readonly code: HubErrorBody[\"code\"];\n  readonly details?: unknown;\n  readonly status?: number;\n\n  constructor(error: HubErrorBody, options: { status?: number } = {}) {\n    super(String(redactHubValue(error.message)));\n    this.name = \"HubSdkError\";\n    this.code = error.code;\n    this.details = redactHubValue(error.details);\n    this.status = options.status;\n  }\n}\n\n// Wire-contract env var names. Mirrored from\n// products/platform/api/src/lib/hub-sandbox-contract.ts where the same\n// literals are pinned by `z.literal(...)`. Any drift here is a contract break.\nexport const HUB_URL_ENV_VAR = \"TANGLE_HUB_URL\" as const;\nexport const HUB_API_KEY_ENV_VAR = \"TANGLE_API_KEY\" as const;\nexport const HUB_CAPABILITY_TOKEN_ENV_VAR =\n  \"TANGLE_HUB_CAPABILITY_TOKEN\" as const;\n\nexport type HubEnv = Record<string, string | undefined>;\n\nexport interface HubClientFromEnvOptions {\n  env?: HubEnv;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\n// Read TANGLE_HUB_URL from env. Strips trailing slashes and the optional\n// `/v1/hub` suffix so the result is the platform root the SDK appends\n// `/v1/hub/...` to. No default — throws HubSdkError on undefined / empty /\n// non-URL. SaaS vs on-prem flips via env only.\nexport function resolveHubBaseUrl(env: HubEnv = readProcessEnv()): string {\n  const raw = env[HUB_URL_ENV_VAR];\n  if (raw === undefined || raw.trim() === \"\") {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `${HUB_URL_ENV_VAR} is required`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  const trimmed = raw.trim();\n  try {\n    new URL(trimmed);\n  } catch {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `${HUB_URL_ENV_VAR} is not a valid URL`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  return trimmed.replace(/\\/+$/, \"\").replace(/\\/v1\\/hub$/, \"\");\n}\n\n// Read exactly one Hub auth credential. Mirrors the\n// `exactly-one-api-key-or-capability-token` rule on the platform-api\n// hubSandboxEnvironmentSchema superRefine. No default; throws on none-or-both.\nexport function resolveHubAuth(env: HubEnv = readProcessEnv()): string {\n  const apiKey = nonEmpty(env[HUB_API_KEY_ENV_VAR]);\n  const capabilityToken = nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR]);\n  const present = [apiKey, capabilityToken].filter(\n    (value): value is string => value !== undefined,\n  );\n\n  if (present.length === 0) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n  if (present.length > 1) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n\n  return present[0];\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  const trimmed = value.trim();\n  return trimmed.length === 0 ? undefined : trimmed;\n}\n\nfunction readProcessEnv(): HubEnv {\n  // Browsers / Workers may not expose `process`. Callers there must pass `env`.\n  const proc = (globalThis as { process?: { env?: HubEnv } }).process;\n  return proc?.env ?? {};\n}\n\nexport class HubClient {\n  readonly baseUrl: string;\n  readonly fetch: typeof fetch;\n  readonly apiKey?: string;\n  readonly authHeaders?: HubAuthHeaders;\n  readonly connections: HubConnectionsClient;\n  readonly permissions: HubPermissionsClient;\n  readonly tokens: HubTokensClient;\n  readonly tools: HubToolsClient;\n  readonly approvals: HubApprovalsClient;\n  readonly audit: HubAuditClient;\n  readonly githubApp: HubGithubAppClient;\n\n  constructor(options: HubClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = options.apiKey;\n    this.authHeaders = options.authHeaders;\n    this.fetch = options.fetch ?? fetch;\n    this.connections = new HubConnectionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.permissions = new HubPermissionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.tokens = new HubTokensClient((path, init) => this.request(path, init));\n    this.tools = new HubToolsClient((path, init) => this.request(path, init));\n    this.approvals = new HubApprovalsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.audit = new HubAuditClient((path, init) => this.request(path, init));\n    this.githubApp = new HubGithubAppClient((path, init) =>\n      this.request(path, init),\n    );\n  }\n\n  // Static factory: construct a HubClient from environment variables.\n  // Required: TANGLE_HUB_URL. Auth: exactly one of TANGLE_API_KEY or\n  // TANGLE_HUB_CAPABILITY_TOKEN (skip the env auth resolve by passing\n  // `apiKey` / `authHeaders` explicitly). No fallback — throws HubSdkError\n  // with HUB_CONFIG_MISSING / HUB_CONFIG_INVALID when env is incomplete.\n  // SaaS vs on-prem flips via env only.\n  static fromEnv(options: HubClientFromEnvOptions = {}): HubClient {\n    const env = options.env ?? readProcessEnv();\n    const baseUrl = resolveHubBaseUrl(env);\n    const apiKey =\n      options.apiKey ?? (options.authHeaders ? undefined : resolveHubAuth(env));\n    return new HubClient({\n      baseUrl,\n      apiKey,\n      authHeaders: options.authHeaders,\n      fetch: options.fetch,\n    });\n  }\n\n  async status(): Promise<HubStatusResponse> {\n    return this.request<HubStatusResponse>(\"/v1/hub/status\", { method: \"GET\" });\n  }\n\n  private async request<TData>(\n    path: string,\n    init: RequestInit,\n  ): Promise<TData> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n    const envelope = (await response.json()) as HubEnvelope<TData>;\n\n    if (!envelope.success) {\n      throw new HubSdkError(envelope.error, { status: response.status });\n    }\n\n    return envelope.data;\n  }\n\n  private async buildHeaders(headers: HeadersInit | undefined) {\n    const mergedHeaders = new Headers(headers);\n    mergedHeaders.set(\"Accept\", \"application/json\");\n\n    if (this.apiKey) {\n      mergedHeaders.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    }\n\n    if (this.authHeaders) {\n      for (const [key, value] of new Headers(await this.authHeaders())) {\n        mergedHeaders.set(key, value);\n      }\n    }\n\n    for (const [key, value] of new Headers(headers)) {\n      mergedHeaders.set(key, value);\n    }\n\n    return mergedHeaders;\n  }\n}\n\nexport interface HubTokenListOptions {\n  includeExpired?: boolean;\n}\n\nexport class HubTokensClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mint(options: {\n    actionPath: string;\n    connectionId?: string;\n    provider?: string;\n    ttlSeconds?: number;\n  }): Promise<HubTokenMintResponse> {\n    return this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify(options),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async list(\n    options: HubTokenListOptions = {},\n  ): Promise<HubTokensListResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.includeExpired) searchParams.set(\"includeExpired\", \"true\");\n    const query = searchParams.toString();\n    const response = await this.request<HubTokensListResponse>(\n      `/v1/hub/tokens${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n    return {\n      tokens: response.tokens.map((token) => ({\n        id: token.id,\n        providerId: token.providerId,\n        connectionId: token.connectionId,\n        connectionDisplay: token.connectionDisplay,\n        actionPath: token.actionPath,\n        expiresAt: token.expiresAt,\n        status: token.status,\n        principalKind: token.principalKind,\n        createdAt: token.createdAt,\n      })),\n    };\n  }\n\n  async revoke(tokenId: string): Promise<HubTokenRevokeResponse> {\n    const response = await this.request<HubTokenRevokeResponse>(\n      `/v1/hub/tokens/${encodeURIComponent(tokenId)}`,\n      { method: \"DELETE\" },\n    );\n    return {\n      tokenId: response.tokenId,\n      status: response.status,\n    };\n  }\n}\n\nexport class HubPermissionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(connectionId: string): Promise<HubPolicyListResponse> {\n    return this.request<HubPolicyListResponse>(\n      `/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse> {\n    return this.request<HubPolicyResponse>(\"/v1/hub/policies\", {\n      method: \"PUT\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n}\n\nexport interface HubToolSearchOptions {\n  provider?: string;\n}\n\nexport interface HubToolInvokeOptions {\n  connectionId?: string;\n  approve?: boolean;\n}\n\nexport class HubToolsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async search(\n    query: string,\n    options: HubToolSearchOptions = {},\n  ): Promise<HubToolsSearchResponse> {\n    return this.request<HubToolsSearchResponse>(\"/v1/hub/tools/search\", {\n      method: \"POST\",\n      body: JSON.stringify({ query, provider: options.provider }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async sources(): Promise<HubToolSourcesResponse> {\n    return this.request<HubToolSourcesResponse>(\"/v1/hub/tools/sources\", {\n      method: \"GET\",\n    });\n  }\n\n  async describe(path: string): Promise<HubToolsDescribeResponse> {\n    return this.request<HubToolsDescribeResponse>(\"/v1/hub/tools/describe\", {\n      method: \"POST\",\n      body: JSON.stringify({ path }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async invoke<TResult = unknown>(\n    path: string,\n    input: unknown,\n    options: HubToolInvokeOptions = {},\n  ): Promise<HubExecResponse<TResult>> {\n    const execInit = this.buildExecInit(path, input, options.connectionId);\n    try {\n      return await this.request<HubExecResponse<TResult>>(\n        \"/v1/hub/exec\",\n        execInit,\n      );\n    } catch (error) {\n      if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) {\n        throw error;\n      }\n      if (options.approve) {\n        const approvalId = getApprovalId(error);\n        if (!approvalId) throw error;\n        const approved = await this.request<HubApprovalDecisionResponse>(\n          `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n          { method: \"POST\" },\n        );\n        validateApprovedExecution(approved, path, options.connectionId);\n        if (!approved.capabilityToken?.token) {\n          throw new HubSdkError({\n            code: \"HUB_CONFIG_MISSING\",\n            message: \"Hub approval did not return a capability token\",\n            details: { approvalId },\n          });\n        }\n        return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n          ...execInit,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${approved.capabilityToken.token}`,\n          },\n        });\n      }\n    }\n\n    const minted = await this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        actionPath: path,\n        connectionId: options.connectionId,\n        provider: options.connectionId ? undefined : path.split(\".\")[0],\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n\n    return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n      ...execInit,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${minted.token}`,\n      },\n    });\n  }\n\n  private buildExecInit(\n    path: string,\n    input: unknown,\n    connectionId: string | undefined,\n  ): RequestInit {\n    return {\n      method: \"POST\",\n      body: JSON.stringify({ path, input, connectionId }),\n      headers: { \"Content-Type\": \"application/json\" },\n    };\n  }\n}\n\nfunction requiresCapabilityToken(error: HubSdkError): boolean {\n  return error.code === \"HUB_APPROVAL_REQUIRED\";\n}\n\nfunction getApprovalId(error: HubSdkError): string | undefined {\n  const id = (error.details as { approval?: { id?: unknown } } | undefined)\n    ?.approval?.id;\n  return typeof id === \"string\" ? id : undefined;\n}\n\nfunction validateApprovedExecution(\n  approved: HubApprovalDecisionResponse,\n  path: string,\n  connectionId: string | undefined,\n): void {\n  if (approved.approval.actionPath !== path) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval action does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedActionPath: path,\n        approvalActionPath: approved.approval.actionPath,\n      },\n    });\n  }\n  if (\n    connectionId !== undefined &&\n    approved.approval.connectionId !== connectionId\n  ) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval connection does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedConnectionId: connectionId,\n        approvalConnectionId: approved.approval.connectionId,\n      },\n    });\n  }\n}\n\nexport interface HubConnectionStartOptions {\n  returnUrl?: string;\n  cli?: boolean;\n}\n\nexport class HubConnectionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubConnectionsResponse> {\n    return this.request<HubConnectionsResponse>(\"/v1/hub/connections\", {\n      method: \"GET\",\n    });\n  }\n\n  async start(\n    provider: string,\n    options: HubConnectionStartOptions = {},\n  ): Promise<HubOAuthStartResponse> {\n    return this.request<HubOAuthStartResponse>(\n      `/v1/hub/connections/${encodeURIComponent(provider)}/start`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({\n          returnUrl: options.returnUrl,\n          cli: options.cli,\n        }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async revoke(connectionId: string): Promise<HubConnectionDeleteResponse> {\n    return this.request<HubConnectionDeleteResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async health(connectionId: string): Promise<HubConnectionHealthResponse> {\n    return this.request<HubConnectionHealthResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`,\n      { method: \"POST\" },\n    );\n  }\n}\n\nexport class HubApprovalsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubApprovalListResponse> {\n    return this.request<HubApprovalListResponse>(\"/v1/hub/approvals\", {\n      method: \"GET\",\n    });\n  }\n\n  async approve(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n      { method: \"POST\" },\n    );\n  }\n\n  async deny(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`,\n      { method: \"POST\" },\n    );\n  }\n}\n\n// GitHub App primitive. The hub holds the App PEM + the per-tenant\n// installation grants; consumers (intelligence autonomous-improvement loop,\n// future code reviewers) ask the hub to mint a short-lived repo-scoped\n// installation token. The mint call MUST be principal-authed; the hub refuses\n// without a matching grant for the calling principal.\nexport class HubGithubAppClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mintInstallationToken(\n    input: HubGithubAppMintInstallationTokenRequest,\n  ): Promise<HubGithubAppMintInstallationTokenResponse> {\n    return this.request<HubGithubAppMintInstallationTokenResponse>(\n      \"/v1/hub/github-app/mint-installation-token\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async getInstallation(\n    installationId: number,\n  ): Promise<HubGithubAppInstallationResponse> {\n    return this.request<HubGithubAppInstallationResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async listRepos(\n    installationId: number,\n  ): Promise<HubGithubAppListReposResponse> {\n    return this.request<HubGithubAppListReposResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/repos`,\n      { method: \"GET\" },\n    );\n  }\n\n  async isRepoInstalled(input: {\n    owner: string;\n    repo: string;\n  }): Promise<HubGithubAppIsRepoInstalledResponse> {\n    const params = new URLSearchParams({\n      owner: input.owner,\n      repo: input.repo,\n    });\n    return this.request<HubGithubAppIsRepoInstalledResponse>(\n      `/v1/hub/github-app/is-repo-installed?${params.toString()}`,\n      { method: \"GET\" },\n    );\n  }\n}\n\nexport class HubAuditClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(options: HubAuditListRequest = {}): Promise<HubAuditResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.provider !== undefined)\n      searchParams.set(\"provider\", options.provider);\n    if (options.action !== undefined)\n      searchParams.set(\"action\", options.action);\n    if (options.status !== undefined)\n      searchParams.set(\"status\", options.status);\n    if (options.since !== undefined) searchParams.set(\"since\", options.since);\n    if (options.until !== undefined) searchParams.set(\"until\", options.until);\n    if (options.cursor !== undefined)\n      searchParams.set(\"cursor\", options.cursor);\n    if (options.limit !== undefined)\n      searchParams.set(\"limit\", String(options.limit));\n    const query = searchParams.toString();\n    return this.request<HubAuditResponse>(\n      `/v1/hub/audit${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n  }\n}\n"],"mappings":";AAAA,MAAM,qBACJ;AACF,MAAM,uBACJ;AAEF,SAAgB,eAAe,OAAyB;AACtD,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,QAAQ,sBAAsB,aAAa;AAG1D,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,KAAK,CAAC;AAGlD,KAAI,SAAS,OAAO,UAAU,SAC5B,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAC/C,KACA,mBAAmB,KAAK,IAAI,GACxB,eACA,eAAe,WAAW,CAC/B,CAAC,CACH;AAGH,QAAO;;;;ACcT,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YAAY,OAAqB,UAA+B,EAAE,EAAE;AAClE,QAAM,OAAO,eAAe,MAAM,QAAQ,CAAC,CAAC;AAC5C,OAAK,OAAO;AACZ,OAAK,OAAO,MAAM;AAClB,OAAK,UAAU,eAAe,MAAM,QAAQ;AAC5C,OAAK,SAAS,QAAQ;;;AAO1B,MAAa,kBAAkB;AAC/B,MAAa,sBAAsB;AACnC,MAAa,+BACX;AAeF,SAAgB,kBAAkB,MAAc,gBAAgB,EAAU;CACxE,MAAM,MAAM,IAAI;AAChB,KAAI,QAAQ,KAAA,KAAa,IAAI,MAAM,KAAK,GACtC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,GAAG,gBAAgB;EAC5B,SAAS,EAAE,QAAQ,iBAAiB;EACrC,CAAC;CAGJ,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI;AACF,MAAI,IAAI,QAAQ;SACV;AACN,QAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,GAAG,gBAAgB;GAC5B,SAAS,EAAE,QAAQ,iBAAiB;GACrC,CAAC;;AAGJ,QAAO,QAAQ,QAAQ,QAAQ,GAAG,CAAC,QAAQ,cAAc,GAAG;;AAM9D,SAAgB,eAAe,MAAc,gBAAgB,EAAU;CAGrE,MAAM,UAAU,CAFD,SAAS,IAAI,qBAEL,EADC,SAAS,IAAI,8BACG,CAAC,CAAC,QACvC,UAA2B,UAAU,KAAA,EACvC;AAED,KAAI,QAAQ,WAAW,EACrB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,UAAU,oBAAoB,MAAM,6BAA6B;EAC1E,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAEJ,KAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,sBAAsB,oBAAoB,MAAM,6BAA6B;EACtF,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAGJ,QAAO,QAAQ;;AAGjB,SAAS,SAAS,OAA+C;AAC/D,KAAI,UAAU,KAAA,EAAW,QAAO,KAAA;CAChC,MAAM,UAAU,MAAM,MAAM;AAC5B,QAAO,QAAQ,WAAW,IAAI,KAAA,IAAY;;AAG5C,SAAS,iBAAyB;AAGhC,QADc,WAA8C,SAC/C,OAAO,EAAE;;AAGxB,IAAa,YAAb,MAAa,UAAU;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA2B;AACrC,OAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,SAAS,QAAQ;AACtB,OAAK,cAAc,QAAQ;AAC3B,OAAK,QAAQ,QAAQ,SAAS;AAC9B,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,SAAS,IAAI,iBAAiB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC3E,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;;CASH,OAAO,QAAQ,UAAmC,EAAE,EAAa;EAC/D,MAAM,MAAM,QAAQ,OAAO,gBAAgB;AAI3C,SAAO,IAAI,UAAU;GACnB,SAJc,kBAAkB,IAIzB;GACP,QAHA,QAAQ,WAAW,QAAQ,cAAc,KAAA,IAAY,eAAe,IAAI;GAIxE,aAAa,QAAQ;GACrB,OAAO,QAAQ;GAChB,CAAC;;CAGJ,MAAM,SAAqC;AACzC,SAAO,KAAK,QAA2B,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;CAG7E,MAAc,QACZ,MACA,MACgB;EAChB,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EACF,MAAM,WAAY,MAAM,SAAS,MAAM;AAEvC,MAAI,CAAC,SAAS,QACZ,OAAM,IAAI,YAAY,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,CAAC;AAGpE,SAAO,SAAS;;CAGlB,MAAc,aAAa,SAAkC;EAC3D,MAAM,gBAAgB,IAAI,QAAQ,QAAQ;AAC1C,gBAAc,IAAI,UAAU,mBAAmB;AAE/C,MAAI,KAAK,OACP,eAAc,IAAI,iBAAiB,UAAU,KAAK,SAAS;AAG7D,MAAI,KAAK,YACP,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,MAAM,KAAK,aAAa,CAAC,CAC9D,eAAc,IAAI,KAAK,MAAM;AAIjC,OAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,QAAQ,CAC7C,eAAc,IAAI,KAAK,MAAM;AAG/B,SAAO;;;AAQX,IAAa,kBAAb,MAA6B;CAC3B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,SAKuB;AAChC,SAAO,KAAK,QAA8B,kBAAkB;GAC1D,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ;GAC7B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,KACJ,UAA+B,EAAE,EACD;EAChC,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,eAAgB,cAAa,IAAI,kBAAkB,OAAO;EACtE,MAAM,QAAQ,aAAa,UAAU;AAKrC,SAAO,EACL,SAAQ,MALa,KAAK,QAC1B,iBAAiB,QAAQ,IAAI,UAAU,MACvC,EAAE,QAAQ,OAAO,CAClB,EAEkB,OAAO,KAAK,WAAW;GACtC,IAAI,MAAM;GACV,YAAY,MAAM;GAClB,cAAc,MAAM;GACpB,mBAAmB,MAAM;GACzB,YAAY,MAAM;GAClB,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,eAAe,MAAM;GACrB,WAAW,MAAM;GAClB,EAAE,EACJ;;CAGH,MAAM,OAAO,SAAkD;EAC7D,MAAM,WAAW,MAAM,KAAK,QAC1B,kBAAkB,mBAAmB,QAAQ,IAC7C,EAAE,QAAQ,UAAU,CACrB;AACD,SAAO;GACL,SAAS,SAAS;GAClB,QAAQ,SAAS;GAClB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,cAAsD;AAC/D,SAAO,KAAK,QACV,iCAAiC,mBAAmB,aAAa,IACjE,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,IAAI,OAA2D;AACnE,SAAO,KAAK,QAA2B,oBAAoB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;AAaN,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OACJ,OACA,UAAgC,EAAE,EACD;AACjC,SAAO,KAAK,QAAgC,wBAAwB;GAClE,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAO,UAAU,QAAQ;IAAU,CAAC;GAC3D,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,UAA2C;AAC/C,SAAO,KAAK,QAAgC,yBAAyB,EACnE,QAAQ,OACT,CAAC;;CAGJ,MAAM,SAAS,MAAiD;AAC9D,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OACJ,MACA,OACA,UAAgC,EAAE,EACC;EACnC,MAAM,WAAW,KAAK,cAAc,MAAM,OAAO,QAAQ,aAAa;AACtE,MAAI;AACF,UAAO,MAAM,KAAK,QAChB,gBACA,SACD;WACM,OAAO;AACd,OAAI,EAAE,iBAAiB,gBAAgB,CAAC,wBAAwB,MAAM,CACpE,OAAM;AAER,OAAI,QAAQ,SAAS;IACnB,MAAM,aAAa,cAAc,MAAM;AACvC,QAAI,CAAC,WAAY,OAAM;IACvB,MAAM,WAAW,MAAM,KAAK,QAC1B,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;AACD,8BAA0B,UAAU,MAAM,QAAQ,aAAa;AAC/D,QAAI,CAAC,SAAS,iBAAiB,MAC7B,OAAM,IAAI,YAAY;KACpB,MAAM;KACN,SAAS;KACT,SAAS,EAAE,YAAY;KACxB,CAAC;AAEJ,WAAO,KAAK,QAAkC,gBAAgB;KAC5D,GAAG;KACH,SAAS;MACP,gBAAgB;MAChB,eAAe,UAAU,SAAS,gBAAgB;MACnD;KACF,CAAC;;;EAIN,MAAM,SAAS,MAAM,KAAK,QAA8B,kBAAkB;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,cAAc,QAAQ;IACtB,UAAU,QAAQ,eAAe,KAAA,IAAY,KAAK,MAAM,IAAI,CAAC;IAC9D,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;AAEF,SAAO,KAAK,QAAkC,gBAAgB;GAC5D,GAAG;GACH,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,OAAO;IACjC;GACF,CAAC;;CAGJ,cACE,MACA,OACA,cACa;AACb,SAAO;GACL,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAM;IAAO;IAAc,CAAC;GACnD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD;;;AAIL,SAAS,wBAAwB,OAA6B;AAC5D,QAAO,MAAM,SAAS;;AAGxB,SAAS,cAAc,OAAwC;CAC7D,MAAM,KAAM,MAAM,SACd,UAAU;AACd,QAAO,OAAO,OAAO,WAAW,KAAK,KAAA;;AAGvC,SAAS,0BACP,UACA,MACA,cACM;AACN,KAAI,SAAS,SAAS,eAAe,KACnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,oBAAoB;GACpB,oBAAoB,SAAS,SAAS;GACvC;EACF,CAAC;AAEJ,KACE,iBAAiB,KAAA,KACjB,SAAS,SAAS,iBAAiB,aAEnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,sBAAsB;GACtB,sBAAsB,SAAS,SAAS;GACzC;EACF,CAAC;;AASN,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAwC;AAC5C,SAAO,KAAK,QAAgC,uBAAuB,EACjE,QAAQ,OACT,CAAC;;CAGJ,MAAM,MACJ,UACA,UAAqC,EAAE,EACP;AAChC,SAAO,KAAK,QACV,uBAAuB,mBAAmB,SAAS,CAAC,SACpD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,WAAW,QAAQ;IACnB,KAAK,QAAQ;IACd,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,IACvD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,CAAC,UACxD,EAAE,QAAQ,QAAQ,CACnB;;;AAIL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAyC;AAC7C,SAAO,KAAK,QAAiC,qBAAqB,EAChE,QAAQ,OACT,CAAC;;CAGJ,MAAM,QAAQ,YAA0D;AACtE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;;CAGH,MAAM,KAAK,YAA0D;AACnE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,QACpD,EAAE,QAAQ,QAAQ,CACnB;;;AASL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,sBACJ,OACoD;AACpD,SAAO,KAAK,QACV,8CACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,gBACJ,gBAC2C;AAC3C,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,IAC9E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,UACJ,gBACwC;AACxC,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,CAAC,SAC/E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,gBAAgB,OAG2B;EAC/C,MAAM,SAAS,IAAI,gBAAgB;GACjC,OAAO,MAAM;GACb,MAAM,MAAM;GACb,CAAC;AACF,SAAO,KAAK,QACV,wCAAwC,OAAO,UAAU,IACzD,EAAE,QAAQ,OAAO,CAClB;;;AAIL,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,UAA+B,EAAE,EAA6B;EACvE,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,aAAa,KAAA,EACvB,cAAa,IAAI,YAAY,QAAQ,SAAS;AAChD,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EACpB,cAAa,IAAI,SAAS,OAAO,QAAQ,MAAM,CAAC;EAClD,MAAM,QAAQ,aAAa,UAAU;AACrC,SAAO,KAAK,QACV,gBAAgB,QAAQ,IAAI,UAAU,MACtC,EAAE,QAAQ,OAAO,CAClB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/hub-sdk",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Typed SDK for Tangle Hub tool discovery and execution",
   "type": "module",
   "main": "dist/index.js",
@@ -16,6 +16,7 @@
   ],
   "devDependencies": {
     "@types/node": "25.6.0",
+    "hono": ">=4.12.12",
     "tsdown": "0.21.10",
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"