@tangle-network/hub-sdk 0.2.0

package/LICENSE

@@ -0,0 +1,11 @@
+Copyright (c) 2025 Tangle Network
+
+All rights reserved.
+
+This software and associated documentation files (the "Software") are proprietary
+and confidential. No part of this Software may be reproduced, distributed, or
+transmitted in any form or by any means, including photocopying, recording, or
+other electronic or mechanical methods, without the prior written permission of
+Tangle Network.
+
+For licensing inquiries, contact: hello@tangle.tools

package/dist/index.d.ts

@@ -0,0 +1,279 @@
+//#region src/types.d.ts
+type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
+interface HubSuccessEnvelope<TData> {
+  success: true;
+  data: TData;
+}
+interface HubErrorEnvelope {
+  success: false;
+  error: HubErrorBody;
+}
+type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
+interface HubErrorBody {
+  code: HubErrorCode;
+  message: string;
+  details?: unknown;
+}
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_CONFIG_MISSING" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED";
+interface HubStatusResponse {
+  contract: unknown;
+  principal: HubPrincipal;
+  connections: HubStatusConnections;
+}
+interface HubPrincipal {
+  kind: HubPrincipalKind;
+  userId: string;
+  apiKeyId?: string;
+  sandboxId?: string;
+  requestId?: string;
+}
+interface HubStatusConnections {
+  connectedProviderCount: number;
+  unhealthyProviderCount: number;
+}
+interface HubConnection {
+  id: string;
+  providerId: string;
+  displayName: string;
+  accountDisplay: string | null;
+  scopes: string[];
+  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
+  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+}
+interface HubConnectionsResponse {
+  connections: HubConnection[];
+}
+interface HubOAuthStartRequest {
+  provider: string;
+  returnUrl?: string;
+  cli?: boolean;
+}
+interface HubOAuthCallbackSuccessQuery {
+  provider: string;
+  code: string;
+  state: string;
+  error?: undefined;
+}
+interface HubOAuthCallbackErrorQuery {
+  provider: string;
+  error: string;
+  state: string;
+  code?: undefined;
+}
+type HubOAuthCallbackQuery = HubOAuthCallbackSuccessQuery | HubOAuthCallbackErrorQuery;
+interface HubOAuthStartResponse {
+  provider: string;
+  redirectUrl: string;
+  state: string;
+  expiresAt: string;
+  scopes: string[];
+  cli: boolean;
+}
+interface HubOAuthCallbackResponse {
+  connectionId: string;
+  provider: string;
+  cli: boolean;
+  reconnected: boolean;
+}
+interface HubConnectionDeleteRequest {
+  connectionId: string;
+}
+interface HubConnectionDeleteResponse {
+  connection: HubConnection;
+}
+interface HubToolSource {
+  sourceId: string;
+  providerId: string;
+  displayName: string;
+  toolCount: number;
+  connectionStatus: "connected" | "missing" | "unknown";
+  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
+  configured: boolean;
+}
+interface HubTool {
+  path: string;
+  providerId?: string;
+  title?: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  connectionRequired?: boolean;
+  connectionStatus?: "connected" | "missing" | "unknown";
+  requiredConnectionProviderId?: string;
+  policyState?: "allow" | "ask" | "deny" | "unknown";
+}
+interface HubToolSourcesResponse {
+  sources: HubToolSource[];
+}
+interface HubToolsSearchRequest {
+  query: string;
+  provider?: string;
+}
+interface HubToolsSearchResponse {
+  tools: HubTool[];
+}
+interface HubToolsDescribeRequest {
+  path: string;
+}
+interface HubToolsDescribeResponse {
+  tool: HubTool;
+}
+interface HubExecRequest {
+  path: string;
+  input?: unknown;
+  connectionId?: string;
+}
+interface HubExecResponse<TResult = unknown> {
+  result: TResult;
+}
+interface HubTokenMintRequest {
+  connectionId?: string;
+  provider?: string;
+  actionPath: string;
+  ttlSeconds?: number;
+}
+interface HubTokenMintResponse {
+  token: string;
+  tokenId: string;
+  expiresAt: string;
+}
+interface HubCapabilityToken {
+  id: string;
+  providerId: string;
+  connectionId: string;
+  connectionDisplay: string | null;
+  actionPath: string;
+  expiresAt: string;
+  status: "active" | "consumed" | "expired" | "revoked";
+  principalKind: HubPrincipalKind;
+  createdAt: string;
+}
+interface HubTokensListResponse {
+  tokens: HubCapabilityToken[];
+}
+interface HubTokenRevokeResponse {
+  tokenId: string;
+  status: HubCapabilityToken["status"];
+}
+type HubPolicyDecision = "allow" | "ask" | "deny";
+interface HubPolicyUpdateRequest {
+  connectionId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+}
+interface HubPolicyListRequest {
+  connectionId: string;
+}
+interface HubPolicy {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubPolicyResponse {
+  policy: HubPolicy;
+}
+interface HubPolicyListResponse {
+  policies: HubPolicy[];
+}
+interface HubAuditEvent {
+  id: string;
+  action: string;
+  targetUserId: string | null;
+  targetKeyId: string | null;
+  metadata: unknown;
+  createdAt: string;
+}
+interface HubAuditResponse {
+  events: HubAuditEvent[];
+  nextCursor: string | null;
+}
+interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
+  error: HubErrorEnvelope["error"] & {
+    code: "HUB_NOT_IMPLEMENTED";
+  };
+}
+//#endregion
+//#region src/client.d.ts
+type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
+interface HubClientOptions {
+  baseUrl: string;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
+}
+declare class HubSdkError extends Error {
+  readonly code: HubErrorBody["code"];
+  readonly details?: unknown;
+  readonly status?: number;
+  constructor(error: HubErrorBody, options?: {
+    status?: number;
+  });
+}
+declare class HubClient {
+  readonly baseUrl: string;
+  readonly fetch: typeof fetch;
+  readonly apiKey?: string;
+  readonly authHeaders?: HubAuthHeaders;
+  readonly connections: HubConnectionsClient;
+  readonly permissions: HubPermissionsClient;
+  readonly tokens: HubTokensClient;
+  readonly tools: HubToolsClient;
+  constructor(options: HubClientOptions);
+  status(): Promise<HubStatusResponse>;
+  private request;
+  private buildHeaders;
+}
+interface HubTokenListOptions {
+  includeExpired?: boolean;
+}
+declare class HubTokensClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  mint(options: {
+    actionPath: string;
+    connectionId?: string;
+    provider?: string;
+    ttlSeconds?: number;
+  }): Promise<HubTokenMintResponse>;
+  list(options?: HubTokenListOptions): Promise<HubTokensListResponse>;
+  revoke(tokenId: string): Promise<HubTokenRevokeResponse>;
+}
+declare class HubPermissionsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(connectionId: string): Promise<HubPolicyListResponse>;
+  set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse>;
+}
+interface HubToolSearchOptions {
+  provider?: string;
+}
+interface HubToolInvokeOptions {
+  connectionId?: string;
+}
+declare class HubToolsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
+  describe(path: string): Promise<HubToolsDescribeResponse>;
+  invoke<TResult = unknown>(path: string, input: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
+  private buildExecInit;
+}
+declare class HubConnectionsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(): Promise<HubConnectionsResponse>;
+  revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
+}
+//#endregion
+//#region src/redaction.d.ts
+declare function redactHubValue(value: unknown): unknown;
+//#endregion
+export { type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, HubClient, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, HubConnectionsClient, type HubConnectionsResponse, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubExecRequest, type HubExecResponse, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, redactHubValue };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/client.ts","../src/redaction.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,OAAA;EACA,IAAA,EAAM,KAAA;AAAA;AAAA,UAGS,gBAAA;EACf,OAAA;EACA,KAAA,EAAO,YAAA;AAAA;AAAA,KAGG,WAAA,UAAqB,kBAAA,CAAmB,KAAA,IAAS,gBAAA;AAAA,UAE5C,YAAA;EACf,IAAA,EAAM,YAAA;EACN,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,YAAA;AAAA,UAmBK,iBAAA;EACf,QAAA;EACA,SAAA,EAAW,YAAA;EACX,WAAA,EAAa,oBAAA;AAAA;AAAA,UAGE,YAAA;EACf,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,QAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,oBAAA;EACf,sBAAA;EACA,sBAAA;AAAA;AAAA,UAGe,aAAA;EACf,EAAA;EACA,UAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,sBAAA;EACf,WAAA,EAAa,aAAA;AAAA;AAAA,UAGE,oBAAA;EACf,QAAA;EACA,SAAA;EACA,GAAA;AAAA;AAAA,UAGe,4BAAA;EACf,QAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;AAAA;AAAA,UAGe,0BAAA;EACf,QAAA;EACA,KAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,KAGU,qBAAA,GACR,4BAAA,GACA,0BAAA;AAAA,UAEa,qBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,wBAAA;EACf,YAAA;EACA,QAAA;EACA,GAAA;EACA,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,YAAA;AAAA;AAAA,UAGe,2BAAA;EACf,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,aAAA;EACf,QAAA;EACA,UAAA;EACA,WAAA;EACA,SAAA;EACA,gBAAA;EACA,MAAA;EACA,UAAA;AAAA;AAAA,UAGe,OAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;EACA,YAAA;EACA,kBAAA;EACA,gBAAA;EACA,4BAAA;EACA,WAAA;AAAA;AAAA,UAGe,sBAAA;EACf,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,qBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,sBAAA;EACf,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,uBAAA;EACf,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,IAAA,EAAM,OAAA;AAAA;AAAA,UAGS,cAAA;EACf,IAAA;EACA,KAAA;EACA,YAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA,EAAQ,OAAA;AAAA;AAAA,UAGO,mBAAA;EACf,YAAA;EACA,QAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,UAAA;EACA,YAAA;EACA,iBAAA;EACA,UAAA;EACA,SAAA;EACA,MAAA;EACA,aAAA,EAAe,gBAAA;EACf,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,UAGO,sBAAA;EACf,OAAA;EACA,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGE,iBAAA;AAAA,UAEK,sBAAA;EACf,YAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;AAAA;AAAA,UAGK,oBAAA;EACf,YAAA;AAAA;AAAA,UAGe,SAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,MAAA,EAAQ,SAAA;AAAA;AAAA,UAGO,qBAAA;EACf,QAAA,EAAU,SAAA;AAAA;AAAA,UAGK,aAAA;EACf,EAAA;EACA,MAAA;EACA,YAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA,EAAQ,aAAA;EACR,UAAA;AAAA;AAAA,UAGe,6BAAA,SAAsC,gBAAA;EACrD,KAAA,EAAO,gBAAA;IAA8B,IAAA;EAAA;AAAA;;;KC9O3B,cAAA,SAAuB,WAAA,GAAc,OAAA,CAAQ,WAAA;AAAA,UAExC,gBAAA;EACf,OAAA;EACA,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,cAGJ,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,YAAA;EAAA,SACN,OAAA;EAAA,SACA,MAAA;cAEG,KAAA,EAAO,YAAA,EAAc,OAAA;IAAW,MAAA;EAAA;AAAA;AAAA,cASjC,SAAA;EAAA,SACF,OAAA;EAAA,SACA,KAAA,SAAc,KAAA;EAAA,SACd,MAAA;EAAA,SACA,WAAA,GAAc,cAAA;EAAA,SACd,WAAA,EAAa,oBAAA;EAAA,SACb,WAAA,EAAa,oBAAA;EAAA,SACb,MAAA,EAAQ,eAAA;EAAA,SACR,KAAA,EAAO,cAAA;cAEJ,OAAA,EAAS,gBAAA;EAef,MAAA,CAAA,GAAU,OAAA,CAAQ,iBAAA;EAAA,QAIV,OAAA;EAAA,QAiBA,YAAA;AAAA;AAAA,UAsBC,mBAAA;EACf,cAAA;AAAA;AAAA,cAGW,eAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA;IACT,UAAA;IACA,YAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,oBAAA;EAQN,IAAA,CACJ,OAAA,GAAS,mBAAA,GACR,OAAA,CAAQ,qBAAA;EAuBL,MAAA,CAAO,OAAA,WAAkB,OAAA,CAAQ,sBAAA;AAAA;AAAA,cAY5B,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,YAAA,WAAuB,OAAA,CAAQ,qBAAA;EAOpC,GAAA,CAAI,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,iBAAA;AAAA;AAAA,UASnC,oBAAA;EACf,QAAA;AAAA;AAAA,UAGe,oBAAA;EACf,YAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,MAAA,CACJ,KAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,sBAAA;EAQL,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,wBAAA;EAQhC,MAAA,mBAAA,CACJ,IAAA,UACA,KAAA,WACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,eAAA,CAAgB,OAAA;EAAA,QAgCnB,aAAA;AAAA;AAAA,cAiBG,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,sBAAA;EAMhB,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;AAAA;;;iBCpS9B,cAAA,CAAe,KAAA"}

package/dist/index.js

@@ -0,0 +1,188 @@
+//#region src/redaction.ts
+const SECRET_KEY_PATTERN = /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;
+const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\b/g;
+function redactHubValue(value) {
+	if (typeof value === "string") return value.replace(SECRET_VALUE_PATTERN, "[REDACTED]");
+	if (Array.isArray(value)) return value.map((item) => redactHubValue(item));
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, SECRET_KEY_PATTERN.test(key) ? "[REDACTED]" : redactHubValue(entryValue)]));
+	return value;
+}
+//#endregion
+//#region src/client.ts
+var HubSdkError = class extends Error {
+	code;
+	details;
+	status;
+	constructor(error, options = {}) {
+		super(String(redactHubValue(error.message)));
+		this.name = "HubSdkError";
+		this.code = error.code;
+		this.details = redactHubValue(error.details);
+		this.status = options.status;
+	}
+};
+var HubClient = class {
+	baseUrl;
+	fetch;
+	apiKey;
+	authHeaders;
+	connections;
+	permissions;
+	tokens;
+	tools;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.apiKey = options.apiKey;
+		this.authHeaders = options.authHeaders;
+		this.fetch = options.fetch ?? fetch;
+		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
+		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
+		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+	}
+	async status() {
+		return this.request("/v1/hub/status", { method: "GET" });
+	}
+	async request(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const envelope = await response.json();
+		if (!envelope.success) throw new HubSdkError(envelope.error, { status: response.status });
+		return envelope.data;
+	}
+	async buildHeaders(headers) {
+		const mergedHeaders = new Headers(headers);
+		mergedHeaders.set("Accept", "application/json");
+		if (this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
+		if (this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
+		for (const [key, value] of new Headers(headers)) mergedHeaders.set(key, value);
+		return mergedHeaders;
+	}
+};
+var HubTokensClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async mint(options) {
+		return this.request("/v1/hub/tokens", {
+			method: "POST",
+			body: JSON.stringify(options),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async list(options = {}) {
+		const searchParams = new URLSearchParams();
+		if (options.includeExpired) searchParams.set("includeExpired", "true");
+		const query = searchParams.toString();
+		return { tokens: (await this.request(`/v1/hub/tokens${query ? `?${query}` : ""}`, { method: "GET" })).tokens.map((token) => ({
+			id: token.id,
+			providerId: token.providerId,
+			connectionId: token.connectionId,
+			connectionDisplay: token.connectionDisplay,
+			actionPath: token.actionPath,
+			expiresAt: token.expiresAt,
+			status: token.status,
+			principalKind: token.principalKind,
+			createdAt: token.createdAt
+		})) };
+	}
+	async revoke(tokenId) {
+		const response = await this.request(`/v1/hub/tokens/${encodeURIComponent(tokenId)}`, { method: "DELETE" });
+		return {
+			tokenId: response.tokenId,
+			status: response.status
+		};
+	}
+};
+var HubPermissionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list(connectionId) {
+		return this.request(`/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`, { method: "GET" });
+	}
+	async set(input) {
+		return this.request("/v1/hub/policies", {
+			method: "PUT",
+			body: JSON.stringify(input),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+};
+var HubToolsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async search(query, options = {}) {
+		return this.request("/v1/hub/tools/search", {
+			method: "POST",
+			body: JSON.stringify({
+				query,
+				provider: options.provider
+			}),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async describe(path) {
+		return this.request("/v1/hub/tools/describe", {
+			method: "POST",
+			body: JSON.stringify({ path }),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async invoke(path, input, options = {}) {
+		const execInit = this.buildExecInit(path, input, options.connectionId);
+		try {
+			return await this.request("/v1/hub/exec", execInit);
+		} catch (error) {
+			if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) throw error;
+		}
+		const minted = await this.request("/v1/hub/tokens", {
+			method: "POST",
+			body: JSON.stringify({
+				actionPath: path,
+				connectionId: options.connectionId,
+				provider: options.connectionId ? void 0 : path.split(".")[0]
+			}),
+			headers: { "Content-Type": "application/json" }
+		});
+		return this.request("/v1/hub/exec", {
+			...execInit,
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${minted.token}`
+			}
+		});
+	}
+	buildExecInit(path, input, connectionId) {
+		return {
+			method: "POST",
+			body: JSON.stringify({
+				path,
+				input,
+				connectionId
+			}),
+			headers: { "Content-Type": "application/json" }
+		};
+	}
+};
+function requiresCapabilityToken(error) {
+	return error.code === "HUB_APPROVAL_REQUIRED";
+}
+var HubConnectionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/connections", { method: "GET" });
+	}
+	async revoke(connectionId) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+export { HubClient, HubConnectionsClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, redactHubValue };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts","../src/client.ts"],"sourcesContent":["const SECRET_KEY_PATTERN =\n  /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;\nconst SECRET_VALUE_PATTERN =\n  /\\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\\b/g;\n\nexport function redactHubValue(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    return value.replace(SECRET_VALUE_PATTERN, \"[REDACTED]\");\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactHubValue(item));\n  }\n\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entryValue]) => [\n        key,\n        SECRET_KEY_PATTERN.test(key)\n          ? \"[REDACTED]\"\n          : redactHubValue(entryValue),\n      ]),\n    );\n  }\n\n  return value;\n}\n","import { redactHubValue } from \"./redaction.js\";\nimport type {\n  HubConnectionDeleteResponse,\n  HubConnectionsResponse,\n  HubEnvelope,\n  HubErrorBody,\n  HubExecResponse,\n  HubPolicyListResponse,\n  HubPolicyResponse,\n  HubPolicyUpdateRequest,\n  HubStatusResponse,\n  HubTokenMintResponse,\n  HubTokenRevokeResponse,\n  HubTokensListResponse,\n  HubToolsDescribeResponse,\n  HubToolsSearchResponse,\n} from \"./types.js\";\n\nexport type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;\n\nexport interface HubClientOptions {\n  baseUrl: string;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\nexport class HubSdkError extends Error {\n  readonly code: HubErrorBody[\"code\"];\n  readonly details?: unknown;\n  readonly status?: number;\n\n  constructor(error: HubErrorBody, options: { status?: number } = {}) {\n    super(String(redactHubValue(error.message)));\n    this.name = \"HubSdkError\";\n    this.code = error.code;\n    this.details = redactHubValue(error.details);\n    this.status = options.status;\n  }\n}\n\nexport class HubClient {\n  readonly baseUrl: string;\n  readonly fetch: typeof fetch;\n  readonly apiKey?: string;\n  readonly authHeaders?: HubAuthHeaders;\n  readonly connections: HubConnectionsClient;\n  readonly permissions: HubPermissionsClient;\n  readonly tokens: HubTokensClient;\n  readonly tools: HubToolsClient;\n\n  constructor(options: HubClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = options.apiKey;\n    this.authHeaders = options.authHeaders;\n    this.fetch = options.fetch ?? fetch;\n    this.connections = new HubConnectionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.permissions = new HubPermissionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.tokens = new HubTokensClient((path, init) => this.request(path, init));\n    this.tools = new HubToolsClient((path, init) => this.request(path, init));\n  }\n\n  async status(): Promise<HubStatusResponse> {\n    return this.request<HubStatusResponse>(\"/v1/hub/status\", { method: \"GET\" });\n  }\n\n  private async request<TData>(\n    path: string,\n    init: RequestInit,\n  ): Promise<TData> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n    const envelope = (await response.json()) as HubEnvelope<TData>;\n\n    if (!envelope.success) {\n      throw new HubSdkError(envelope.error, { status: response.status });\n    }\n\n    return envelope.data;\n  }\n\n  private async buildHeaders(headers: HeadersInit | undefined) {\n    const mergedHeaders = new Headers(headers);\n    mergedHeaders.set(\"Accept\", \"application/json\");\n\n    if (this.apiKey) {\n      mergedHeaders.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    }\n\n    if (this.authHeaders) {\n      for (const [key, value] of new Headers(await this.authHeaders())) {\n        mergedHeaders.set(key, value);\n      }\n    }\n\n    for (const [key, value] of new Headers(headers)) {\n      mergedHeaders.set(key, value);\n    }\n\n    return mergedHeaders;\n  }\n}\n\nexport interface HubTokenListOptions {\n  includeExpired?: boolean;\n}\n\nexport class HubTokensClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mint(options: {\n    actionPath: string;\n    connectionId?: string;\n    provider?: string;\n    ttlSeconds?: number;\n  }): Promise<HubTokenMintResponse> {\n    return this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify(options),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async list(\n    options: HubTokenListOptions = {},\n  ): Promise<HubTokensListResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.includeExpired) searchParams.set(\"includeExpired\", \"true\");\n    const query = searchParams.toString();\n    const response = await this.request<HubTokensListResponse>(\n      `/v1/hub/tokens${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n    return {\n      tokens: response.tokens.map((token) => ({\n        id: token.id,\n        providerId: token.providerId,\n        connectionId: token.connectionId,\n        connectionDisplay: token.connectionDisplay,\n        actionPath: token.actionPath,\n        expiresAt: token.expiresAt,\n        status: token.status,\n        principalKind: token.principalKind,\n        createdAt: token.createdAt,\n      })),\n    };\n  }\n\n  async revoke(tokenId: string): Promise<HubTokenRevokeResponse> {\n    const response = await this.request<HubTokenRevokeResponse>(\n      `/v1/hub/tokens/${encodeURIComponent(tokenId)}`,\n      { method: \"DELETE\" },\n    );\n    return {\n      tokenId: response.tokenId,\n      status: response.status,\n    };\n  }\n}\n\nexport class HubPermissionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(connectionId: string): Promise<HubPolicyListResponse> {\n    return this.request<HubPolicyListResponse>(\n      `/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse> {\n    return this.request<HubPolicyResponse>(\"/v1/hub/policies\", {\n      method: \"PUT\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n}\n\nexport interface HubToolSearchOptions {\n  provider?: string;\n}\n\nexport interface HubToolInvokeOptions {\n  connectionId?: string;\n}\n\nexport class HubToolsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async search(\n    query: string,\n    options: HubToolSearchOptions = {},\n  ): Promise<HubToolsSearchResponse> {\n    return this.request<HubToolsSearchResponse>(\"/v1/hub/tools/search\", {\n      method: \"POST\",\n      body: JSON.stringify({ query, provider: options.provider }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async describe(path: string): Promise<HubToolsDescribeResponse> {\n    return this.request<HubToolsDescribeResponse>(\"/v1/hub/tools/describe\", {\n      method: \"POST\",\n      body: JSON.stringify({ path }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async invoke<TResult = unknown>(\n    path: string,\n    input: unknown,\n    options: HubToolInvokeOptions = {},\n  ): Promise<HubExecResponse<TResult>> {\n    const execInit = this.buildExecInit(path, input, options.connectionId);\n    try {\n      return await this.request<HubExecResponse<TResult>>(\n        \"/v1/hub/exec\",\n        execInit,\n      );\n    } catch (error) {\n      if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) {\n        throw error;\n      }\n    }\n\n    const minted = await this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        actionPath: path,\n        connectionId: options.connectionId,\n        provider: options.connectionId ? undefined : path.split(\".\")[0],\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n\n    return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n      ...execInit,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${minted.token}`,\n      },\n    });\n  }\n\n  private buildExecInit(\n    path: string,\n    input: unknown,\n    connectionId: string | undefined,\n  ): RequestInit {\n    return {\n      method: \"POST\",\n      body: JSON.stringify({ path, input, connectionId }),\n      headers: { \"Content-Type\": \"application/json\" },\n    };\n  }\n}\n\nfunction requiresCapabilityToken(error: HubSdkError): boolean {\n  return error.code === \"HUB_APPROVAL_REQUIRED\";\n}\n\nexport class HubConnectionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubConnectionsResponse> {\n    return this.request<HubConnectionsResponse>(\"/v1/hub/connections\", {\n      method: \"GET\",\n    });\n  }\n\n  async revoke(connectionId: string): Promise<HubConnectionDeleteResponse> {\n    return this.request<HubConnectionDeleteResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n}\n"],"mappings":";AAAA,MAAM,qBACJ;AACF,MAAM,uBACJ;AAEF,SAAgB,eAAe,OAAyB;AACtD,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,QAAQ,sBAAsB,aAAa;AAG1D,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,KAAK,CAAC;AAGlD,KAAI,SAAS,OAAO,UAAU,SAC5B,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAC/C,KACA,mBAAmB,KAAK,IAAI,GACxB,eACA,eAAe,WAAW,CAC/B,CAAC,CACH;AAGH,QAAO;;;;ACET,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YAAY,OAAqB,UAA+B,EAAE,EAAE;AAClE,QAAM,OAAO,eAAe,MAAM,QAAQ,CAAC,CAAC;AAC5C,OAAK,OAAO;AACZ,OAAK,OAAO,MAAM;AAClB,OAAK,UAAU,eAAe,MAAM,QAAQ;AAC5C,OAAK,SAAS,QAAQ;;;AAI1B,IAAa,YAAb,MAAuB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA2B;AACrC,OAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,SAAS,QAAQ;AACtB,OAAK,cAAc,QAAQ;AAC3B,OAAK,QAAQ,QAAQ,SAAS;AAC9B,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,SAAS,IAAI,iBAAiB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC3E,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;;CAG3E,MAAM,SAAqC;AACzC,SAAO,KAAK,QAA2B,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;CAG7E,MAAc,QACZ,MACA,MACgB;EAChB,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EACF,MAAM,WAAY,MAAM,SAAS,MAAM;AAEvC,MAAI,CAAC,SAAS,QACZ,OAAM,IAAI,YAAY,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,CAAC;AAGpE,SAAO,SAAS;;CAGlB,MAAc,aAAa,SAAkC;EAC3D,MAAM,gBAAgB,IAAI,QAAQ,QAAQ;AAC1C,gBAAc,IAAI,UAAU,mBAAmB;AAE/C,MAAI,KAAK,OACP,eAAc,IAAI,iBAAiB,UAAU,KAAK,SAAS;AAG7D,MAAI,KAAK,YACP,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,MAAM,KAAK,aAAa,CAAC,CAC9D,eAAc,IAAI,KAAK,MAAM;AAIjC,OAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,QAAQ,CAC7C,eAAc,IAAI,KAAK,MAAM;AAG/B,SAAO;;;AAQX,IAAa,kBAAb,MAA6B;CAC3B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,SAKuB;AAChC,SAAO,KAAK,QAA8B,kBAAkB;GAC1D,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ;GAC7B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,KACJ,UAA+B,EAAE,EACD;EAChC,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,eAAgB,cAAa,IAAI,kBAAkB,OAAO;EACtE,MAAM,QAAQ,aAAa,UAAU;AAKrC,SAAO,EACL,SAAQ,MALa,KAAK,QAC1B,iBAAiB,QAAQ,IAAI,UAAU,MACvC,EAAE,QAAQ,OAAO,CAClB,EAEkB,OAAO,KAAK,WAAW;GACtC,IAAI,MAAM;GACV,YAAY,MAAM;GAClB,cAAc,MAAM;GACpB,mBAAmB,MAAM;GACzB,YAAY,MAAM;GAClB,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,eAAe,MAAM;GACrB,WAAW,MAAM;GAClB,EAAE,EACJ;;CAGH,MAAM,OAAO,SAAkD;EAC7D,MAAM,WAAW,MAAM,KAAK,QAC1B,kBAAkB,mBAAmB,QAAQ,IAC7C,EAAE,QAAQ,UAAU,CACrB;AACD,SAAO;GACL,SAAS,SAAS;GAClB,QAAQ,SAAS;GAClB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,cAAsD;AAC/D,SAAO,KAAK,QACV,iCAAiC,mBAAmB,aAAa,IACjE,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,IAAI,OAA2D;AACnE,SAAO,KAAK,QAA2B,oBAAoB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;AAYN,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OACJ,OACA,UAAgC,EAAE,EACD;AACjC,SAAO,KAAK,QAAgC,wBAAwB;GAClE,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAO,UAAU,QAAQ;IAAU,CAAC;GAC3D,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,SAAS,MAAiD;AAC9D,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OACJ,MACA,OACA,UAAgC,EAAE,EACC;EACnC,MAAM,WAAW,KAAK,cAAc,MAAM,OAAO,QAAQ,aAAa;AACtE,MAAI;AACF,UAAO,MAAM,KAAK,QAChB,gBACA,SACD;WACM,OAAO;AACd,OAAI,EAAE,iBAAiB,gBAAgB,CAAC,wBAAwB,MAAM,CACpE,OAAM;;EAIV,MAAM,SAAS,MAAM,KAAK,QAA8B,kBAAkB;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,cAAc,QAAQ;IACtB,UAAU,QAAQ,eAAe,KAAA,IAAY,KAAK,MAAM,IAAI,CAAC;IAC9D,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;AAEF,SAAO,KAAK,QAAkC,gBAAgB;GAC5D,GAAG;GACH,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,OAAO;IACjC;GACF,CAAC;;CAGJ,cACE,MACA,OACA,cACa;AACb,SAAO;GACL,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAM;IAAO;IAAc,CAAC;GACnD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD;;;AAIL,SAAS,wBAAwB,OAA6B;AAC5D,QAAO,MAAM,SAAS;;AAGxB,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAwC;AAC5C,SAAO,KAAK,QAAgC,uBAAuB,EACjE,QAAQ,OACT,CAAC;;CAGJ,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,IACvD,EAAE,QAAQ,UAAU,CACrB"}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@tangle-network/hub-sdk",
+  "version": "0.2.0",
+  "description": "Typed SDK for Tangle Hub tool discovery and execution",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "25.6.0",
+    "tsdown": "0.21.10",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.5"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}