@tangle-network/hub-sdk 0.3.0 → 0.4.0

package/README.md

@@ -1,7 +1,8 @@
 # @tangle-network/hub-sdk
 
 Typed SDK for the Tangle Hub `/v1/hub/*` surface. Status, connections, tools
-discovery and invocation, capability tokens, policies, approvals, audit.
+discovery and invocation, capability tokens, policies, approvals, audit,
+inbound channels, and product event subscriptions.
 
 ## Install
 
@@ -164,11 +165,67 @@ fields none were supplied for — `details.missing` names them) or
 across instances only `snapshot` + `run.done` arrive, and the persisted record
 read via `getRun` stays the source of truth.
 
+## Product event subscriptions
+
+Products can bind a managed channel or a hosted provider connection to a signed
+server callback without authoring workflow YAML:
+
+OAuth readiness and inbound-event readiness are separate.
+Check `provider.eventIngressConfigured === true` before presenting an inbound
+channel as available.
+An absent value means the server predates readiness discovery and should be
+treated as unavailable.
+
+```ts
+const callbackSecret = await deriveHubEventCallbackSecret({
+  rootSecret: env.HUB_EVENT_CALLBACK_ROOT_SECRET,
+  productId: "relationships",
+  ownerId: tangleUserId,
+  bindingId: channel.id,
+});
+
+const { subscription } = await hub.eventSubscriptions.create({
+  clientReference: `relationships:${channel.id}`,
+  label: "Relationship workspace inbound",
+  source: { type: "channel", channelId: channel.id },
+  event: "email.received",
+  callback: {
+    url: "https://relationships.example/api/events",
+    secret: callbackSecret,
+  },
+});
+```
+
+`clientReference` is the product-owned idempotency key.
+The callback URL and secret are encrypted by the platform and never returned.
+The derivation scopes one callback secret to one product, owner, and binding, so
+the product stores only those existing ids.
+On receipt, authenticate and parse the exact raw request in one call:
+
+```ts
+const authenticated = await authenticateHubEventRequest({
+  request,
+  secret: callbackSecret,
+});
+if (!authenticated.ok) return authenticated.response;
+
+const { delivery } = authenticated;
+const email = delivery.providerEvent.payload;
+```
+
+The signed delivery includes the verified provider event directly, so the
+product does not need a second workflow-run request.
+Callbacks may be retried; use `delivery.runId` as the durable idempotency key
+before starting product work.
+
 ## Exports
 
 - `HubClient`, `HubClient.fromEnv(options?)`
 - `HubConnectionsClient`, `HubPermissionsClient`, `HubTokensClient`,
-  `HubToolsClient`, `HubApprovalsClient`, `HubAuditClient`, `HubWorkflowsClient`
+  `HubChannelsClient`, `HubEventSubscriptionsClient`, `HubToolsClient`,
+  `HubApprovalsClient`, `HubAuditClient`, `HubWorkflowsClient`
+- `deriveHubEventCallbackSecret`, `authenticateHubEventRequest`,
+  `verifyHubEventSignature`, `parseHubEventDelivery`, `HubEventDeliveryError`
 - `HubSdkError` — typed `code: HubErrorCode`, redacted `details`, optional
   HTTP `status`
 - `HUB_URL_ENV_VAR`, `HUB_API_KEY_ENV_VAR`, `HUB_CAPABILITY_TOKEN_ENV_VAR` —

package/dist/index.d.ts

@@ -46,6 +46,126 @@ interface HubConnection {
 interface HubConnectionsResponse {
   connections: HubConnection[];
 }
+interface HubEmailChannel {
+  id: string;
+  kind: "email";
+  providerId: "email";
+  connectionId: string;
+  clientReference: string | null;
+  label: string | null;
+  address: string;
+  status: "active";
+  createdAt: string;
+  updatedAt: string;
+}
+type HubChannel = HubEmailChannel;
+interface HubChannelsResponse {
+  channels: HubChannel[];
+}
+interface HubEmailChannelCreateRequest {
+  /**
+   * Product-owned idempotency key. Retrying the same request returns the
+   * original mailbox instead of provisioning another address.
+   */
+  clientReference?: string;
+  label?: string;
+}
+interface HubChannelCreateResponse {
+  channel: HubChannel;
+  /** True only when this request created the channel. */
+  created: boolean;
+}
+interface HubChannelDeleteResponse {
+  removed: true;
+}
+type HubEventConditionScalar = string | number | boolean | null;
+type HubEventCondition = {
+  path: string;
+  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+  value?: HubEventConditionScalar | HubEventConditionScalar[];
+} | {
+  all: HubEventCondition[];
+} | {
+  any: HubEventCondition[];
+} | {
+  not: HubEventCondition;
+};
+interface HubEventSubscriptionFilter {
+  action?: string;
+  repo?: string;
+  when?: HubEventCondition;
+}
+type HubEventSubscriptionSource = {
+  type: "channel";
+  channelId: string;
+} | {
+  type: "connection";
+  connectionId: string;
+};
+interface HubEventSubscriptionCallback {
+  url: string;
+  secret: string;
+}
+interface HubEventSubscriptionCreateRequest {
+  /**
+   * Product-owned idempotency key. Reusing it with the same source and filter
+   * returns the existing subscription; reusing it for different input fails.
+   */
+  clientReference: string;
+  label?: string;
+  source: HubEventSubscriptionSource;
+  event: string;
+  filter?: HubEventSubscriptionFilter;
+  callback: HubEventSubscriptionCallback;
+}
+interface HubEventSubscription {
+  id: string;
+  clientReference: string;
+  label: string | null;
+  source: HubEventSubscriptionSource;
+  providerId: string;
+  connectionId: string;
+  event: string;
+  filter: HubEventSubscriptionFilter;
+  workflowId: string;
+  status: "active" | "error";
+  lastError: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubEventSubscriptionsResponse {
+  subscriptions: HubEventSubscription[];
+}
+interface HubEventSubscriptionCreateResponse {
+  subscription: HubEventSubscription;
+  /** True only when this request created the subscription; false on idempotent reuse. */
+  created: boolean;
+}
+interface HubEventSubscriptionDeleteResponse {
+  removed: true;
+}
+interface HubProviderEvent {
+  provider: string;
+  connectionId: string;
+  type: string;
+  action?: string;
+  repo?: string;
+  deliveryId?: string;
+  payload: unknown;
+}
+interface HubEventDelivery {
+  subscriptionId: string;
+  workflowId: string;
+  runId: string;
+  source: {
+    kind: "channel" | "connection";
+    id: string;
+    provider: string;
+    event: string;
+  };
+  providerEvent: HubProviderEvent;
+  firedAt: string;
+}
 /** A connector's auth model. */
 type HubProviderAuthKind = "oauth2" | "api_key" | "none" | "custom";
 interface HubProvider {
@@ -73,6 +193,12 @@ interface HubProvider {
   /** True when the provider's OAuth app credentials are wired, i.e. a connect
    *  flow can actually start. UIs offer Connect only for configured providers. */
   configured: boolean;
+  /**
+   * True when this deployment can receive this provider's inbound events.
+   * This is separate from `configured`: OAuth can be ready while the shared
+   * webhook secret or bot identity is still absent.
+   */
+  eventIngressConfigured?: boolean;
 }
 interface HubProvidersResponse {
   providers: HubProvider[];
@@ -681,6 +807,8 @@ declare class HubClient {
   readonly apiKey?: string;
   readonly authHeaders?: HubAuthHeaders;
   readonly connections: HubConnectionsClient;
+  readonly channels: HubChannelsClient;
+  readonly eventSubscriptions: HubEventSubscriptionsClient;
   readonly permissions: HubPermissionsClient;
   readonly tokens: HubTokensClient;
   readonly tools: HubToolsClient;
@@ -763,6 +891,20 @@ interface HubConnectionStartOptions {
   returnUrl?: string;
   cli?: boolean;
 }
+declare class HubChannelsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(): Promise<HubChannelsResponse>;
+  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
+  delete(channelId: string): Promise<HubChannelDeleteResponse>;
+}
+declare class HubEventSubscriptionsClient {
+  private readonly request;
+  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  list(): Promise<HubEventSubscriptionsResponse>;
+  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
+  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
+}
 declare class HubConnectionsClient {
   private readonly request;
   constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
@@ -905,8 +1047,78 @@ declare class HubWorkflowsClient {
   schema(): Promise<HubWorkflowSchemaResponse>;
 }
 //#endregion
+//#region src/event-delivery.d.ts
+type HubEventSignatureFailure = "missing" | "malformed" | "stale" | "mismatch";
+type HubEventSignatureResult = {
+  valid: true;
+  timestamp: number;
+} | {
+  valid: false;
+  reason: HubEventSignatureFailure;
+};
+interface VerifyHubEventSignatureInput {
+  body: string;
+  signature: string | null | undefined;
+  secret: string;
+  toleranceSeconds?: number;
+  now?: number | Date;
+}
+interface DeriveHubEventCallbackSecretInput {
+  /** App-level secret stored only in the product's server environment. */
+  rootSecret: string;
+  /** Stable product slug, such as `relationships`. */
+  productId: string;
+  /** Stable Tangle owner id; user and team ids are both valid. */
+  ownerId: string;
+  /** Stable product-local binding id used in the callback route. */
+  bindingId: string;
+}
+type HubEventRequestFailureCode = "METHOD_NOT_ALLOWED" | "UNEXPECTED_EVENT" | "UNSUPPORTED_MEDIA_TYPE" | "PAYLOAD_TOO_LARGE" | "INVALID_SIGNATURE" | "INVALID_DELIVERY" | "DELIVERY_ID_MISMATCH";
+type HubEventRequestResult = {
+  ok: true;
+  delivery: HubEventDelivery;
+} | {
+  ok: false;
+  code: HubEventRequestFailureCode;
+  response: Response;
+};
+interface AuthenticateHubEventRequestInput {
+  request: Request;
+  /** The per-binding secret supplied when the subscription was created. */
+  secret: string;
+  /** Defaults to 5 MiB plus envelope overhead; hard-capped at 10 MiB. */
+  maxBodyBytes?: number;
+  toleranceSeconds?: number;
+  now?: number | Date;
+}
+declare class HubEventDeliveryError extends Error {
+  readonly code: "INVALID_JSON" | "INVALID_PAYLOAD" | "CRYPTO_UNAVAILABLE" | "INVALID_TOLERANCE" | "INVALID_CALLBACK_SECRET" | "INVALID_SECRET_SCOPE" | "INVALID_BODY_LIMIT";
+  constructor(code: HubEventDeliveryError["code"], message: string);
+}
+/**
+ * Derive one callback secret per product binding from a single server-held root
+ * secret. Products persist only the binding id; the derived secret can be
+ * reproduced for callback authentication without another secret table.
+ */
+declare function deriveHubEventCallbackSecret(input: DeriveHubEventCallbackSecretInput): Promise<string>;
+/**
+ * Authenticate and parse the platform's callback as one operation. The exact
+ * raw body is read once with a size limit before its signature is checked.
+ *
+ * A successful callback can be retried. Use `delivery.runId` as the durable
+ * idempotency key before starting product work.
+ */
+declare function authenticateHubEventRequest(input: AuthenticateHubEventRequestInput): Promise<HubEventRequestResult>;
+/**
+ * Authenticate a Hub event callback against its exact raw request body.
+ * The timestamp window rejects captured-request replay, and byte-wise
+ * comparison avoids secret-dependent string comparison behavior.
+ */
+declare function verifyHubEventSignature(input: VerifyHubEventSignatureInput): Promise<HubEventSignatureResult>;
+declare function parseHubEventDelivery(input: string | unknown): HubEventDelivery;
+//#endregion
 //#region src/redaction.d.ts
 declare function redactHubValue(value: unknown): unknown;
 //#endregion
-export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListReposResponse, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubManualRunInput, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowEventFilter, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunStatus, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, redactHubValue, resolveHubAuth, resolveHubBaseUrl };
+export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListReposResponse, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubManualRunInput, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowEventFilter, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunStatus, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, type VerifyHubEventSignatureInput, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/client.ts","../src/redaction.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,OAAA;EACA,IAAA,EAAM,KAAA;AAAA;AAAA,UAGS,gBAAA;EACf,OAAA;EACA,KAAA,EAAO,YAAA;AAAA;AAAA,KAGG,WAAA,UAAqB,kBAAA,CAAmB,KAAA,IAAS,gBAAA;AAAA,UAE5C,YAAA;EACf,IAAA,EAAM,YAAA;EACN,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,YAAA;AAAA,UAkDK,iBAAA;EACf,QAAA;EACA,SAAA,EAAW,YAAA;EACX,WAAA,EAAa,oBAAA;AAAA;AAAA,UAGE,YAAA;EACf,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,QAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,oBAAA;EACf,sBAAA;EACA,sBAAA;AAAA;AAAA,UAGe,aAAA;EACf,EAAA;EACA,UAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,sBAAA;EACf,WAAA,EAAa,aAAA;AAAA;;KAIH,mBAAA;AAAA,UAEK,WAAA;EACf,UAAA;EACA,KAAA;EA3FsB;EA6FtB,QAAA,EAAU,mBAAA;EA3CK;;;EA+Cf,QAAA;EACA,QAAA;EACA,MAAA;EA/CW;;EAkDX,eAAA;EAjDiC;;EAoDjC,WAAA;EAjD2B;;EAoD3B,YAAA;EAnDA;EAqDA,MAAA;EApDA;;EAuDA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,SAAA,EAAW,WAAA;EArDI;EAuDf,gBAAA;AAAA;AAAA,UAGe,oBAAA;EACf,QAAA;EACA,SAAA;EACA,GAAA;AAAA;AAAA,UAGe,4BAAA;EACf,QAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;AAAA;AAAA,UAGe,0BAAA;EACf,QAAA;EACA,KAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,KAGU,qBAAA,GACR,4BAAA,GACA,0BAAA;AAAA,UAEa,qBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,qCAAA;EACf,SAAA;AAAA;AAAA,UAGe,sCAAA;EACf,QAAA;EACA,KAAA;EACA,QAAA;EACA,UAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;AAAA;AAAA,UAGe,wCAAA;EACf,IAAA;EACA,KAAA;EACA,MAAA;EACA,aAAA;EACA,UAAA;EACA,SAAA;AAAA;AAAA,UAGe,yCAAA;EACf,YAAA;EACA,QAAA;EACA,WAAA;EACA,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,wBAAA;EACf,YAAA;EACA,QAAA;EACA,GAAA;EACA,WAAA;AAAA;;;;UAMe,uBAAA;EACf,QAAA;EACA,MAAA;AAAA;;;UAKe,wBAAA;EACf,UAAA,EAAY,aAAA;EACZ,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,YAAA;AAAA;AAAA,UAGe,2BAAA;EACf,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,0BAAA;EACf,YAAA;AAAA;AAAA,KAGU,yBAAA;AAAA,UAMK,wBAAA;EACf,IAAA;EACA,OAAA;AAAA;AAAA,UAGe,uBAAA;EACf,MAAA,EAAQ,yBAAA;EACR,SAAA;EACA,KAAA,GAAQ,wBAAA;AAAA;AAAA,UAGO,2BAAA;EACf,UAAA,EAAY,aAAA;EACZ,MAAA,EAAQ,uBAAA;AAAA;AAAA,UAGO,aAAA;EACf,QAAA;EACA,UAAA;EACA,WAAA;EACA,SAAA;EACA,gBAAA;EACA,MAAA;EACA,UAAA;AAAA;;;;KAMU,WAAA;AAAA,UAEK,OAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;EACA,YAAA;EACA,kBAAA;EACA,gBAAA;EACA,4BAAA;EACA,WAAA;EACA,IAAA,GAAO,WAAA;AAAA;AAAA,UAGQ,sBAAA;EACf,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,qBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,sBAAA;EACf,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,uBAAA;EACf,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,IAAA,EAAM,OAAA;AAAA;AAAA,UAGS,cAAA;EACf,IAAA;EACA,KAAA;EACA,YAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA,EAAQ,OAAA;AAAA;AAAA,UAGO,mBAAA;EACf,YAAA;EACA,QAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,UAAA;EACA,YAAA;EACA,iBAAA;EACA,UAAA;EACA,SAAA;EACA,MAAA;EACA,aAAA,EAAe,gBAAA;EACf,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,UAGO,sBAAA;EACf,OAAA;EACA,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGE,iBAAA;AAAA,UAEK,sBAAA;EACf,YAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;AAAA;AAAA,UAGK,oBAAA;EACf,YAAA;AAAA;AAAA,UAGe,sBAAA;EACf,YAAA;EACA,UAAA;AAAA;AAAA,UAGe,uBAAA;EACf,YAAA;EACA,UAAA;EAhIA;EAkIA,OAAA;AAAA;AAAA,UAGe,SAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,MAAA,EAAQ,SAAA;AAAA;AAAA,UAGO,qBAAA;EACf,QAAA,EAAU,SAAA;AAAA;AAAA,UAGK,sBAAA;EACf,YAAA;EACA,UAAA;EA7I+B;EA+I/B,YAAA;EA5Ie;EA8If,OAAA;EACA,WAAA;AAAA;AAAA,UAGe,uBAAA;EACf,YAAA;EAhJA;EAkJA,QAAA;AAAA;AAAA,KAGU,iBAAA;AAAA,UAOK,WAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,SAAA;EACA,kBAAA,EAAoB,MAAA;EACpB,MAAA,EAAQ,iBAAA;EACR,WAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,0BAAA;EACf,OAAA;EACA,KAAA;EACA,SAAA;AAAA;AAAA,UAGe,2BAAA;EACf,QAAA,EAAU,WAAA;EACV,eAAA,GAAkB,0BAAA;AAAA;AAAA,UAGH,uBAAA;EACf,SAAA,EAAW,WAAA;AAAA;AAAA,UAGI,aAAA;EACf,EAAA;EACA,MAAA;EACA,YAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,QAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA,EAAQ,aAAA;EACR,UAAA;AAAA;AAAA,UAGe,6BAAA,SAAsC,gBAAA;EACrD,KAAA,EAAO,gBAAA;IAA8B,IAAA;EAAA;AAAA;AAAA,UAetB,wCAAA;EAjLA;EAmLf,OAAA;;EAEA,cAAA;EApLA;;;;;EA0LA,WAAA,GAAc,MAAA;EArLgB;EAuL9B,UAAA;AAAA;AAAA,UAGe,yCAAA;EACf,KAAA;EACA,SAAA;EACA,cAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,cAAA;EA9LA;EAgMA,YAAA;EACA,WAAA;EA9LA;EAgMA,mBAAA;EAhMU;EAkMV,aAAA;EACA,SAAA;AAAA;AAAA,UAGe,gCAAA;EACf,YAAA,EAAc,wBAAA;AAAA;AAAA,UAGC,6BAAA;EACf,cAAA;EArMS;EAuMT,aAAA;AAAA;AAAA,UAGe,kCAAA;EACf,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,mCAAA;EACf,SAAA;EACA,cAAA;AAAA;AAAA,UASe,iBAAA;EACf,IAAA;EACA,MAAA,EAAQ,MAAA;AAAA;;UAIO,sBAAA;EACf,KAAA;EACA,MAAA;EACA,IAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;EACA,QAAA;EACA,YAAA;EACA,WAAA,EAAa,sBAAA;EACb,IAAA;EACA,QAAA;EACA,UAAA;EACA,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,IAAA;EACA,OAAA;AAAA;AAAA,KAGU,oBAAA;;;UAcK,qBAAA;EACf,KAAA;EACA,IAAA;EACA,MAAA;EACA,SAAA;EACA,WAAA;EACA,KAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,KAAA;EACA,IAAA;AAAA;;;;UAMe,iBAAA;EACf,KAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,WAAA;EACA,UAAA,GAAa,qBAAA;AAAA;;UAIE,uBAAA;EACf,KAAA;EACA,IAAA;EA9O2B;;;;;;EAqP3B,MAAA;EApPA;;;;AAIF;;EAuPE,MAAA;EACA,KAAA;EACA,OAAA;EArPe;;EAwPf,QAAA,GAAW,iBAAA;AAAA;;UAII,cAAA;EACf,EAAA;EACA,MAAA,EAAQ,oBAAA;EACR,aAAA,EAAe,uBAAA;EA1Pf;EA4PA,KAAA;EACA,QAAA;EAxPA;;EA2PA,kBAAA;EA1PW;AAGb;EA0PE,cAAA;EACA,SAAA;EACA,SAAA;EACA,WAAA;AAAA;;;;;AAhPF;;UAyPiB,oBAAA,SAA6B,cAAA;EAC5C,UAAA;EAzPA;;;EA6PA,cAAA;EACA,kBAAA;AAAA;;;;;;;KASU,oBAAA,GAAuB,MAAA;;UAGlB,sBAAA;EACf,KAAA;AAAA;;;;;;;AAzPF;;;;UAsQiB,0BAAA;EACf,KAAA;EACA,MAAA;EAtQkB;;;AAGpB;EAwQE,SAAA;AAAA;;;AApQF;;;;;;KA+QY,yBAAA;EACN,IAAA;EAAkB,GAAA,EAAK,oBAAA;AAAA;EACvB,IAAA;EAAwB,KAAA;EAAe,IAAA;EAAc,EAAA;AAAA;EAErD,IAAA;EACA,KAAA;EACA,IAAA;EAIA,MAAA;EACA,OAAA;EACA,KAAA;EACA,EAAA;AAAA;EAGA,IAAA;EACA,WAAA;EACA,cAAA;EACA,KAAA;EACA,EAAA;AAAA;EAGA,IAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,EAAA;AAAA;EAEA,IAAA;EAAe,WAAA;EAAqB,KAAA;EAAe,EAAA;AAAA;EACnD,IAAA;AAAA;EAEA,IAAA;EAGA,MAAA;EACA,KAAA;EACA,EAAA;AAAA;EAMA,IAAA;EACA,UAAA;EACA,EAAA;AAAA;AAzQN;AAAA,UA6QiB,qBAAA;EACf,EAAA;EACA,MAAA,EAAQ,oBAAA;EACR,KAAA;EACA,SAAA;EACA,WAAA;AAAA;;UAIe,mBAAA;EACf,IAAA,EAAM,cAAA;EACN,UAAA;AAAA;AAAA,UAGe,WAAA;EACf,EAAA;EACA,IAAA;EACA,WAAA;EACA,OAAA;EAjRA;EAmRA,OAAA,EAAS,iBAAA;EAhRT;EAkRA,cAAA;EACA,gBAAA,EAAkB,0BAAA;EAhRH;EAkRf,QAAA,GAAW,kBAAA;;;EAGX,eAAA,GAAkB,iBAAA;EAjRH;EAmRf,OAAA,GAAU,qBAAA;EACV,SAAA;EACA,SAAA;AAAA;AA/QF;;;AAAA,UAqRiB,iBAAA;EACf,IAAA;EACA,QAAA;AAAA;AAAA,KAGU,2BAAA;EACN,KAAA;EAAa,IAAA;EAAc,WAAA;EAAqB,YAAA;AAAA;EAChD,KAAA;EAAc,MAAA,EAAQ,0BAAA;AAAA;;KAGhB,yBAAA,GAA4B,MAAA;;;KChwB5B,cAAA,SAAuB,WAAA,GAAc,OAAA,CAAQ,WAAA;AAAA,UAExC,gBAAA;EACf,OAAA;EACA,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,cAGJ,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,YAAA;EAAA,SACN,OAAA;EAAA,SACA,MAAA;cAEG,KAAA,EAAO,YAAA,EAAc,OAAA;IAAW,MAAA;EAAA;AAAA;AAAA,cA6RjC,eAAA;AAAA,cACA,mBAAA;AAAA,cACA,4BAAA;AAAA,KAGD,MAAA,GAAS,MAAA;AAAA,UAEJ,uBAAA;EACf,GAAA,GAAM,MAAA;EACN,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,iBAOD,iBAAA,CAAkB,GAAA,GAAK,MAAA;AAAA,iBA2BvB,cAAA,CAAe,GAAA,GAAK,MAAA;AAAA,cAyCvB,SAAA;EAAA,SACF,OAAA;EAAA,SACA,KAAA,SAAc,KAAA;EAAA,SACd,MAAA;EAAA,SACA,WAAA,GAAc,cAAA;EAAA,SACd,WAAA,EAAa,oBAAA;EAAA,SACb,WAAA,EAAa,oBAAA;EAAA,SACb,MAAA,EAAQ,eAAA;EAAA,SACR,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;EAAA,SACX,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;EAAA,SACX,SAAA,EAAW,kBAAA;cAER,OAAA,EAAS,gBAAA;EAAA,OAoCd,OAAA,CAAQ,OAAA,GAAS,uBAAA,GAA+B,SAAA;EAajD,MAAA,CAAA,GAAU,OAAA,CAAQ,iBAAA;EAAA,QAIV,OAAA;EDxed;;;;AAIF;;;;;AAkDA;;EAtDE,QC8hBc,MAAA;EAAA,QA2CA,YAAA;AAAA;AAAA,UA2BC,mBAAA;EACf,cAAA;AAAA;AAAA,cAGW,eAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA;IACT,UAAA;IACA,YAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,oBAAA;EAQN,IAAA,CACJ,OAAA,GAAS,mBAAA,GACR,OAAA,CAAQ,qBAAA;EAuBL,MAAA,CAAO,OAAA,WAAkB,OAAA,CAAQ,sBAAA;AAAA;AAAA,cAY5B,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,YAAA,WAAuB,OAAA,CAAQ,qBAAA;EAOpC,GAAA,CAAI,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,iBAAA;;EAS5C,MAAA,CACJ,KAAA,EAAO,sBAAA,GACN,OAAA,CAAQ,uBAAA;EDtnBW;AAGxB;;EC8nBQ,WAAA,CAAY,YAAA,WAAuB,OAAA,CAAQ,sBAAA;ED9nBrB;;EC2oBtB,YAAA,CAAa,YAAA,WAAuB,OAAA,CAAQ,uBAAA;AAAA;AAAA,UAYnC,oBAAA;EACf,QAAA;EDlpBA;;;;;;ECypBA,KAAA;AAAA;AAAA,UAGe,oBAAA;EACf,YAAA;EACA,OAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,MAAA,CACJ,KAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,sBAAA;EAYL,OAAA,CAAA,GAAW,OAAA,CAAQ,sBAAA;EAMnB,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,wBAAA;EAQhC,MAAA,mBAAA,CACJ,IAAA,UACA,KAAA,WACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,eAAA,CAAgB,OAAA;EAAA,QAuDnB,aAAA;AAAA;AAAA,UAuDO,yBAAA;EACf,SAAA;EACA,GAAA;AAAA;AAAA,cAGW,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,sBAAA;EDvyBtB;;;ECgzBM,SAAA,CAAA,GAAa,OAAA,CAAQ,oBAAA;EAMrB,KAAA,CACJ,QAAA,UACA,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,qBAAA;EAcL,2BAAA,CACJ,OAAA,GAAS,qCAAA,GACR,OAAA,CAAQ,sCAAA;EAWL,8BAAA,CACJ,KAAA,EAAO,wCAAA,GACN,OAAA,CAAQ,yCAAA;ED30BwB;;;;EC01B7B,aAAA,CACJ,QAAA,UACA,MAAA,WACC,OAAA,CAAQ,wBAAA;EAWL,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;EAOtC,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAQjC,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,uBAAA;EAMhB,OAAA,CAAQ,UAAA,WAAqB,OAAA,CAAQ,2BAAA;EAOrC,IAAA,CAAK,UAAA,WAAqB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAa7B,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,qBAAA,CACJ,KAAA,EAAO,wCAAA,GACN,OAAA,CAAQ,yCAAA;EAWL,eAAA,CACJ,cAAA,WACC,OAAA,CAAQ,gCAAA;EAOL,SAAA,CACJ,cAAA,WACC,OAAA,CAAQ,6BAAA;EAOL,eAAA,CAAgB,KAAA;IACpB,KAAA;IACA,IAAA;EAAA,IACE,OAAA,CAAQ,mCAAA;AAAA;AAAA,cAYD,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA,GAAS,mBAAA,GAA2B,OAAA,CAAQ,gBAAA;AAAA;AAAA,cA2B5C,kBAAA;EAAA,iBAMQ,OAAA;EAAA,iBAIA,MAAA;cAJA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA,GACI,MAAA,KACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,cAAA,CAAe,UAAA;EAGxB,IAAA,CAAA,GAAQ,OAAA,CAAQ,WAAA;EAIhB,GAAA,CAAI,EAAA,WAAa,OAAA,CAAQ,WAAA;EAOzB,MAAA,CAAO,IAAA,WAAe,OAAA,CAAQ,WAAA;EAQ9B,MAAA,CAAO,EAAA,UAAY,IAAA,WAAe,OAAA,CAAQ,WAAA;EAW1C,MAAA,CAAO,EAAA,WAAa,OAAA;EDrgCxB;;AAGJ;;;EC6gCQ,UAAA,CAAW,EAAA,UAAY,OAAA,YAAmB,OAAA,CAAQ,WAAA;ED5gCxD;;;;EC2hCM,QAAA,CACJ,EAAA,UACA,IAAA;IAAQ,KAAA;IAAgB,MAAA;EAAA,IACvB,OAAA,CAAQ,mBAAA;EDthCI;;;;;AAIjB;;;;;;;ECyiCQ,GAAA,CACJ,EAAA,UACA,MAAA,GAAS,oBAAA,EACT,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,sBAAA;EDtiCX;;;AAGF;;;ECsjCQ,MAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,oBAAA;EDvjCX;;;;;;AAMF;;;ECikCQ,MAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,0BAAA;EDlkCX;;;;;AAIF;;;;;;;;;ECmlCS,QAAA,CACL,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,cAAA,CAAe,yBAAA;;;;ADtkCpB;;;;;;;;;AAKA;;;EC4oCQ,UAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IACE,cAAA;IACA,SAAA;IACA,MAAA,GAAS,WAAA;EAAA,IAEV,OAAA,CAAQ,oBAAA;EA2EL,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,2BAAA;EAQhC,MAAA,CAAA,GAAU,OAAA,CAAQ,yBAAA;AAAA;;;iBCr8CV,cAAA,CAAe,KAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/client.ts","../src/event-delivery.ts","../src/redaction.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,OAAA;EACA,IAAA,EAAM,KAAA;AAAA;AAAA,UAGS,gBAAA;EACf,OAAA;EACA,KAAA,EAAO,YAAA;AAAA;AAAA,KAGG,WAAA,UAAqB,kBAAA,CAAmB,KAAA,IAAS,gBAAA;AAAA,UAE5C,YAAA;EACf,IAAA,EAAM,YAAA;EACN,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,YAAA;AAAA,UAkDK,iBAAA;EACf,QAAA;EACA,SAAA,EAAW,YAAA;EACX,WAAA,EAAa,oBAAA;AAAA;AAAA,UAGE,YAAA;EACf,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,QAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,oBAAA;EACf,sBAAA;EACA,sBAAA;AAAA;AAAA,UAGe,aAAA;EACf,EAAA;EACA,UAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,sBAAA;EACf,WAAA,EAAa,aAAA;AAAA;AAAA,UAGE,eAAA;EACf,EAAA;EACA,IAAA;EACA,UAAA;EACA,YAAA;EACA,eAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,KAGU,UAAA,GAAa,eAAA;AAAA,UAER,mBAAA;EACf,QAAA,EAAU,UAAA;AAAA;AAAA,UAGK,4BAAA;EApDkB;AAGnC;;;EAsDE,eAAA;EACA,KAAA;AAAA;AAAA,UAGe,wBAAA;EACf,OAAA,EAAS,UAAA;EAvDT;EAyDA,OAAA;AAAA;AAAA,UAGe,wBAAA;EACf,OAAA;AAAA;AAAA,KAGU,uBAAA;AAAA,KAEA,iBAAA;EAEN,IAAA;EACA,EAAA;EAWA,KAAA,GAAQ,uBAAA,GAA0B,uBAAA;AAAA;EAElC,GAAA,EAAK,iBAAA;AAAA;EACL,GAAA,EAAK,iBAAA;AAAA;EACL,GAAA,EAAK,iBAAA;AAAA;AAAA,UAEM,0BAAA;EACf,MAAA;EACA,IAAA;EACA,IAAA,GAAO,iBAAA;AAAA;AAAA,KAGG,0BAAA;EACN,IAAA;EAAiB,SAAA;AAAA;EACjB,IAAA;EAAoB,YAAA;AAAA;AAAA,UAET,4BAAA;EACf,GAAA;EACA,MAAA;AAAA;AAAA,UAGe,iCAAA;EAzEf;;;;EA8EA,eAAA;EACA,KAAA;EACA,MAAA,EAAQ,0BAAA;EACR,KAAA;EACA,MAAA,GAAS,0BAAA;EACT,QAAA,EAAU,4BAAA;AAAA;AAAA,UAGK,oBAAA;EACf,EAAA;EACA,eAAA;EACA,KAAA;EACA,MAAA,EAAQ,0BAAA;EACR,UAAA;EACA,YAAA;EACA,KAAA;EACA,MAAA,EAAQ,0BAAA;EACR,UAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,6BAAA;EACf,aAAA,EAAe,oBAAA;AAAA;AAAA,UAGA,kCAAA;EACf,YAAA,EAAc,oBAAA;EAhFL;EAkFT,OAAA;AAAA;AAAA,UAGe,kCAAA;EACf,OAAA;AAAA;AAAA,UAGe,gBAAA;EACf,QAAA;EACA,YAAA;EACA,IAAA;EACA,MAAA;EACA,IAAA;EACA,UAAA;EACA,OAAA;AAAA;AAAA,UAGe,gBAAA;EACf,cAAA;EACA,UAAA;EACA,KAAA;EACA,MAAA;IACE,IAAA;IACA,EAAA;IACA,QAAA;IACA,KAAA;EAAA;EAEF,aAAA,EAAe,gBAAA;EACf,OAAA;AAAA;;KAIU,mBAAA;AAAA,UAEK,WAAA;EACf,UAAA;EACA,KAAA;EAzFI;EA2FJ,QAAA,EAAU,mBAAA;EA3FgB;;AAE5B;EA6FE,QAAA;EACA,QAAA;EACA,MAAA;EA9FA;;EAiGA,eAAA;EA/FO;;EAkGP,WAAA;EA/FU;;EAkGV,YAAA;EAlGoC;EAoGpC,MAAA;EAnGqB;;EAsGrB,UAAA;EArGoC;;AAEtC;;;EAyGE,sBAAA;AAAA;AAAA,UAGe,oBAAA;EACf,SAAA,EAAW,WAAA;;EAEX,gBAAA;AAAA;AAAA,UAGe,oBAAA;EACf,QAAA;EACA,SAAA;EACA,GAAA;AAAA;AAAA,UAGe,4BAAA;EACf,QAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;AAAA;AAAA,UAGe,0BAAA;EACf,QAAA;EACA,KAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,KAGU,qBAAA,GACR,4BAAA,GACA,0BAAA;AAAA,UAEa,qBAAA;EACf,QAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;EACA,GAAA;AAAA;AAAA,UAGe,qCAAA;EACf,SAAA;AAAA;AAAA,UAGe,sCAAA;EACf,QAAA;EACA,KAAA;EACA,QAAA;EACA,UAAA;EACA,KAAA;EACA,SAAA;EACA,MAAA;AAAA;AAAA,UAGe,wCAAA;EACf,IAAA;EACA,KAAA;EACA,MAAA;EACA,aAAA;EACA,UAAA;EACA,SAAA;AAAA;AAAA,UAGe,yCAAA;EACf,YAAA;EACA,QAAA;EACA,WAAA;EACA,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,wBAAA;EACf,YAAA;EACA,QAAA;EACA,GAAA;EACA,WAAA;AAAA;;;;UAMe,uBAAA;EACf,QAAA;EACA,MAAA;AAAA;;;UAKe,wBAAA;EACf,UAAA,EAAY,aAAA;EACZ,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,YAAA;AAAA;AAAA,UAGe,2BAAA;EACf,UAAA,EAAY,aAAA;AAAA;AAAA,UAGG,0BAAA;EACf,YAAA;AAAA;AAAA,KAGU,yBAAA;AAAA,UAMK,wBAAA;EACf,IAAA;EACA,OAAA;AAAA;AAAA,UAGe,uBAAA;EACf,MAAA,EAAQ,yBAAA;EACR,SAAA;EACA,KAAA,GAAQ,wBAAA;AAAA;AAAA,UAGO,2BAAA;EACf,UAAA,EAAY,aAAA;EACZ,MAAA,EAAQ,uBAAA;AAAA;AAAA,UAGO,aAAA;EACf,QAAA;EACA,UAAA;EACA,WAAA;EACA,SAAA;EACA,gBAAA;EACA,MAAA;EACA,UAAA;AAAA;;;;KAMU,WAAA;AAAA,UAEK,OAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;EACA,WAAA;EACA,WAAA;EACA,YAAA;EACA,kBAAA;EACA,gBAAA;EACA,4BAAA;EACA,WAAA;EACA,IAAA,GAAO,WAAA;AAAA;AAAA,UAGQ,sBAAA;EACf,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,qBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,sBAAA;EACf,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,uBAAA;EACf,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,IAAA,EAAM,OAAA;AAAA;AAAA,UAGS,cAAA;EACf,IAAA;EACA,KAAA;EACA,YAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA,EAAQ,OAAA;AAAA;AAAA,UAGO,mBAAA;EACf,YAAA;EACA,QAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,oBAAA;EACf,KAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,UAAA;EACA,YAAA;EACA,iBAAA;EACA,UAAA;EACA,SAAA;EACA,MAAA;EACA,aAAA,EAAe,gBAAA;EACf,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,UAGO,sBAAA;EACf,OAAA;EACA,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAGE,iBAAA;AAAA,UAEK,sBAAA;EACf,YAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;AAAA;AAAA,UAGK,oBAAA;EACf,YAAA;AAAA;AAAA,UAGe,sBAAA;EACf,YAAA;EACA,UAAA;AAAA;AAAA,UAGe,uBAAA;EACf,YAAA;EACA,UAAA;EApLA;EAsLA,OAAA;AAAA;AAAA,UAGe,SAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,QAAA,EAAU,iBAAA;EACV,SAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,MAAA,EAAQ,SAAA;AAAA;AAAA,UAGO,qBAAA;EACf,QAAA,EAAU,SAAA;AAAA;AAAA,UAGK,sBAAA;EACf,YAAA;EACA,UAAA;EA/LA;EAiMA,YAAA;EAhMW;EAkMX,OAAA;EACA,WAAA;AAAA;AAAA,UAGe,uBAAA;EACf,YAAA;EA/LM;EAiMN,QAAA;AAAA;AAAA,KAGU,iBAAA;AAAA,UAOK,WAAA;EACf,EAAA;EACA,YAAA;EACA,UAAA;EACA,UAAA;EACA,SAAA;EACA,kBAAA,EAAoB,MAAA;EACpB,MAAA,EAAQ,iBAAA;EACR,WAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,UAGe,0BAAA;EACf,OAAA;EACA,KAAA;EACA,SAAA;AAAA;AAAA,UAGe,2BAAA;EACf,QAAA,EAAU,WAAA;EACV,eAAA,GAAkB,0BAAA;AAAA;AAAA,UAGH,uBAAA;EACf,SAAA,EAAW,WAAA;AAAA;AAAA,UAGI,aAAA;EACf,EAAA;EACA,MAAA;EACA,YAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,QAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;EACA,KAAA;EACA,MAAA;EACA,KAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA,EAAQ,aAAA;EACR,UAAA;AAAA;AAAA,UAGe,6BAAA,SAAsC,gBAAA;EACrD,KAAA,EAAO,gBAAA;IAA8B,IAAA;EAAA;AAAA;AAAA,UAetB,wCAAA;EAtOgB;EAwO/B,OAAA;EArO4B;EAuO5B,cAAA;EAvO4B;;;;;EA6O5B,WAAA,GAAc,MAAA;EAvOd;EAyOA,UAAA;AAAA;AAAA,UAGe,yCAAA;EACf,KAAA;EACA,SAAA;EACA,cAAA;EACA,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,wBAAA;EACf,cAAA;EAjOkB;EAmOlB,YAAA;EACA,WAAA;EA5OA;EA8OA,mBAAA;EA5OA;EA8OA,aAAA;EACA,SAAA;AAAA;AAAA,UAGe,gCAAA;EACf,YAAA,EAAc,wBAAA;AAAA;AAAA,UAGC,6BAAA;EACf,cAAA;EAjPkB;EAmPlB,aAAA;AAAA;AAAA,UAGe,kCAAA;EACf,KAAA;EACA,IAAA;AAAA;AAAA,UAGe,mCAAA;EACf,SAAA;EACA,cAAA;AAAA;AAAA,UASe,iBAAA;EACf,IAAA;EACA,MAAA,EAAQ,MAAA;AAAA;;UAIO,sBAAA;EACf,KAAA;EACA,MAAA;EACA,IAAA;AAAA;AAAA,UAGe,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;EACA,QAAA;EACA,YAAA;EACA,WAAA,EAAa,sBAAA;EACb,IAAA;EACA,QAAA;EACA,UAAA;EACA,WAAA;AAAA;AAAA,UAGe,0BAAA;EACf,IAAA;EACA,OAAA;AAAA;AAAA,KAGU,oBAAA;;;UAcK,qBAAA;EACf,KAAA;EACA,IAAA;EACA,MAAA;EACA,SAAA;EACA,WAAA;EACA,KAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,KAAA;EACA,IAAA;AAAA;;AApRF;;UA0RiB,iBAAA;EACf,KAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,WAAA;EACA,UAAA,GAAa,qBAAA;AAAA;;UAIE,uBAAA;EACf,KAAA;EACA,IAAA;EA9RA;;;;;;EAqSA,MAAA;EA/Re;;;;AAIjB;;EAkSE,MAAA;EACA,KAAA;EACA,OAAA;EAhSe;;EAmSf,QAAA,GAAW,iBAAA;AAAA;;UAII,cAAA;EACf,EAAA;EACA,MAAA,EAAQ,oBAAA;EACR,aAAA,EAAe,uBAAA;EArSL;EAuSV,KAAA;EACA,QAAA;EAxS2B;;EA2S3B,kBAAA;EAzSqC;;EA4SrC,cAAA;EACA,SAAA;EACA,SAAA;EACA,WAAA;AAAA;;;AAzSF;;;;UAkTiB,oBAAA,SAA6B,cAAA;EAC5C,UAAA;EA/SqC;;;EAmTrC,cAAA;EACA,kBAAA;AAAA;;;;;;;KASU,oBAAA,GAAuB,MAAA;AAjTnC;AAAA,UAoTiB,sBAAA;EACf,KAAA;AAAA;;;;;;;;;;;UAae,0BAAA;EACf,KAAA;EACA,MAAA;EAzTA;;AAGF;;EA2TE,SAAA;AAAA;;AAvTF;;;;;;;KAkUY,yBAAA;EACN,IAAA;EAAkB,GAAA,EAAK,oBAAA;AAAA;EACvB,IAAA;EAAwB,KAAA;EAAe,IAAA;EAAc,EAAA;AAAA;EAErD,IAAA;EACA,KAAA;EACA,IAAA;EAIA,MAAA;EACA,OAAA;EACA,KAAA;EACA,EAAA;AAAA;EAGA,IAAA;EACA,WAAA;EACA,cAAA;EACA,KAAA;EACA,EAAA;AAAA;EAGA,IAAA;EACA,WAAA;EACA,cAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EACA,YAAA;EACA,OAAA;EACA,EAAA;AAAA;EAEA,IAAA;EAAe,WAAA;EAAqB,KAAA;EAAe,EAAA;AAAA;EACnD,IAAA;AAAA;EAEA,IAAA;EAGA,MAAA;EACA,KAAA;EACA,EAAA;AAAA;EAMA,IAAA;EACA,UAAA;EACA,EAAA;AAAA;;UAIW,qBAAA;EACf,EAAA;EACA,MAAA,EAAQ,oBAAA;EACR,KAAA;EACA,SAAA;EACA,WAAA;AAAA;;UAIe,mBAAA;EACf,IAAA,EAAM,cAAA;EACN,UAAA;AAAA;AAAA,UAGe,WAAA;EACf,EAAA;EACA,IAAA;EACA,WAAA;EACA,OAAA;EAhVS;EAkVT,OAAA,EAAS,iBAAA;EA/UyB;EAiVlC,cAAA;EACA,gBAAA,EAAkB,0BAAA;EAjVlB;EAmVA,QAAA,GAAW,kBAAA;EAjVX;;EAoVA,eAAA,GAAkB,iBAAA;EAjVlB;EAmVA,OAAA,GAAU,qBAAA;EACV,SAAA;EACA,SAAA;AAAA;;;;UAMe,iBAAA;EACf,IAAA;EACA,QAAA;AAAA;AAAA,KAGU,2BAAA;EACN,KAAA;EAAa,IAAA;EAAc,WAAA;EAAqB,YAAA;AAAA;EAChD,KAAA;EAAc,MAAA,EAAQ,0BAAA;AAAA;;KAGhB,yBAAA,GAA4B,MAAA;;;KC54B5B,cAAA,SAAuB,WAAA,GAAc,OAAA,CAAQ,WAAA;AAAA,UAExC,gBAAA;EACf,OAAA;EACA,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,cAGJ,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,YAAA;EAAA,SACN,OAAA;EAAA,SACA,MAAA;cAEG,KAAA,EAAO,YAAA,EAAc,OAAA;IAAW,MAAA;EAAA;AAAA;AAAA,cA6RjC,eAAA;AAAA,cACA,mBAAA;AAAA,cACA,4BAAA;AAAA,KAGD,MAAA,GAAS,MAAA;AAAA,UAEJ,uBAAA;EACf,GAAA,GAAM,MAAA;EACN,MAAA;EACA,WAAA,GAAc,cAAA;EACd,KAAA,UAAe,KAAA;AAAA;AAAA,iBAOD,iBAAA,CAAkB,GAAA,GAAK,MAAA;AAAA,iBA2BvB,cAAA,CAAe,GAAA,GAAK,MAAA;AAAA,cAyCvB,SAAA;EAAA,SACF,OAAA;EAAA,SACA,KAAA,SAAc,KAAA;EAAA,SACd,MAAA;EAAA,SACA,WAAA,GAAc,cAAA;EAAA,SACd,WAAA,EAAa,oBAAA;EAAA,SACb,QAAA,EAAU,iBAAA;EAAA,SACV,kBAAA,EAAoB,2BAAA;EAAA,SACpB,WAAA,EAAa,oBAAA;EAAA,SACb,MAAA,EAAQ,eAAA;EAAA,SACR,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;EAAA,SACX,KAAA,EAAO,cAAA;EAAA,SACP,SAAA,EAAW,kBAAA;EAAA,SACX,SAAA,EAAW,kBAAA;cAER,OAAA,EAAS,gBAAA;EAAA,OA0Cd,OAAA,CAAQ,OAAA,GAAS,uBAAA,GAA+B,SAAA;EAajD,MAAA,CAAA,GAAU,OAAA,CAAQ,iBAAA;EAAA,QAIV,OAAA;EDvfP;;AAGT;;;;;AAkDA;;;;EArDS,QC6iBO,MAAA;EAAA,QA2CA,YAAA;AAAA;AAAA,UA2BC,mBAAA;EACf,cAAA;AAAA;AAAA,cAGW,eAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA;IACT,UAAA;IACA,YAAA;IACA,QAAA;IACA,UAAA;EAAA,IACE,OAAA,CAAQ,oBAAA;EAQN,IAAA,CACJ,OAAA,GAAS,mBAAA,GACR,OAAA,CAAQ,qBAAA;EAuBL,MAAA,CAAO,OAAA,WAAkB,OAAA,CAAQ,sBAAA;AAAA;AAAA,cAY5B,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,YAAA,WAAuB,OAAA,CAAQ,qBAAA;EAOpC,GAAA,CAAI,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,iBAAA;ED3nB5B;ECooBhB,MAAA,CACJ,KAAA,EAAO,sBAAA,GACN,OAAA,CAAQ,uBAAA;EDnoBiB;;;EC8oBtB,WAAA,CAAY,YAAA,WAAuB,OAAA,CAAQ,sBAAA;ED5oBjD;;ECypBM,YAAA,CAAa,YAAA,WAAuB,OAAA,CAAQ,uBAAA;AAAA;AAAA,UAYnC,oBAAA;EACf,QAAA;EDhqBA;;;;;AAKF;ECkqBE,KAAA;AAAA;AAAA,UAGe,oBAAA;EACf,YAAA;EACA,OAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,MAAA,CACJ,KAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,sBAAA;EAYL,OAAA,CAAA,GAAW,OAAA,CAAQ,sBAAA;EAMnB,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,wBAAA;EAQhC,MAAA,mBAAA,CACJ,IAAA,UACA,KAAA,WACA,OAAA,GAAS,oBAAA,GACR,OAAA,CAAQ,eAAA,CAAgB,OAAA;EAAA,QAuDnB,aAAA;AAAA;AAAA,UAuDO,yBAAA;EACf,SAAA;EACA,GAAA;AAAA;AAAA,cAGW,iBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,mBAAA;EAMhB,WAAA,CACJ,KAAA,GAAO,4BAAA,GACN,OAAA,CAAQ,wBAAA;EAQL,MAAA,CAAO,SAAA,WAAoB,OAAA,CAAQ,wBAAA;AAAA;AAAA,cAQ9B,2BAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,6BAAA;EAOhB,MAAA,CACJ,KAAA,EAAO,iCAAA,GACN,OAAA,CAAQ,kCAAA;EAWL,MAAA,CACJ,cAAA,WACC,OAAA,CAAQ,kCAAA;AAAA;AAAA,cAQA,oBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,sBAAA;;;;EAShB,SAAA,CAAA,GAAa,OAAA,CAAQ,oBAAA;EAMrB,KAAA,CACJ,QAAA,UACA,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,qBAAA;EAcL,2BAAA,CACJ,OAAA,GAAS,qCAAA,GACR,OAAA,CAAQ,sCAAA;EAWL,8BAAA,CACJ,KAAA,EAAO,wCAAA,GACN,OAAA,CAAQ,yCAAA;ED75BI;;;;EC46BT,aAAA,CACJ,QAAA,UACA,MAAA,WACC,OAAA,CAAQ,wBAAA;EAWL,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;EAOtC,MAAA,CAAO,YAAA,WAAuB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAQjC,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAA,GAAQ,OAAA,CAAQ,uBAAA;EAMhB,OAAA,CAAQ,UAAA,WAAqB,OAAA,CAAQ,2BAAA;EAOrC,IAAA,CAAK,UAAA,WAAqB,OAAA,CAAQ,2BAAA;AAAA;AAAA,cAa7B,kBAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,qBAAA,CACJ,KAAA,EAAO,wCAAA,GACN,OAAA,CAAQ,yCAAA;EAWL,eAAA,CACJ,cAAA,WACC,OAAA,CAAQ,gCAAA;EAOL,SAAA,CACJ,cAAA,WACC,OAAA,CAAQ,6BAAA;EAOL,eAAA,CAAgB,KAAA;IACpB,KAAA;IACA,IAAA;EAAA,IACE,OAAA,CAAQ,mCAAA;AAAA;AAAA,cAYD,cAAA;EAAA,iBAEQ,OAAA;cAAA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA;EAGT,IAAA,CAAK,OAAA,GAAS,mBAAA,GAA2B,OAAA,CAAQ,gBAAA;AAAA;AAAA,cA2B5C,kBAAA;EAAA,iBAMQ,OAAA;EAAA,iBAIA,MAAA;cAJA,OAAA,UACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,KAAA,GACI,MAAA,KACf,IAAA,UACA,IAAA,EAAM,WAAA,KACH,OAAA,CAAQ,cAAA,CAAe,UAAA;EAGxB,IAAA,CAAA,GAAQ,OAAA,CAAQ,WAAA;EAIhB,GAAA,CAAI,EAAA,WAAa,OAAA,CAAQ,WAAA;EAOzB,MAAA,CAAO,IAAA,WAAe,OAAA,CAAQ,WAAA;EAQ9B,MAAA,CAAO,EAAA,UAAY,IAAA,WAAe,OAAA,CAAQ,WAAA;EAW1C,MAAA,CAAO,EAAA,WAAa,OAAA;EDrlCnB;;;AAGT;;EC6lCQ,UAAA,CAAW,EAAA,UAAY,OAAA,YAAmB,OAAA,CAAQ,WAAA;ED7lCpB;;;;EC4mC9B,QAAA,CACJ,EAAA,UACA,IAAA;IAAQ,KAAA;IAAgB,MAAA;EAAA,IACvB,OAAA,CAAQ,mBAAA;ED3mCgC;;;;AAK7C;;;;;;;;EC6nCQ,GAAA,CACJ,EAAA,UACA,MAAA,GAAS,oBAAA,EACT,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,sBAAA;ED1nCH;;;;;;EC6oCF,MAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,oBAAA;ED3oCwB;;;;;;;;;EC2pC7B,MAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,OAAA,CAAQ,0BAAA;EDvpCH;;;;;;;;AAQV;;;;;AAIA;ECgqCS,QAAA,CACL,EAAA,UACA,KAAA,UACA,IAAA;IAAQ,MAAA,GAAS,WAAA;EAAA,IAChB,cAAA,CAAe,yBAAA;EDnqClB;;;;;AAKF;;;;;AAIA;;;;;ECquCQ,UAAA,CACJ,EAAA,UACA,KAAA,UACA,IAAA;IACE,cAAA;IACA,SAAA;IACA,MAAA,GAAS,WAAA;EAAA,IAEV,OAAA,CAAQ,oBAAA;EA2EL,QAAA,CAAS,IAAA,WAAe,OAAA,CAAQ,2BAAA;EAQhC,MAAA,CAAA,GAAU,OAAA,CAAQ,yBAAA;AAAA;;;KCphDd,wBAAA;AAAA,KAMA,uBAAA;EACN,KAAA;EAAa,SAAA;AAAA;EACb,KAAA;EAAc,MAAA,EAAQ,wBAAA;AAAA;AAAA,UAEX,4BAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA;EACA,gBAAA;EACA,GAAA,YAAe,IAAA;AAAA;AAAA,UAGA,iCAAA;EFvBgB;EEyB/B,UAAA;EFvBmB;EEyBnB,SAAA;EFzBA;EE2BA,OAAA;EF3BmB;EE6BnB,SAAA;AAAA;AAAA,KAGU,0BAAA;AAAA,KASA,qBAAA;EACN,EAAA;EAAU,QAAA,EAAU,gBAAA;AAAA;EAEpB,EAAA;EACA,IAAA,EAAM,0BAAA;EACN,QAAA,EAAU,QAAA;AAAA;AAAA,UAGC,gCAAA;EACf,OAAA,EAAS,OAAA;EF/CkE;EEiD3E,MAAA;EF/Ce;EEiDf,YAAA;EACA,gBAAA;EACA,GAAA,YAAe,IAAA;AAAA;AAAA,cAGJ,qBAAA,SAA8B,KAAA;EAAA,SAChC,IAAA;cASG,IAAA,EAAM,qBAAA,UAA+B,OAAA;AAAA;;AF1DnD;;;;iBEsEsB,4BAAA,CACpB,KAAA,EAAO,iCAAA,GACN,OAAA;AFtBH;;;;;;;AAAA,iBEuEsB,2BAAA,CACpB,KAAA,EAAO,gCAAA,GACN,OAAA,CAAQ,qBAAA;;;;AFnEX;;iBEoJsB,uBAAA,CACpB,KAAA,EAAO,4BAAA,GACN,OAAA,CAAQ,uBAAA;AAAA,iBA0DK,qBAAA,CACd,KAAA,qBACC,gBAAA;;;iBCzRa,cAAA,CAAe,KAAA"}

package/dist/index.js

@@ -49,7 +49,7 @@ function isHubErrorEnvelope(value) {
 function isHubSuccessEnvelope(value) {
 	return typeof value === "object" && value !== null && value.success === true;
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
 function optString(value) {
@@ -83,7 +83,7 @@ function isRunDoneStatus(value) {
 */
 function toRunStreamEvent(eventType, data) {
 	if (eventType === "ping") return { type: "ping" };
-	if (!isRecord(data)) return null;
+	if (!isRecord$1(data)) return null;
 	switch (eventType) {
 		case "snapshot": return typeof data.id === "string" && typeof data.workflowId === "string" && typeof data.status === "string" && Array.isArray(data.actionResults) ? {
 			type: "snapshot",
@@ -226,6 +226,8 @@ var HubClient = class HubClient {
 	apiKey;
 	authHeaders;
 	connections;
+	channels;
+	eventSubscriptions;
 	permissions;
 	tokens;
 	tools;
@@ -239,6 +241,8 @@ var HubClient = class HubClient {
 		this.authHeaders = options.authHeaders;
 		this.fetch = options.fetch ?? fetch.bind(globalThis);
 		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
+		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
 		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
 		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
 		this.tools = new HubToolsClient((path, init) => this.request(path, init));
@@ -504,6 +508,42 @@ function validateApprovedExecution(approved, path, connectionId) {
 		}
 	});
 }
+var HubChannelsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/channels", { method: "GET" });
+	}
+	async createEmail(input = {}) {
+		return this.request("/v1/hub/channels/email", {
+			method: "POST",
+			body: JSON.stringify(input),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async delete(channelId) {
+		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
+	}
+};
+var HubEventSubscriptionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	}
+	async create(input) {
+		return this.request("/v1/hub/event-subscriptions", {
+			method: "POST",
+			body: JSON.stringify(input),
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	async delete(subscriptionId) {
+		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
+	}
+};
 var HubConnectionsClient = class {
 	constructor(request) {
 		this.request = request;
@@ -832,6 +872,263 @@ var HubWorkflowsClient = class {
 	}
 };
 //#endregion
-export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubApprovalsClient, HubAuditClient, HubClient, HubConnectionsClient, HubGithubAppClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, redactHubValue, resolveHubAuth, resolveHubBaseUrl };
+//#region src/event-delivery.ts
+const DEFAULT_TOLERANCE_SECONDS = 300;
+const MAX_TOLERANCE_SECONDS = 3600;
+const MAX_SIGNATURE_HEADER_LENGTH = 1024;
+const MAX_SIGNATURES = 5;
+const SHA256_HEX_LENGTH = 64;
+const MIN_CALLBACK_SECRET_BYTES = 32;
+const MAX_SECRET_SCOPE_COMPONENT_BYTES = 512;
+const DEFAULT_MAX_CALLBACK_BODY_BYTES = 5308416;
+const MAX_CALLBACK_BODY_BYTES = 10 * 1024 * 1024;
+var HubEventDeliveryError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "HubEventDeliveryError";
+		this.code = code;
+	}
+};
+/**
+* Derive one callback secret per product binding from a single server-held root
+* secret. Products persist only the binding id; the derived secret can be
+* reproduced for callback authentication without another secret table.
+*/
+async function deriveHubEventCallbackSecret(input) {
+	const encoder = new TextEncoder();
+	if (encoder.encode(input.rootSecret).byteLength < MIN_CALLBACK_SECRET_BYTES) throw new HubEventDeliveryError("INVALID_CALLBACK_SECRET", `Hub event root secret must contain at least ${MIN_CALLBACK_SECRET_BYTES} UTF-8 bytes`);
+	for (const [name, value] of [
+		["productId", input.productId],
+		["ownerId", input.ownerId],
+		["bindingId", input.bindingId]
+	]) {
+		const bytes = encoder.encode(value).byteLength;
+		if (bytes === 0 || bytes > MAX_SECRET_SCOPE_COMPONENT_BYTES) throw new HubEventDeliveryError("INVALID_SECRET_SCOPE", `${name} must contain 1-${MAX_SECRET_SCOPE_COMPONENT_BYTES} UTF-8 bytes`);
+	}
+	const subtle = requireSubtleCrypto();
+	const key = await subtle.importKey("raw", encoder.encode(input.rootSecret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const scope = JSON.stringify([
+		"tangle-hub-event-callback",
+		1,
+		input.productId,
+		input.ownerId,
+		input.bindingId
+	]);
+	return bytesToBase64Url(new Uint8Array(await subtle.sign("HMAC", key, encoder.encode(scope))));
+}
+/**
+* Authenticate and parse the platform's callback as one operation. The exact
+* raw body is read once with a size limit before its signature is checked.
+*
+* A successful callback can be retried. Use `delivery.runId` as the durable
+* idempotency key before starting product work.
+*/
+async function authenticateHubEventRequest(input) {
+	if (input.request.method !== "POST") return requestFailure("METHOD_NOT_ALLOWED", 405, "method_not_allowed", { Allow: "POST" });
+	if (input.request.headers.get("x-tangle-event") !== "hub.event") return requestFailure("UNEXPECTED_EVENT", 400, "invalid_hub_event");
+	const contentType = input.request.headers.get("content-type") ?? "";
+	if (!/^application\/json(?:\s*;|$)/i.test(contentType)) return requestFailure("UNSUPPORTED_MEDIA_TYPE", 415, "unsupported_media_type");
+	const maxBodyBytes = input.maxBodyBytes ?? DEFAULT_MAX_CALLBACK_BODY_BYTES;
+	if (!Number.isSafeInteger(maxBodyBytes) || maxBodyBytes < 1 || maxBodyBytes > MAX_CALLBACK_BODY_BYTES) throw new HubEventDeliveryError("INVALID_BODY_LIMIT", `Hub event body limit must be an integer from 1 to ${MAX_CALLBACK_BODY_BYTES} bytes`);
+	if (new TextEncoder().encode(input.secret).byteLength < MIN_CALLBACK_SECRET_BYTES) throw new HubEventDeliveryError("INVALID_CALLBACK_SECRET", `Hub event callback secret must contain at least ${MIN_CALLBACK_SECRET_BYTES} UTF-8 bytes`);
+	const declaredLength = input.request.headers.get("content-length");
+	if (declaredLength !== null && /^\d+$/.test(declaredLength) && Number(declaredLength) > maxBodyBytes) return requestFailure("PAYLOAD_TOO_LARGE", 413, "payload_too_large");
+	const body = await readRequestBody(input.request, maxBodyBytes);
+	if (body === null) return requestFailure("PAYLOAD_TOO_LARGE", 413, "payload_too_large");
+	if (!(await verifyHubEventSignature({
+		body,
+		signature: input.request.headers.get("x-tangle-signature"),
+		secret: input.secret,
+		...input.toleranceSeconds !== void 0 ? { toleranceSeconds: input.toleranceSeconds } : {},
+		...input.now !== void 0 ? { now: input.now } : {}
+	})).valid) return requestFailure("INVALID_SIGNATURE", 401, "invalid_signature");
+	let delivery;
+	try {
+		delivery = parseHubEventDelivery(body);
+	} catch (error) {
+		if (error instanceof HubEventDeliveryError) return requestFailure("INVALID_DELIVERY", 400, "invalid_delivery");
+		throw error;
+	}
+	if (input.request.headers.get("x-tangle-delivery-id") !== delivery.runId) return requestFailure("DELIVERY_ID_MISMATCH", 400, "invalid_delivery");
+	return {
+		ok: true,
+		delivery
+	};
+}
+/**
+* Authenticate a Hub event callback against its exact raw request body.
+* The timestamp window rejects captured-request replay, and byte-wise
+* comparison avoids secret-dependent string comparison behavior.
+*/
+async function verifyHubEventSignature(input) {
+	if (!input.signature) return {
+		valid: false,
+		reason: "missing"
+	};
+	if (input.signature.length > MAX_SIGNATURE_HEADER_LENGTH) return {
+		valid: false,
+		reason: "malformed"
+	};
+	const parsed = parseSignatureHeader(input.signature);
+	if (!parsed) return {
+		valid: false,
+		reason: "malformed"
+	};
+	const tolerance = input.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+	if (!Number.isFinite(tolerance) || !Number.isInteger(tolerance) || tolerance < 0 || tolerance > MAX_TOLERANCE_SECONDS) throw new HubEventDeliveryError("INVALID_TOLERANCE", `Signature tolerance must be an integer from 0 to ${MAX_TOLERANCE_SECONDS} seconds`);
+	const nowMs = input.now instanceof Date ? input.now.getTime() : typeof input.now === "number" ? input.now : Date.now();
+	if (!Number.isFinite(nowMs) || Math.abs(Math.floor(nowMs / 1e3) - parsed.timestamp) > tolerance) return {
+		valid: false,
+		reason: "stale"
+	};
+	const subtle = requireSubtleCrypto();
+	const encoder = new TextEncoder();
+	const key = await subtle.importKey("raw", encoder.encode(input.secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const expected = new Uint8Array(await subtle.sign("HMAC", key, encoder.encode(`${parsed.timestamp}.${input.body}`)));
+	let matched = 0;
+	for (const signature of parsed.signatures) matched |= constantTimeEqual(expected, signature);
+	return matched === 1 ? {
+		valid: true,
+		timestamp: parsed.timestamp
+	} : {
+		valid: false,
+		reason: "mismatch"
+	};
+}
+function parseHubEventDelivery(input) {
+	let value = input;
+	if (typeof input === "string") try {
+		value = JSON.parse(input);
+	} catch {
+		throw new HubEventDeliveryError("INVALID_JSON", "Hub event callback body is not valid JSON");
+	}
+	if (!isRecord(value)) return invalidDelivery();
+	const source = value.source;
+	const providerEvent = value.providerEvent;
+	if (!nonEmptyString(value.subscriptionId) || !nonEmptyString(value.workflowId) || !nonEmptyString(value.runId) || !isRecord(source) || source.kind !== "channel" && source.kind !== "connection" || !nonEmptyString(source.id) || !nonEmptyString(source.provider) || !nonEmptyString(source.event) || !isRecord(providerEvent) || !nonEmptyString(providerEvent.provider) || !nonEmptyString(providerEvent.connectionId) || !nonEmptyString(providerEvent.type) || providerEvent.provider !== source.provider || providerEvent.type !== source.event || !Object.hasOwn(providerEvent, "payload") || !optionalString(providerEvent.action) || !optionalString(providerEvent.repo) || !optionalString(providerEvent.deliveryId) || !nonEmptyString(value.firedAt) || !Number.isFinite(Date.parse(value.firedAt))) return invalidDelivery();
+	return {
+		subscriptionId: value.subscriptionId,
+		workflowId: value.workflowId,
+		runId: value.runId,
+		source: {
+			kind: source.kind,
+			id: source.id,
+			provider: source.provider,
+			event: source.event
+		},
+		providerEvent: {
+			provider: providerEvent.provider,
+			connectionId: providerEvent.connectionId,
+			type: providerEvent.type,
+			...typeof providerEvent.action === "string" ? { action: providerEvent.action } : {},
+			...typeof providerEvent.repo === "string" ? { repo: providerEvent.repo } : {},
+			...typeof providerEvent.deliveryId === "string" ? { deliveryId: providerEvent.deliveryId } : {},
+			payload: providerEvent.payload
+		},
+		firedAt: value.firedAt
+	};
+}
+function parseSignatureHeader(header) {
+	let timestamp;
+	const signatures = [];
+	for (const segment of header.split(",")) {
+		const separator = segment.indexOf("=");
+		if (separator <= 0) return null;
+		const key = segment.slice(0, separator).trim();
+		const value = segment.slice(separator + 1).trim();
+		if (key === "t") {
+			if (timestamp !== void 0 || !/^\d+$/.test(value)) return null;
+			const candidate = Number(value);
+			if (!Number.isSafeInteger(candidate) || candidate <= 0) return null;
+			timestamp = candidate;
+		} else if (key === "v1") {
+			if (signatures.length >= MAX_SIGNATURES || value.length !== SHA256_HEX_LENGTH || !/^[0-9a-f]+$/i.test(value)) return null;
+			signatures.push(hexToBytes(value));
+		}
+	}
+	return timestamp !== void 0 && signatures.length > 0 ? {
+		timestamp,
+		signatures
+	} : null;
+}
+function hexToBytes(hex) {
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+	return bytes;
+}
+function constantTimeEqual(expected, actual) {
+	let difference = expected.length ^ actual.length;
+	const length = Math.max(expected.length, actual.length);
+	for (let index = 0; index < length; index += 1) difference |= (expected[index % expected.length] ?? 0) ^ (actual[index % actual.length] ?? 0);
+	return difference === 0 ? 1 : 0;
+}
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function optionalString(value) {
+	return value === void 0 || nonEmptyString(value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidDelivery() {
+	throw new HubEventDeliveryError("INVALID_PAYLOAD", "Hub event callback body does not match the delivery contract");
+}
+function requireSubtleCrypto() {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) throw new HubEventDeliveryError("CRYPTO_UNAVAILABLE", "Web Crypto is required for Hub event callback authentication");
+	return subtle;
+}
+function bytesToBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function readRequestBody(request, maxBytes) {
+	const reader = request.body?.getReader();
+	if (!reader) return "";
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			total += next.value.byteLength;
+			if (total > maxBytes) return null;
+			chunks.push(next.value);
+		}
+	} finally {
+		await reader.cancel().catch(() => {});
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(body);
+}
+function requestFailure(code, status, error, headers) {
+	return {
+		ok: false,
+		code,
+		response: Response.json({ error }, {
+			status,
+			headers: {
+				"cache-control": "no-store",
+				...headers ? Object.fromEntries(new Headers(headers)) : {}
+			}
+		})
+	};
+}
+//#endregion
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubApprovalsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/redaction.ts","../src/client.ts"],"sourcesContent":["const SECRET_KEY_PATTERN =\n  /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;\nconst SECRET_VALUE_PATTERN =\n  /\\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\\b/g;\n\nexport function redactHubValue(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    return value.replace(SECRET_VALUE_PATTERN, \"[REDACTED]\");\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactHubValue(item));\n  }\n\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entryValue]) => [\n        key,\n        SECRET_KEY_PATTERN.test(key)\n          ? \"[REDACTED]\"\n          : redactHubValue(entryValue),\n      ]),\n    );\n  }\n\n  return value;\n}\n","import { SSEChunkParser } from \"@tangle-network/sdk-telemetry\";\nimport { redactHubValue } from \"./redaction.js\";\nimport type {\n  HubAllowWritesResponse,\n  HubApiKeyConnectResponse,\n  HubApprovalDecisionResponse,\n  HubApprovalListResponse,\n  HubAuditListRequest,\n  HubAuditResponse,\n  HubConnectionDeleteResponse,\n  HubConnectionHealthResponse,\n  HubConnectionsResponse,\n  HubErrorBody,\n  HubErrorEnvelope,\n  HubExecResponse,\n  HubGithubAppInstallationResponse,\n  HubGithubAppIsRepoInstalledResponse,\n  HubGithubAppListReposResponse,\n  HubGithubAppMintInstallationTokenRequest,\n  HubGithubAppMintInstallationTokenResponse,\n  HubOAuthStartResponse,\n  HubPolicyDeleteRequest,\n  HubPolicyDeleteResponse,\n  HubPolicyListResponse,\n  HubPolicyResponse,\n  HubPolicyUpdateRequest,\n  HubProvidersResponse,\n  HubRevertWritesResponse,\n  HubStatusResponse,\n  HubSuccessEnvelope,\n  HubTokenMintResponse,\n  HubTokenRevokeResponse,\n  HubTokensListResponse,\n  HubToolSourcesResponse,\n  HubToolsDescribeResponse,\n  HubToolsSearchResponse,\n  HubWhatsappEmbeddedSignupCompleteRequest,\n  HubWhatsappEmbeddedSignupCompleteResponse,\n  HubWhatsappEmbeddedSignupStartRequest,\n  HubWhatsappEmbeddedSignupStartResponse,\n  HubWorkflow,\n  HubWorkflowRunCancelResult,\n  HubWorkflowRunDetail,\n  HubWorkflowRunEnqueued,\n  HubWorkflowRunInputs,\n  HubWorkflowRunStatus,\n  HubWorkflowRunStreamEvent,\n  HubWorkflowRunsPage,\n  HubWorkflowSchemaResponse,\n  HubWorkflowValidateResponse,\n} from \"./types.js\";\n\nexport type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;\n\nexport interface HubClientOptions {\n  baseUrl: string;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\nexport class HubSdkError extends Error {\n  readonly code: HubErrorBody[\"code\"];\n  readonly details?: unknown;\n  readonly status?: number;\n\n  constructor(error: HubErrorBody, options: { status?: number } = {}) {\n    super(String(redactHubValue(error.message)));\n    this.name = \"HubSdkError\";\n    this.code = error.code;\n    this.details = redactHubValue(error.details);\n    this.status = options.status;\n  }\n}\n\n// Cap a response body at a readable length for inclusion in an error's\n// `details.bodySnippet`. The HubSdkError constructor runs the result through\n// `redactHubValue`, so token-shaped substrings in an upstream error page are\n// scrubbed before they reach the snippet.\nfunction bodySnippet(body: string, max = 200): string {\n  const trimmed = body.trim();\n  return trimmed.length > max ? `${trimmed.slice(0, max)}…` : trimmed;\n}\n\n// Transport-level failure: the response was not a hub envelope. Carries the\n// numeric HTTP status on both `code` (HUB_HTTP_<status>) and `status`, plus a\n// body snippet, so callers see the real status instead of a JSON parse error.\nfunction httpError(\n  path: string,\n  status: number,\n  statusText: string,\n  body: string,\n  contentType: string,\n): HubSdkError {\n  const suffix = statusText ? ` ${statusText}` : \"\";\n  return new HubSdkError(\n    {\n      code: `HUB_HTTP_${status}`,\n      message: `Hub request ${path} failed: HTTP ${status}${suffix}`,\n      details: {\n        status,\n        path,\n        contentType: contentType || null,\n        bodySnippet: bodySnippet(body),\n      },\n    },\n    { status },\n  );\n}\n\nfunction isHubErrorEnvelope(value: unknown): value is HubErrorEnvelope {\n  if (typeof value !== \"object\" || value === null) return false;\n  const candidate = value as { success?: unknown; error?: unknown };\n  if (candidate.success !== false) return false;\n  const error = candidate.error as { code?: unknown } | undefined;\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    typeof error.code === \"string\"\n  );\n}\n\nfunction isHubSuccessEnvelope<TData>(\n  value: unknown,\n): value is HubSuccessEnvelope<TData> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { success?: unknown }).success === true\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction optString(value: unknown): string {\n  return typeof value === \"string\" ? value : \"\";\n}\n\n/** An agent iteration's terminal status (`iteration.ended`) — only ever\n *  succeeded/failed; an iteration is never guard-skipped. */\nfunction isIterationStatus(value: unknown): value is \"succeeded\" | \"failed\" {\n  return value === \"succeeded\" || value === \"failed\";\n}\n\n/** An action's terminal status on `action.finished`. Beyond succeeded/failed a\n *  guarded action can end `skipped` (its `if` resolved false, so it never ran) —\n *  accepted here so a skipped event is surfaced, not dropped as malformed. */\nfunction isActionFinishedStatus(\n  value: unknown,\n): value is \"succeeded\" | \"failed\" | \"skipped\" {\n  return value === \"succeeded\" || value === \"failed\" || value === \"skipped\";\n}\n\n/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`\n *  (a user cancel) — a value neither the action nor iteration status checkers\n *  accept — so `run.done` uses this rather than them, which would drop a\n *  cancelled terminal event and hang the stream. */\nfunction isRunDoneStatus(\n  value: unknown,\n): value is \"succeeded\" | \"failed\" | \"cancelled\" {\n  return value === \"succeeded\" || value === \"failed\" || value === \"cancelled\";\n}\n\n/**\n * Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed\n * run-stream event, validating the fields each variant declares rather than\n * blindly casting the wire payload. A frame that doesn't match its event's\n * shape (or an unknown event name) returns null so the consumer skips it — a\n * malformed `token` can never reach a consumer as `{ delta: undefined }`, and\n * new server event kinds don't break older clients.\n */\nfunction toRunStreamEvent(\n  eventType: string | undefined,\n  data: unknown,\n): HubWorkflowRunStreamEvent | null {\n  if (eventType === \"ping\") return { type: \"ping\" };\n  if (!isRecord(data)) return null;\n  switch (eventType) {\n    case \"snapshot\":\n      // The snapshot payload is the full run detail. HubWorkflowRunDetail narrows\n      // status/actionResults from optional to REQUIRED, so validate those anchors\n      // (not just id/workflowId) before the cast — otherwise a contract-breaking\n      // server response would hand consumers `undefined` where the type promises a\n      // value. `status` is checked as a present string rather than against the\n      // enum so a new server-side status doesn't drop an otherwise-valid snapshot.\n      return typeof data.id === \"string\" &&\n        typeof data.workflowId === \"string\" &&\n        typeof data.status === \"string\" &&\n        Array.isArray(data.actionResults)\n        ? { type: \"snapshot\", run: data as unknown as HubWorkflowRunDetail }\n        : null;\n    case \"token\":\n      // `delta` is the one field a consumer writes to stdout raw, so a\n      // non-string drops the frame instead of crashing downstream.\n      return typeof data.delta === \"string\" &&\n        typeof data.actionIndex === \"number\"\n        ? {\n            type: \"token\",\n            actionIndex: data.actionIndex,\n            delta: data.delta,\n            at: optString(data.at),\n          }\n        : null;\n    case \"run.done\":\n      // The terminal signal — a bad status must not masquerade as completion,\n      // but `cancelled` is a valid terminal outcome (a user-cancelled run) and\n      // must be surfaced, not dropped, so the stream ends instead of hanging.\n      return isRunDoneStatus(data.status)\n        ? {\n            type: \"run.done\",\n            status: data.status,\n            error: typeof data.error === \"string\" ? data.error : null,\n            ...(typeof data.at === \"string\" ? { at: data.at } : {}),\n          }\n        : null;\n    case \"run.waiting\":\n      // The run PARKED on a human `decision` step — non-terminal, but it ENDS the\n      // live stream (no further ticks until it resumes, a fresh execution). Surface\n      // it with the pending decision id so a consumer stops watching and prompts\n      // for a resolution instead of hanging or reading it as completion. Require a\n      // NON-EMPTY decisionId: a blank one is unactionable (the consumer couldn't\n      // resolve it), so drop the frame rather than end the stream on a dead id.\n      return typeof data.decisionId === \"string\" && data.decisionId.length > 0\n        ? {\n            type: \"run.waiting\",\n            decisionId: data.decisionId,\n            ...(typeof data.at === \"string\" ? { at: data.at } : {}),\n          }\n        : null;\n    // Lifecycle events: construct the result from the SSE frame's `eventType`\n    // with the required fields validated, so the yielded `.type` always matches\n    // the frame (never the payload's own `type`, which may drift or be absent)\n    // and only validated optional fields are copied.\n    case \"action.started\":\n      return typeof data.index === \"number\" &&\n        typeof data.kind === \"string\" &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"action.started\",\n            index: data.index,\n            kind: data.kind,\n            at: data.at,\n          }\n        : null;\n    case \"action.finished\":\n      return typeof data.index === \"number\" &&\n        typeof data.kind === \"string\" &&\n        isActionFinishedStatus(data.status) &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"action.finished\",\n            index: data.index,\n            kind: data.kind,\n            status: data.status,\n            at: data.at,\n            ...(typeof data.costUsd === \"number\"\n              ? { costUsd: data.costUsd }\n              : {}),\n            ...(typeof data.error === \"string\" ? { error: data.error } : {}),\n          }\n        : null;\n    case \"iteration.started\":\n      return typeof data.actionIndex === \"number\" &&\n        typeof data.iterationIndex === \"number\" &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"iteration.started\",\n            actionIndex: data.actionIndex,\n            iterationIndex: data.iterationIndex,\n            at: data.at,\n            ...(typeof data.model === \"string\" ? { model: data.model } : {}),\n          }\n        : null;\n    case \"iteration.ended\":\n      return typeof data.actionIndex === \"number\" &&\n        typeof data.iterationIndex === \"number\" &&\n        isIterationStatus(data.status) &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"iteration.ended\",\n            actionIndex: data.actionIndex,\n            iterationIndex: data.iterationIndex,\n            status: data.status,\n            at: data.at,\n            ...(typeof data.outputPreview === \"string\"\n              ? { outputPreview: data.outputPreview }\n              : {}),\n            ...(typeof data.inputTokens === \"number\"\n              ? { inputTokens: data.inputTokens }\n              : {}),\n            ...(typeof data.outputTokens === \"number\"\n              ? { outputTokens: data.outputTokens }\n              : {}),\n            ...(typeof data.costUsd === \"number\"\n              ? { costUsd: data.costUsd }\n              : {}),\n          }\n        : null;\n    default:\n      return null;\n  }\n}\n\n/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the\n *  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`\n *  (AbortSignal.timeout). */\nfunction isAbortError(err: unknown): boolean {\n  return (\n    err instanceof Error &&\n    (err.name === \"AbortError\" || err.name === \"TimeoutError\")\n  );\n}\n\n/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.\n *  Returns undefined when neither bound applies (no per-request abort needed). */\nfunction combineAbortSignals(\n  caller: AbortSignal | undefined,\n  timeoutMs: number | null,\n): AbortSignal | undefined {\n  const signals: AbortSignal[] = [];\n  if (caller) signals.push(caller);\n  if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));\n  if (signals.length === 0) return undefined;\n  return signals.length === 1 ? signals[0] : AbortSignal.any(signals);\n}\n\n/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on\n *  abort so a cancelled wait leaves nothing pending. */\nfunction delay(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason ?? new Error(\"The operation was aborted\"));\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal?.reason ?? new Error(\"The operation was aborted\"));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n\n// Wire-contract env var names. Mirrored from\n// products/platform/api/src/lib/hub-sandbox-contract.ts where the same\n// literals are pinned by `z.literal(...)`. Any drift here is a contract break.\nexport const HUB_URL_ENV_VAR = \"TANGLE_HUB_URL\" as const;\nexport const HUB_API_KEY_ENV_VAR = \"TANGLE_API_KEY\" as const;\nexport const HUB_CAPABILITY_TOKEN_ENV_VAR =\n  \"TANGLE_HUB_CAPABILITY_TOKEN\" as const;\n\nexport type HubEnv = Record<string, string | undefined>;\n\nexport interface HubClientFromEnvOptions {\n  env?: HubEnv;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\n// Read TANGLE_HUB_URL from env. Strips trailing slashes and the optional\n// `/v1/hub` suffix so the result is the platform root the SDK appends\n// `/v1/hub/...` to. No default — throws HubSdkError on undefined / empty /\n// non-URL. SaaS vs on-prem flips via env only.\nexport function resolveHubBaseUrl(env: HubEnv = readProcessEnv()): string {\n  const raw = env[HUB_URL_ENV_VAR];\n  if (raw === undefined || raw.trim() === \"\") {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `${HUB_URL_ENV_VAR} is required`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  const trimmed = raw.trim();\n  try {\n    new URL(trimmed);\n  } catch {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `${HUB_URL_ENV_VAR} is not a valid URL`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  return trimmed.replace(/\\/+$/, \"\").replace(/\\/v1\\/hub$/, \"\");\n}\n\n// Read exactly one Hub auth credential. Mirrors the\n// `exactly-one-api-key-or-capability-token` rule on the platform-api\n// hubSandboxEnvironmentSchema superRefine. No default; throws on none-or-both.\nexport function resolveHubAuth(env: HubEnv = readProcessEnv()): string {\n  const apiKey = nonEmpty(env[HUB_API_KEY_ENV_VAR]);\n  const capabilityToken = nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR]);\n  const present = [apiKey, capabilityToken].filter(\n    (value): value is string => value !== undefined,\n  );\n\n  if (present.length === 0) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n  if (present.length > 1) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n\n  return present[0];\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  const trimmed = value.trim();\n  return trimmed.length === 0 ? undefined : trimmed;\n}\n\nfunction readProcessEnv(): HubEnv {\n  // Browsers / Workers may not expose `process`. Callers there must pass `env`.\n  const proc = (globalThis as { process?: { env?: HubEnv } }).process;\n  return proc?.env ?? {};\n}\n\nexport class HubClient {\n  readonly baseUrl: string;\n  readonly fetch: typeof fetch;\n  readonly apiKey?: string;\n  readonly authHeaders?: HubAuthHeaders;\n  readonly connections: HubConnectionsClient;\n  readonly permissions: HubPermissionsClient;\n  readonly tokens: HubTokensClient;\n  readonly tools: HubToolsClient;\n  readonly approvals: HubApprovalsClient;\n  readonly audit: HubAuditClient;\n  readonly githubApp: HubGithubAppClient;\n  readonly workflows: HubWorkflowsClient;\n\n  constructor(options: HubClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = options.apiKey;\n    this.authHeaders = options.authHeaders;\n    // Cloudflare Workers' global fetch throws \"Illegal invocation\" when called as\n    // a method (this.fetch(...)) with a non-global `this`. Bind the default to\n    // globalThis so HubClient works in the Worker runtime; a caller-supplied\n    // fetch is used as-is (the caller owns its binding).\n    this.fetch = options.fetch ?? fetch.bind(globalThis);\n    this.connections = new HubConnectionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.permissions = new HubPermissionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.tokens = new HubTokensClient((path, init) => this.request(path, init));\n    this.tools = new HubToolsClient((path, init) => this.request(path, init));\n    this.approvals = new HubApprovalsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.audit = new HubAuditClient((path, init) => this.request(path, init));\n    this.githubApp = new HubGithubAppClient((path, init) =>\n      this.request(path, init),\n    );\n    this.workflows = new HubWorkflowsClient(\n      (path, init) => this.request(path, init),\n      (path, init) => this.stream(path, init),\n    );\n  }\n\n  // Static factory: construct a HubClient from environment variables.\n  // Required: TANGLE_HUB_URL. Auth: exactly one of TANGLE_API_KEY or\n  // TANGLE_HUB_CAPABILITY_TOKEN (skip the env auth resolve by passing\n  // `apiKey` / `authHeaders` explicitly). No fallback — throws HubSdkError\n  // with HUB_CONFIG_MISSING / HUB_CONFIG_INVALID when env is incomplete.\n  // SaaS vs on-prem flips via env only.\n  static fromEnv(options: HubClientFromEnvOptions = {}): HubClient {\n    const env = options.env ?? readProcessEnv();\n    const baseUrl = resolveHubBaseUrl(env);\n    const apiKey =\n      options.apiKey ?? (options.authHeaders ? undefined : resolveHubAuth(env));\n    return new HubClient({\n      baseUrl,\n      apiKey,\n      authHeaders: options.authHeaders,\n      fetch: options.fetch,\n    });\n  }\n\n  async status(): Promise<HubStatusResponse> {\n    return this.request<HubStatusResponse>(\"/v1/hub/status\", { method: \"GET\" });\n  }\n\n  private async request<TData>(\n    path: string,\n    init: RequestInit,\n  ): Promise<TData> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n\n    const status = response.status;\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    const bodyText = await response.text();\n\n    // The hub envelope is always JSON. A non-JSON body (gateway/HTML error\n    // page, redirect, plaintext, wrong host) is not an envelope — surface the\n    // HTTP status + a body snippet rather than letting JSON parsing throw an\n    // opaque SyntaxError that hides the real status.\n    if (!contentType.includes(\"application/json\")) {\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(bodyText);\n    } catch {\n      // JSON content-type but an unparseable body — still a transport-level\n      // failure, not a hub envelope.\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    // A typed error envelope (success: false) keeps the server's code/status,\n    // including on non-2xx responses (e.g. HUB_NOT_FOUND on 404).\n    if (isHubErrorEnvelope(parsed)) {\n      throw new HubSdkError(parsed.error, { status });\n    }\n    if (isHubSuccessEnvelope<TData>(parsed)) {\n      return parsed.data;\n    }\n\n    // Valid JSON, but not a hub envelope (e.g. a proxy's own error shape).\n    throw httpError(path, status, response.statusText, bodyText, contentType);\n  }\n\n  /**\n   * Open a streaming (Server-Sent Events) response and return its raw body.\n   * Shares auth-header building + `fetch` with {@link request}, but does NOT\n   * buffer or JSON-parse the body — the caller consumes the stream.\n   *\n   * A successful stream comes back as `text/event-stream`. Anything else is an\n   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML\n   * page); it is surfaced the same way {@link request} surfaces errors — a\n   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an\n   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.\n   */\n  private async stream(\n    path: string,\n    init: RequestInit,\n  ): Promise<ReadableStream<Uint8Array>> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n\n    const status = response.status;\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    // A non-2xx response is an error even when it carries a text/event-stream\n    // content-type (a misconfigured upstream / proxy error page) — route it into\n    // the error path below instead of handing it to the consumer as a live\n    // stream, which would hang waiting for events that never come.\n    if (!response.ok || !contentType.includes(\"text/event-stream\")) {\n      const bodyText = await response.text().catch(() => \"\");\n      if (contentType.includes(\"application/json\")) {\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(bodyText);\n        } catch {\n          parsed = undefined;\n        }\n        if (isHubErrorEnvelope(parsed)) {\n          throw new HubSdkError(parsed.error, { status });\n        }\n      }\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    if (!response.body) {\n      throw httpError(\n        path,\n        status,\n        response.statusText,\n        \"event-stream response had no body\",\n        contentType,\n      );\n    }\n    return response.body;\n  }\n\n  private async buildHeaders(headers: HeadersInit | undefined) {\n    const mergedHeaders = new Headers(headers);\n    // Default Accept to JSON only when the caller didn't set one — a streaming\n    // caller (watchRun) passes `Accept: text/event-stream` and must keep it, so\n    // the SSE Accept is correct by construction, not by header re-merge order.\n    if (!mergedHeaders.has(\"Accept\")) {\n      mergedHeaders.set(\"Accept\", \"application/json\");\n    }\n\n    if (this.apiKey) {\n      mergedHeaders.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    }\n\n    if (this.authHeaders) {\n      for (const [key, value] of new Headers(await this.authHeaders())) {\n        mergedHeaders.set(key, value);\n      }\n    }\n\n    for (const [key, value] of new Headers(headers)) {\n      mergedHeaders.set(key, value);\n    }\n\n    return mergedHeaders;\n  }\n}\n\nexport interface HubTokenListOptions {\n  includeExpired?: boolean;\n}\n\nexport class HubTokensClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mint(options: {\n    actionPath: string;\n    connectionId?: string;\n    provider?: string;\n    ttlSeconds?: number;\n  }): Promise<HubTokenMintResponse> {\n    return this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify(options),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async list(\n    options: HubTokenListOptions = {},\n  ): Promise<HubTokensListResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.includeExpired) searchParams.set(\"includeExpired\", \"true\");\n    const query = searchParams.toString();\n    const response = await this.request<HubTokensListResponse>(\n      `/v1/hub/tokens${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n    return {\n      tokens: response.tokens.map((token) => ({\n        id: token.id,\n        providerId: token.providerId,\n        connectionId: token.connectionId,\n        connectionDisplay: token.connectionDisplay,\n        actionPath: token.actionPath,\n        expiresAt: token.expiresAt,\n        status: token.status,\n        principalKind: token.principalKind,\n        createdAt: token.createdAt,\n      })),\n    };\n  }\n\n  async revoke(tokenId: string): Promise<HubTokenRevokeResponse> {\n    const response = await this.request<HubTokenRevokeResponse>(\n      `/v1/hub/tokens/${encodeURIComponent(tokenId)}`,\n      { method: \"DELETE\" },\n    );\n    return {\n      tokenId: response.tokenId,\n      status: response.status,\n    };\n  }\n}\n\nexport class HubPermissionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(connectionId: string): Promise<HubPolicyListResponse> {\n    return this.request<HubPolicyListResponse>(\n      `/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse> {\n    return this.request<HubPolicyResponse>(\"/v1/hub/policies\", {\n      method: \"PUT\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  /** Reset an action to its default by deleting any stored override. */\n  async delete(\n    input: HubPolicyDeleteRequest,\n  ): Promise<HubPolicyDeleteResponse> {\n    return this.request<HubPolicyDeleteResponse>(\"/v1/hub/policies\", {\n      method: \"DELETE\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  /** Bulk-allow every write action of a connection's provider. Reads are\n   *  already allowed for sandbox agents; destructive actions stay `ask`.\n   *  Idempotent: actions with an existing policy are left untouched. */\n  async allowWrites(connectionId: string): Promise<HubAllowWritesResponse> {\n    return this.request<HubAllowWritesResponse>(\n      \"/v1/hub/policies/allow-writes\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ connectionId }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /** Inverse of `allowWrites`: delete only the rows it created for this\n   *  connection. Manual per-action decisions are left intact. */\n  async revertWrites(connectionId: string): Promise<HubRevertWritesResponse> {\n    return this.request<HubRevertWritesResponse>(\n      \"/v1/hub/policies/revert-writes\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ connectionId }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n\nexport interface HubToolSearchOptions {\n  provider?: string;\n  /** Max tools to return. The server defaults to a relevance-ranked shortlist\n   *  (20); pass a higher value (bounded server-side) to enumerate a provider's\n   *  full action list, e.g. for a catalog/browse UI. The cap bounds the MERGED\n   *  response across sources — with no `provider` set, a low limit can exclude\n   *  some providers' tools, so scope by `provider` when you need one connector's\n   *  complete list. */\n  limit?: number;\n}\n\nexport interface HubToolInvokeOptions {\n  connectionId?: string;\n  approve?: boolean;\n}\n\nexport class HubToolsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async search(\n    query: string,\n    options: HubToolSearchOptions = {},\n  ): Promise<HubToolsSearchResponse> {\n    return this.request<HubToolsSearchResponse>(\"/v1/hub/tools/search\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        query,\n        provider: options.provider,\n        limit: options.limit,\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async sources(): Promise<HubToolSourcesResponse> {\n    return this.request<HubToolSourcesResponse>(\"/v1/hub/tools/sources\", {\n      method: \"GET\",\n    });\n  }\n\n  async describe(path: string): Promise<HubToolsDescribeResponse> {\n    return this.request<HubToolsDescribeResponse>(\"/v1/hub/tools/describe\", {\n      method: \"POST\",\n      body: JSON.stringify({ path }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async invoke<TResult = unknown>(\n    path: string,\n    input: unknown,\n    options: HubToolInvokeOptions = {},\n  ): Promise<HubExecResponse<TResult>> {\n    const execInit = this.buildExecInit(path, input, options.connectionId);\n    try {\n      return await this.request<HubExecResponse<TResult>>(\n        \"/v1/hub/exec\",\n        execInit,\n      );\n    } catch (error) {\n      if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) {\n        throw error;\n      }\n      if (options.approve) {\n        const approvalId = getApprovalId(error);\n        if (!approvalId) throw error;\n        const approved = await this.request<HubApprovalDecisionResponse>(\n          `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n          { method: \"POST\" },\n        );\n        validateApprovedExecution(approved, path, options.connectionId);\n        if (!approved.capabilityToken?.token) {\n          throw new HubSdkError({\n            code: \"HUB_CONFIG_MISSING\",\n            message: \"Hub approval did not return a capability token\",\n            details: { approvalId },\n          });\n        }\n        return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n          ...execInit,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${approved.capabilityToken.token}`,\n          },\n        });\n      }\n    }\n\n    const minted = await this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        actionPath: path,\n        connectionId: options.connectionId,\n        provider: options.connectionId ? undefined : path.split(\".\")[0],\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n\n    return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n      ...execInit,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${minted.token}`,\n      },\n    });\n  }\n\n  private buildExecInit(\n    path: string,\n    input: unknown,\n    connectionId: string | undefined,\n  ): RequestInit {\n    return {\n      method: \"POST\",\n      body: JSON.stringify({ path, input, connectionId }),\n      headers: { \"Content-Type\": \"application/json\" },\n    };\n  }\n}\n\nfunction requiresCapabilityToken(error: HubSdkError): boolean {\n  return error.code === \"HUB_APPROVAL_REQUIRED\";\n}\n\nfunction getApprovalId(error: HubSdkError): string | undefined {\n  const id = (error.details as { approval?: { id?: unknown } } | undefined)\n    ?.approval?.id;\n  return typeof id === \"string\" ? id : undefined;\n}\n\nfunction validateApprovedExecution(\n  approved: HubApprovalDecisionResponse,\n  path: string,\n  connectionId: string | undefined,\n): void {\n  if (approved.approval.actionPath !== path) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval action does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedActionPath: path,\n        approvalActionPath: approved.approval.actionPath,\n      },\n    });\n  }\n  if (\n    connectionId !== undefined &&\n    approved.approval.connectionId !== connectionId\n  ) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval connection does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedConnectionId: connectionId,\n        approvalConnectionId: approved.approval.connectionId,\n      },\n    });\n  }\n}\n\nexport interface HubConnectionStartOptions {\n  returnUrl?: string;\n  cli?: boolean;\n}\n\nexport class HubConnectionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubConnectionsResponse> {\n    return this.request<HubConnectionsResponse>(\"/v1/hub/connections\", {\n      method: \"GET\",\n    });\n  }\n\n  /** Connector catalog: every provider the hub can expose, each flagged with\n   *  `configured` (whether its OAuth app credentials are wired). Callers render\n   *  this alongside `list()` to offer Connect for not-yet-connected providers. */\n  async providers(): Promise<HubProvidersResponse> {\n    return this.request<HubProvidersResponse>(\"/v1/hub/providers\", {\n      method: \"GET\",\n    });\n  }\n\n  async start(\n    provider: string,\n    options: HubConnectionStartOptions = {},\n  ): Promise<HubOAuthStartResponse> {\n    return this.request<HubOAuthStartResponse>(\n      `/v1/hub/connections/${encodeURIComponent(provider)}/start`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({\n          returnUrl: options.returnUrl,\n          cli: options.cli,\n        }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async startWhatsappEmbeddedSignup(\n    options: HubWhatsappEmbeddedSignupStartRequest = {},\n  ): Promise<HubWhatsappEmbeddedSignupStartResponse> {\n    return this.request<HubWhatsappEmbeddedSignupStartResponse>(\n      \"/v1/hub/connections/whatsapp-business/embedded-signup/start\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ returnUrl: options.returnUrl }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async completeWhatsappEmbeddedSignup(\n    input: HubWhatsappEmbeddedSignupCompleteRequest,\n  ): Promise<HubWhatsappEmbeddedSignupCompleteResponse> {\n    return this.request<HubWhatsappEmbeddedSignupCompleteResponse>(\n      \"/v1/hub/connections/whatsapp-business/embedded-signup/complete\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /** Connect a non-OAuth (api-key) connector by submitting the user's key.\n   *  The server validates the key with a live probe before persisting and\n   *  returns the created (or reconnected) connection — there is no redirect,\n   *  unlike `start`. */\n  async connectApiKey(\n    provider: string,\n    apiKey: string,\n  ): Promise<HubApiKeyConnectResponse> {\n    return this.request<HubApiKeyConnectResponse>(\n      `/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({ apiKey }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async revoke(connectionId: string): Promise<HubConnectionDeleteResponse> {\n    return this.request<HubConnectionDeleteResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async health(connectionId: string): Promise<HubConnectionHealthResponse> {\n    return this.request<HubConnectionHealthResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`,\n      { method: \"POST\" },\n    );\n  }\n}\n\nexport class HubApprovalsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubApprovalListResponse> {\n    return this.request<HubApprovalListResponse>(\"/v1/hub/approvals\", {\n      method: \"GET\",\n    });\n  }\n\n  async approve(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n      { method: \"POST\" },\n    );\n  }\n\n  async deny(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`,\n      { method: \"POST\" },\n    );\n  }\n}\n\n// GitHub App primitive. The hub holds the App PEM + the per-tenant\n// installation grants; consumers (intelligence autonomous-improvement loop,\n// future code reviewers) ask the hub to mint a short-lived repo-scoped\n// installation token. The mint call MUST be principal-authed; the hub refuses\n// without a matching grant for the calling principal.\nexport class HubGithubAppClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mintInstallationToken(\n    input: HubGithubAppMintInstallationTokenRequest,\n  ): Promise<HubGithubAppMintInstallationTokenResponse> {\n    return this.request<HubGithubAppMintInstallationTokenResponse>(\n      \"/v1/hub/github-app/mint-installation-token\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async getInstallation(\n    installationId: number,\n  ): Promise<HubGithubAppInstallationResponse> {\n    return this.request<HubGithubAppInstallationResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async listRepos(\n    installationId: number,\n  ): Promise<HubGithubAppListReposResponse> {\n    return this.request<HubGithubAppListReposResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/repos`,\n      { method: \"GET\" },\n    );\n  }\n\n  async isRepoInstalled(input: {\n    owner: string;\n    repo: string;\n  }): Promise<HubGithubAppIsRepoInstalledResponse> {\n    const params = new URLSearchParams({\n      owner: input.owner,\n      repo: input.repo,\n    });\n    return this.request<HubGithubAppIsRepoInstalledResponse>(\n      `/v1/hub/github-app/is-repo-installed?${params.toString()}`,\n      { method: \"GET\" },\n    );\n  }\n}\n\nexport class HubAuditClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(options: HubAuditListRequest = {}): Promise<HubAuditResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.provider !== undefined)\n      searchParams.set(\"provider\", options.provider);\n    if (options.action !== undefined)\n      searchParams.set(\"action\", options.action);\n    if (options.status !== undefined)\n      searchParams.set(\"status\", options.status);\n    if (options.since !== undefined) searchParams.set(\"since\", options.since);\n    if (options.until !== undefined) searchParams.set(\"until\", options.until);\n    if (options.cursor !== undefined)\n      searchParams.set(\"cursor\", options.cursor);\n    if (options.limit !== undefined)\n      searchParams.set(\"limit\", String(options.limit));\n    const query = searchParams.toString();\n    return this.request<HubAuditResponse>(\n      `/v1/hub/audit${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n  }\n}\n\n// Workflow resource. Unlike the rest of the hub surface these endpoints live\n// at `/v1/workflows` (the platform root, not `/v1/hub`), but they share the\n// same auth + envelope, so they ride the same client. YAML is the durable\n// representation — create/update take a raw YAML string and the platform\n// compiles it to the engine's run model.\nexport class HubWorkflowsClient {\n  // `stream` is optional so the exported constructor stays source-compatible\n  // with the pre-streaming `new HubWorkflowsClient(request)` shape. `HubClient`\n  // always supplies it; only `watchRun` needs it, and it fails loudly when a\n  // client was built without it.\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n    private readonly stream?: (\n      path: string,\n      init: RequestInit,\n    ) => Promise<ReadableStream<Uint8Array>>,\n  ) {}\n\n  async list(): Promise<HubWorkflow[]> {\n    return this.request<HubWorkflow[]>(\"/v1/workflows\", { method: \"GET\" });\n  }\n\n  async get(id: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async create(yaml: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\"/v1/workflows\", {\n      method: \"POST\",\n      body: JSON.stringify({ yaml }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async update(id: string, yaml: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      {\n        method: \"PUT\",\n        body: JSON.stringify({ yaml }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async delete(id: string): Promise<void> {\n    await this.request<undefined>(`/v1/workflows/${encodeURIComponent(id)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  /**\n   * Enable or disable a workflow without editing its YAML. Works even when the\n   * workflow's connection was revoked (a disabled workflow can't be recompiled\n   * via `update`, but it can still be paused/resumed here).\n   */\n  async setEnabled(id: string, enabled: boolean): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ enabled }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /**\n   * One page of run history, newest first. Pass the previous page's\n   * `nextCursor` to fetch the next; a null `nextCursor` means the last page.\n   */\n  async listRuns(\n    id: string,\n    opts: { limit?: number; cursor?: string } = {},\n  ): Promise<HubWorkflowRunsPage> {\n    const params = new URLSearchParams();\n    if (opts.limit !== undefined) params.set(\"limit\", String(opts.limit));\n    if (opts.cursor !== undefined) params.set(\"cursor\", opts.cursor);\n    const query = params.toString();\n    return this.request<HubWorkflowRunsPage>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n  }\n\n  /**\n   * Enqueue an immediate (\"Run now\") run and return its `runId`. The run goes\n   * through the identical execution path a trigger delivery uses.\n   *\n   * `inputs` supplies the trigger fields the workflow reads (its\n   * {@link HubWorkflow.manualRunInputs}), as a flat `{ path: value }` map — e.g.\n   * `{ \"pull_request.number\": \"123\" }`. Omit it for a one-click run of a\n   * workflow that reads no trigger fields. Throws `HubSdkError`:\n   * `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`\n   * names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`\n   * for an unknown/foreign id. Pass `opts.signal` to abort a slow request.\n   */\n  async run(\n    id: string,\n    inputs?: HubWorkflowRunInputs,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunEnqueued> {\n    const hasInputs = inputs !== undefined && Object.keys(inputs).length > 0;\n    return this.request<HubWorkflowRunEnqueued>(\n      `/v1/workflows/${encodeURIComponent(id)}/run`,\n      {\n        method: \"POST\",\n        body: JSON.stringify(hasInputs ? { inputs } : {}),\n        headers: { \"Content-Type\": \"application/json\" },\n        ...(opts.signal ? { signal: opts.signal } : {}),\n      },\n    );\n  }\n\n  /**\n   * A single run's full detail: per-action `output` + `agentRun` execution\n   * detail (size-capped server-side) and the trigger context — the deep \"why\n   * did this run do what it did\" view. `NOT_FOUND` when the run is unknown or\n   * does not belong to both the caller and this workflow.\n   */\n  async getRun(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunDetail> {\n    return this.request<HubWorkflowRunDetail>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}`,\n      { method: \"GET\", ...(opts.signal ? { signal: opts.signal } : {}) },\n    );\n  }\n\n  /**\n   * Stop a queued or in-flight run. A `queued` run is cancelled synchronously\n   * and comes back `{ status: \"cancelled\" }` (already terminal); a `running` run\n   * is signalled to abort and comes back `{ status: \"cancelling\", signalled }` —\n   * it settles `cancelled` a moment later as its current action tears down, which\n   * a {@link watchRun}/{@link getRun} observes. Throws `HubSdkError`:\n   * `RUN_NOT_CANCELLABLE` when the run already finished, `NOT_FOUND` for an\n   * unknown/foreign run id. Pass `opts.signal` to abort a slow request.\n   */\n  async cancel(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunCancelResult> {\n    return this.request<HubWorkflowRunCancelResult>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/cancel`,\n      { method: \"POST\", ...(opts.signal ? { signal: opts.signal } : {}) },\n    );\n  }\n\n  /**\n   * Stream a run's live progress as an async iterable of typed events. The\n   * first event is always a `snapshot` of the current persisted state; then\n   * `action.*` / `iteration.*` / `token` ticks arrive as the run executes;\n   * `ping` is a keepalive; a terminal `run.done` ends the iteration. If the run\n   * is already finished when the stream opens, it yields the snapshot then\n   * `run.done` and completes.\n   *\n   * Live ticks require the worker executing the run to share the API process;\n   * across instances only `snapshot` + `run.done` (from the server's terminal\n   * poll) arrive — the persisted record, read via {@link getRun}, stays the\n   * source of truth. Pass `signal` to cancel; iterating to `run.done` (or\n   * breaking early) releases the connection.\n   */\n  async *watchRun(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): AsyncGenerator<HubWorkflowRunStreamEvent> {\n    const openStream = this.stream;\n    if (!openStream) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message:\n          \"watchRun needs a streaming transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly\",\n      });\n    }\n    const body = await openStream(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`,\n      {\n        method: \"GET\",\n        headers: { Accept: \"text/event-stream\" },\n        ...(opts.signal ? { signal: opts.signal } : {}),\n      },\n    );\n    // Frame + parse with the shared SSE primitive (`SSEChunkParser` from\n    // sdk-telemetry). A malformed `data:` payload becomes null and is skipped\n    // rather than throwing mid-stream.\n    const reader = body.getReader();\n    const decoder = new TextDecoder();\n    const parser = new SSEChunkParser<unknown>({\n      transform: (raw) => {\n        try {\n          return JSON.parse(raw);\n        } catch {\n          return null;\n        }\n      },\n    });\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        const text = done\n          ? decoder.decode()\n          : decoder.decode(value, { stream: true });\n        const parsedEvents = done\n          ? [...parser.push(text), ...parser.flush()]\n          : parser.push(text);\n        for (const parsed of parsedEvents) {\n          const event = toRunStreamEvent(parsed.eventType, parsed.data);\n          if (!event) continue;\n          yield event;\n          // Both terminal completion and a decision park end the stream.\n          if (event.type === \"run.done\" || event.type === \"run.waiting\") return;\n        }\n        if (done) return;\n      }\n    } finally {\n      // Cancel through the reader on every exit (early break, run.done, throw)\n      // to tear down the HTTP/SSE connection; it's a safe no-op once the stream\n      // has closed on its own. NOT releaseLock() — cancelling via the reader\n      // already tears down the source, and releaseLock() after cancel risks a\n      // TypeError if a read is still settling. (body.cancel() can't be used here\n      // — getReader() locks the body.)\n      await reader.cancel().catch(() => {});\n    }\n  }\n\n  /**\n   * Poll {@link getRun} until the run reaches a terminal state (`succeeded` or\n   * `failed`) and return its detail. The scripting primitive behind \"run and\n   * print the result\": pairs with {@link run} for a one-call trigger-and-wait.\n   *\n   * Returns as soon as the run leaves the active set (`queued` / `running`) —\n   * i.e. on `succeeded`, `failed`, or any future non-active status — so a new\n   * terminal state can never hang the wait. Polls every `pollIntervalMs`\n   * (default 2000). With `timeoutMs` set, throws\n   * `HubSdkError(WORKFLOW_RUN_TIMEOUT)` — carrying the last observed status on\n   * `details.status` — only once the deadline has actually passed; the last\n   * wait is clamped to the remaining time so a `timeoutMs` shorter than the\n   * poll interval still waits the full requested window rather than giving up a\n   * poll early. Pass `signal` to cancel the wait between polls.\n   */\n  async waitForRun(\n    id: string,\n    runId: string,\n    opts: {\n      pollIntervalMs?: number;\n      timeoutMs?: number;\n      signal?: AbortSignal;\n    } = {},\n  ): Promise<HubWorkflowRunDetail> {\n    const pollIntervalMs = opts.pollIntervalMs ?? 2000;\n    // Guard against a bad poll cadence turning the loop into a getRun hot-loop\n    // (e.g. 0 / NaN → zero-delay timers).\n    if (!Number.isFinite(pollIntervalMs) || pollIntervalMs <= 0) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message: `waitForRun pollIntervalMs must be a positive number (got ${opts.pollIntervalMs})`,\n      });\n    }\n    if (\n      opts.timeoutMs !== undefined &&\n      (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs <= 0)\n    ) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message: `waitForRun timeoutMs must be a positive number (got ${opts.timeoutMs})`,\n      });\n    }\n    const deadline =\n      opts.timeoutMs !== undefined ? Date.now() + opts.timeoutMs : null;\n    const timeoutError = (status: HubWorkflowRunStatus | undefined) =>\n      new HubSdkError({\n        code: \"WORKFLOW_RUN_TIMEOUT\",\n        message: `Workflow run ${runId} did not reach a terminal state within ${opts.timeoutMs}ms${status ? ` (last status: ${status})` : \"\"}`,\n        details: { runId, status, timeoutMs: opts.timeoutMs },\n      });\n    let lastStatus: HubWorkflowRunStatus | undefined;\n    for (;;) {\n      if (opts.signal?.aborted) {\n        throw opts.signal.reason ?? new Error(\"The operation was aborted\");\n      }\n      const remainingMs = deadline !== null ? deadline - Date.now() : null;\n      if (remainingMs !== null && remainingMs <= 0)\n        throw timeoutError(lastStatus);\n\n      // Abort the in-flight poll if the caller aborts OR the deadline elapses\n      // mid-request, so a hung getRun can't outlive `timeoutMs` / ignore `signal`.\n      const pollSignal = combineAbortSignals(opts.signal, remainingMs);\n      let run: HubWorkflowRunDetail;\n      try {\n        run = await this.getRun(\n          id,\n          runId,\n          pollSignal ? { signal: pollSignal } : {},\n        );\n      } catch (err) {\n        // Caller cancellation propagates as-is; a deadline-driven abort becomes\n        // the typed timeout.\n        if (opts.signal?.aborted) throw err;\n        if (deadline !== null && isAbortError(err))\n          throw timeoutError(lastStatus);\n        throw err;\n      }\n      lastStatus = run.status;\n      // Terminal = anything not still in flight. Waiting for a fixed\n      // {succeeded,failed} allow-list would hang forever if the run reached a\n      // status added later (e.g. a future `cancelled`).\n      if (run.status !== \"queued\" && run.status !== \"running\") return run;\n      // Recompute the remaining budget AFTER the poll — `getRun` may have\n      // consumed most of it — so the wait is clamped to what's actually left\n      // and can never overshoot `timeoutMs`.\n      const delayRemainingMs = deadline !== null ? deadline - Date.now() : null;\n      if (delayRemainingMs !== null && delayRemainingMs <= 0) {\n        throw timeoutError(lastStatus);\n      }\n      await delay(\n        delayRemainingMs !== null\n          ? Math.min(pollIntervalMs, delayRemainingMs)\n          : pollIntervalMs,\n        opts.signal,\n      );\n    }\n  }\n\n  async validate(yaml: string): Promise<HubWorkflowValidateResponse> {\n    return this.request<HubWorkflowValidateResponse>(\"/v1/workflows/validate\", {\n      method: \"POST\",\n      body: JSON.stringify({ yaml }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async schema(): Promise<HubWorkflowSchemaResponse> {\n    return this.request<HubWorkflowSchemaResponse>(\"/v1/workflows/schema\", {\n      method: \"GET\",\n    });\n  }\n}\n"],"mappings":";;AAAA,MAAM,qBACJ;AACF,MAAM,uBACJ;AAEF,SAAgB,eAAe,OAAyB;AACtD,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,QAAQ,sBAAsB,aAAa;AAG1D,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,KAAK,CAAC;AAGlD,KAAI,SAAS,OAAO,UAAU,SAC5B,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAC/C,KACA,mBAAmB,KAAK,IAAI,GACxB,eACA,eAAe,WAAW,CAC/B,CAAC,CACH;AAGH,QAAO;;;;ACoCT,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YAAY,OAAqB,UAA+B,EAAE,EAAE;AAClE,QAAM,OAAO,eAAe,MAAM,QAAQ,CAAC,CAAC;AAC5C,OAAK,OAAO;AACZ,OAAK,OAAO,MAAM;AAClB,OAAK,UAAU,eAAe,MAAM,QAAQ;AAC5C,OAAK,SAAS,QAAQ;;;AAQ1B,SAAS,YAAY,MAAc,MAAM,KAAa;CACpD,MAAM,UAAU,KAAK,MAAM;AAC3B,QAAO,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,IAAI,CAAC,KAAK;;AAM9D,SAAS,UACP,MACA,QACA,YACA,MACA,aACa;CACb,MAAM,SAAS,aAAa,IAAI,eAAe;AAC/C,QAAO,IAAI,YACT;EACE,MAAM,YAAY;EAClB,SAAS,eAAe,KAAK,gBAAgB,SAAS;EACtD,SAAS;GACP;GACA;GACA,aAAa,eAAe;GAC5B,aAAa,YAAY,KAAK;GAC/B;EACF,EACD,EAAE,QAAQ,CACX;;AAGH,SAAS,mBAAmB,OAA2C;AACrE,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;CACxD,MAAM,YAAY;AAClB,KAAI,UAAU,YAAY,MAAO,QAAO;CACxC,MAAM,QAAQ,UAAU;AACxB,QACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAO,MAAM,SAAS;;AAI1B,SAAS,qBACP,OACoC;AACpC,QACE,OAAO,UAAU,YACjB,UAAU,QACT,MAAgC,YAAY;;AAIjD,SAAS,SAAS,OAAkD;AAClE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAGhD,SAAS,UAAU,OAAwB;AACzC,QAAO,OAAO,UAAU,WAAW,QAAQ;;;;AAK7C,SAAS,kBAAkB,OAAiD;AAC1E,QAAO,UAAU,eAAe,UAAU;;;;;AAM5C,SAAS,uBACP,OAC6C;AAC7C,QAAO,UAAU,eAAe,UAAU,YAAY,UAAU;;;;;;AAOlE,SAAS,gBACP,OAC+C;AAC/C,QAAO,UAAU,eAAe,UAAU,YAAY,UAAU;;;;;;;;;;AAWlE,SAAS,iBACP,WACA,MACkC;AAClC,KAAI,cAAc,OAAQ,QAAO,EAAE,MAAM,QAAQ;AACjD,KAAI,CAAC,SAAS,KAAK,CAAE,QAAO;AAC5B,SAAQ,WAAR;EACE,KAAK,WAOH,QAAO,OAAO,KAAK,OAAO,YACxB,OAAO,KAAK,eAAe,YAC3B,OAAO,KAAK,WAAW,YACvB,MAAM,QAAQ,KAAK,cAAc,GAC/B;GAAE,MAAM;GAAY,KAAK;GAAyC,GAClE;EACN,KAAK,QAGH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,gBAAgB,WAC1B;GACE,MAAM;GACN,aAAa,KAAK;GAClB,OAAO,KAAK;GACZ,IAAI,UAAU,KAAK,GAAG;GACvB,GACD;EACN,KAAK,WAIH,QAAO,gBAAgB,KAAK,OAAO,GAC/B;GACE,MAAM;GACN,QAAQ,KAAK;GACb,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;GACrD,GAAI,OAAO,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,IAAI,GAAG,EAAE;GACvD,GACD;EACN,KAAK,cAOH,QAAO,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,SAAS,IACnE;GACE,MAAM;GACN,YAAY,KAAK;GACjB,GAAI,OAAO,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,IAAI,GAAG,EAAE;GACvD,GACD;EAKN,KAAK,iBACH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,IAAI,KAAK;GACV,GACD;EACN,KAAK,kBACH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,SAAS,YACrB,uBAAuB,KAAK,OAAO,IACnC,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,YAAY,WACxB,EAAE,SAAS,KAAK,SAAS,GACzB,EAAE;GACN,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;GAChE,GACD;EACN,KAAK,oBACH,QAAO,OAAO,KAAK,gBAAgB,YACjC,OAAO,KAAK,mBAAmB,YAC/B,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,aAAa,KAAK;GAClB,gBAAgB,KAAK;GACrB,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;GAChE,GACD;EACN,KAAK,kBACH,QAAO,OAAO,KAAK,gBAAgB,YACjC,OAAO,KAAK,mBAAmB,YAC/B,kBAAkB,KAAK,OAAO,IAC9B,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,aAAa,KAAK;GAClB,gBAAgB,KAAK;GACrB,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,kBAAkB,WAC9B,EAAE,eAAe,KAAK,eAAe,GACrC,EAAE;GACN,GAAI,OAAO,KAAK,gBAAgB,WAC5B,EAAE,aAAa,KAAK,aAAa,GACjC,EAAE;GACN,GAAI,OAAO,KAAK,iBAAiB,WAC7B,EAAE,cAAc,KAAK,cAAc,GACnC,EAAE;GACN,GAAI,OAAO,KAAK,YAAY,WACxB,EAAE,SAAS,KAAK,SAAS,GACzB,EAAE;GACP,GACD;EACN,QACE,QAAO;;;;;;AAOb,SAAS,aAAa,KAAuB;AAC3C,QACE,eAAe,UACd,IAAI,SAAS,gBAAgB,IAAI,SAAS;;;;AAM/C,SAAS,oBACP,QACA,WACyB;CACzB,MAAM,UAAyB,EAAE;AACjC,KAAI,OAAQ,SAAQ,KAAK,OAAO;AAChC,KAAI,cAAc,KAAM,SAAQ,KAAK,YAAY,QAAQ,UAAU,CAAC;AACpE,KAAI,QAAQ,WAAW,EAAG,QAAO,KAAA;AACjC,QAAO,QAAQ,WAAW,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ;;;;AAKrE,SAAS,MAAM,IAAY,QAAqC;AAC9D,QAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,MAAI,QAAQ,SAAS;AACnB,UAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;AAC/D;;EAEF,MAAM,gBAAgB;AACpB,gBAAa,MAAM;AACnB,UAAO,QAAQ,0BAAU,IAAI,MAAM,4BAA4B,CAAC;;EAElE,MAAM,QAAQ,iBAAiB;AAC7B,WAAQ,oBAAoB,SAAS,QAAQ;AAC7C,YAAS;KACR,GAAG;AACN,UAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;GAC1D;;AAMJ,MAAa,kBAAkB;AAC/B,MAAa,sBAAsB;AACnC,MAAa,+BACX;AAeF,SAAgB,kBAAkB,MAAc,gBAAgB,EAAU;CACxE,MAAM,MAAM,IAAI;AAChB,KAAI,QAAQ,KAAA,KAAa,IAAI,MAAM,KAAK,GACtC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,GAAG,gBAAgB;EAC5B,SAAS,EAAE,QAAQ,iBAAiB;EACrC,CAAC;CAGJ,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI;AACF,MAAI,IAAI,QAAQ;SACV;AACN,QAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,GAAG,gBAAgB;GAC5B,SAAS,EAAE,QAAQ,iBAAiB;GACrC,CAAC;;AAGJ,QAAO,QAAQ,QAAQ,QAAQ,GAAG,CAAC,QAAQ,cAAc,GAAG;;AAM9D,SAAgB,eAAe,MAAc,gBAAgB,EAAU;CAGrE,MAAM,UAAU,CAFD,SAAS,IAAI,qBAEL,EADC,SAAS,IAAI,8BACG,CAAC,CAAC,QACvC,UAA2B,UAAU,KAAA,EACvC;AAED,KAAI,QAAQ,WAAW,EACrB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,UAAU,oBAAoB,MAAM,6BAA6B;EAC1E,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAEJ,KAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,sBAAsB,oBAAoB,MAAM,6BAA6B;EACtF,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAGJ,QAAO,QAAQ;;AAGjB,SAAS,SAAS,OAA+C;AAC/D,KAAI,UAAU,KAAA,EAAW,QAAO,KAAA;CAChC,MAAM,UAAU,MAAM,MAAM;AAC5B,QAAO,QAAQ,WAAW,IAAI,KAAA,IAAY;;AAG5C,SAAS,iBAAyB;AAGhC,QADc,WAA8C,SAC/C,OAAO,EAAE;;AAGxB,IAAa,YAAb,MAAa,UAAU;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA2B;AACrC,OAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,SAAS,QAAQ;AACtB,OAAK,cAAc,QAAQ;AAK3B,OAAK,QAAQ,QAAQ,SAAS,MAAM,KAAK,WAAW;AACpD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,SAAS,IAAI,iBAAiB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC3E,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,YAAY,IAAI,oBAClB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,GACvC,MAAM,SAAS,KAAK,OAAO,MAAM,KAAK,CACxC;;CASH,OAAO,QAAQ,UAAmC,EAAE,EAAa;EAC/D,MAAM,MAAM,QAAQ,OAAO,gBAAgB;AAI3C,SAAO,IAAI,UAAU;GACnB,SAJc,kBAAkB,IAIzB;GACP,QAHA,QAAQ,WAAW,QAAQ,cAAc,KAAA,IAAY,eAAe,IAAI;GAIxE,aAAa,QAAQ;GACrB,OAAO,QAAQ;GAChB,CAAC;;CAGJ,MAAM,SAAqC;AACzC,SAAO,KAAK,QAA2B,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;CAG7E,MAAc,QACZ,MACA,MACgB;EAChB,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EAEF,MAAM,SAAS,SAAS;EACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;EAC5D,MAAM,WAAW,MAAM,SAAS,MAAM;AAMtC,MAAI,CAAC,YAAY,SAAS,mBAAmB,CAC3C,OAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;EAG3E,IAAI;AACJ,MAAI;AACF,YAAS,KAAK,MAAM,SAAS;UACvB;AAGN,SAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;AAK3E,MAAI,mBAAmB,OAAO,CAC5B,OAAM,IAAI,YAAY,OAAO,OAAO,EAAE,QAAQ,CAAC;AAEjD,MAAI,qBAA4B,OAAO,CACrC,QAAO,OAAO;AAIhB,QAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;;;;;;;;;;;;CAc3E,MAAc,OACZ,MACA,MACqC;EACrC,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EAEF,MAAM,SAAS,SAAS;EACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;AAK5D,MAAI,CAAC,SAAS,MAAM,CAAC,YAAY,SAAS,oBAAoB,EAAE;GAC9D,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,YAAY,GAAG;AACtD,OAAI,YAAY,SAAS,mBAAmB,EAAE;IAC5C,IAAI;AACJ,QAAI;AACF,cAAS,KAAK,MAAM,SAAS;YACvB;AACN,cAAS,KAAA;;AAEX,QAAI,mBAAmB,OAAO,CAC5B,OAAM,IAAI,YAAY,OAAO,OAAO,EAAE,QAAQ,CAAC;;AAGnD,SAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;AAG3E,MAAI,CAAC,SAAS,KACZ,OAAM,UACJ,MACA,QACA,SAAS,YACT,qCACA,YACD;AAEH,SAAO,SAAS;;CAGlB,MAAc,aAAa,SAAkC;EAC3D,MAAM,gBAAgB,IAAI,QAAQ,QAAQ;AAI1C,MAAI,CAAC,cAAc,IAAI,SAAS,CAC9B,eAAc,IAAI,UAAU,mBAAmB;AAGjD,MAAI,KAAK,OACP,eAAc,IAAI,iBAAiB,UAAU,KAAK,SAAS;AAG7D,MAAI,KAAK,YACP,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,MAAM,KAAK,aAAa,CAAC,CAC9D,eAAc,IAAI,KAAK,MAAM;AAIjC,OAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,QAAQ,CAC7C,eAAc,IAAI,KAAK,MAAM;AAG/B,SAAO;;;AAQX,IAAa,kBAAb,MAA6B;CAC3B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,SAKuB;AAChC,SAAO,KAAK,QAA8B,kBAAkB;GAC1D,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ;GAC7B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,KACJ,UAA+B,EAAE,EACD;EAChC,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,eAAgB,cAAa,IAAI,kBAAkB,OAAO;EACtE,MAAM,QAAQ,aAAa,UAAU;AAKrC,SAAO,EACL,SAAQ,MALa,KAAK,QAC1B,iBAAiB,QAAQ,IAAI,UAAU,MACvC,EAAE,QAAQ,OAAO,CAClB,EAEkB,OAAO,KAAK,WAAW;GACtC,IAAI,MAAM;GACV,YAAY,MAAM;GAClB,cAAc,MAAM;GACpB,mBAAmB,MAAM;GACzB,YAAY,MAAM;GAClB,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,eAAe,MAAM;GACrB,WAAW,MAAM;GAClB,EAAE,EACJ;;CAGH,MAAM,OAAO,SAAkD;EAC7D,MAAM,WAAW,MAAM,KAAK,QAC1B,kBAAkB,mBAAmB,QAAQ,IAC7C,EAAE,QAAQ,UAAU,CACrB;AACD,SAAO;GACL,SAAS,SAAS;GAClB,QAAQ,SAAS;GAClB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,cAAsD;AAC/D,SAAO,KAAK,QACV,iCAAiC,mBAAmB,aAAa,IACjE,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,IAAI,OAA2D;AACnE,SAAO,KAAK,QAA2B,oBAAoB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;CAIJ,MAAM,OACJ,OACkC;AAClC,SAAO,KAAK,QAAiC,oBAAoB;GAC/D,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;;;CAMJ,MAAM,YAAY,cAAuD;AACvE,SAAO,KAAK,QACV,iCACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;GACtC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;CAKH,MAAM,aAAa,cAAwD;AACzE,SAAO,KAAK,QACV,kCACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;GACtC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;AAoBL,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OACJ,OACA,UAAgC,EAAE,EACD;AACjC,SAAO,KAAK,QAAgC,wBAAwB;GAClE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,UAAU,QAAQ;IAClB,OAAO,QAAQ;IAChB,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,UAA2C;AAC/C,SAAO,KAAK,QAAgC,yBAAyB,EACnE,QAAQ,OACT,CAAC;;CAGJ,MAAM,SAAS,MAAiD;AAC9D,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OACJ,MACA,OACA,UAAgC,EAAE,EACC;EACnC,MAAM,WAAW,KAAK,cAAc,MAAM,OAAO,QAAQ,aAAa;AACtE,MAAI;AACF,UAAO,MAAM,KAAK,QAChB,gBACA,SACD;WACM,OAAO;AACd,OAAI,EAAE,iBAAiB,gBAAgB,CAAC,wBAAwB,MAAM,CACpE,OAAM;AAER,OAAI,QAAQ,SAAS;IACnB,MAAM,aAAa,cAAc,MAAM;AACvC,QAAI,CAAC,WAAY,OAAM;IACvB,MAAM,WAAW,MAAM,KAAK,QAC1B,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;AACD,8BAA0B,UAAU,MAAM,QAAQ,aAAa;AAC/D,QAAI,CAAC,SAAS,iBAAiB,MAC7B,OAAM,IAAI,YAAY;KACpB,MAAM;KACN,SAAS;KACT,SAAS,EAAE,YAAY;KACxB,CAAC;AAEJ,WAAO,KAAK,QAAkC,gBAAgB;KAC5D,GAAG;KACH,SAAS;MACP,gBAAgB;MAChB,eAAe,UAAU,SAAS,gBAAgB;MACnD;KACF,CAAC;;;EAIN,MAAM,SAAS,MAAM,KAAK,QAA8B,kBAAkB;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,cAAc,QAAQ;IACtB,UAAU,QAAQ,eAAe,KAAA,IAAY,KAAK,MAAM,IAAI,CAAC;IAC9D,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;AAEF,SAAO,KAAK,QAAkC,gBAAgB;GAC5D,GAAG;GACH,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,OAAO;IACjC;GACF,CAAC;;CAGJ,cACE,MACA,OACA,cACa;AACb,SAAO;GACL,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAM;IAAO;IAAc,CAAC;GACnD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD;;;AAIL,SAAS,wBAAwB,OAA6B;AAC5D,QAAO,MAAM,SAAS;;AAGxB,SAAS,cAAc,OAAwC;CAC7D,MAAM,KAAM,MAAM,SACd,UAAU;AACd,QAAO,OAAO,OAAO,WAAW,KAAK,KAAA;;AAGvC,SAAS,0BACP,UACA,MACA,cACM;AACN,KAAI,SAAS,SAAS,eAAe,KACnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,oBAAoB;GACpB,oBAAoB,SAAS,SAAS;GACvC;EACF,CAAC;AAEJ,KACE,iBAAiB,KAAA,KACjB,SAAS,SAAS,iBAAiB,aAEnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,sBAAsB;GACtB,sBAAsB,SAAS,SAAS;GACzC;EACF,CAAC;;AASN,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAwC;AAC5C,SAAO,KAAK,QAAgC,uBAAuB,EACjE,QAAQ,OACT,CAAC;;;;;CAMJ,MAAM,YAA2C;AAC/C,SAAO,KAAK,QAA8B,qBAAqB,EAC7D,QAAQ,OACT,CAAC;;CAGJ,MAAM,MACJ,UACA,UAAqC,EAAE,EACP;AAChC,SAAO,KAAK,QACV,uBAAuB,mBAAmB,SAAS,CAAC,SACpD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,WAAW,QAAQ;IACnB,KAAK,QAAQ;IACd,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,4BACJ,UAAiD,EAAE,EACF;AACjD,SAAO,KAAK,QACV,+DACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,WAAW,QAAQ,WAAW,CAAC;GACtD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,+BACJ,OACoD;AACpD,SAAO,KAAK,QACV,kEACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;;;CAOH,MAAM,cACJ,UACA,QACmC;AACnC,SAAO,KAAK,QACV,uBAAuB,mBAAmB,SAAS,CAAC,eACpD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GAChC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,IACvD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,CAAC,UACxD,EAAE,QAAQ,QAAQ,CACnB;;;AAIL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAyC;AAC7C,SAAO,KAAK,QAAiC,qBAAqB,EAChE,QAAQ,OACT,CAAC;;CAGJ,MAAM,QAAQ,YAA0D;AACtE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;;CAGH,MAAM,KAAK,YAA0D;AACnE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,QACpD,EAAE,QAAQ,QAAQ,CACnB;;;AASL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,sBACJ,OACoD;AACpD,SAAO,KAAK,QACV,8CACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,gBACJ,gBAC2C;AAC3C,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,IAC9E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,UACJ,gBACwC;AACxC,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,CAAC,SAC/E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,gBAAgB,OAG2B;EAC/C,MAAM,SAAS,IAAI,gBAAgB;GACjC,OAAO,MAAM;GACb,MAAM,MAAM;GACb,CAAC;AACF,SAAO,KAAK,QACV,wCAAwC,OAAO,UAAU,IACzD,EAAE,QAAQ,OAAO,CAClB;;;AAIL,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,UAA+B,EAAE,EAA6B;EACvE,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,aAAa,KAAA,EACvB,cAAa,IAAI,YAAY,QAAQ,SAAS;AAChD,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EACpB,cAAa,IAAI,SAAS,OAAO,QAAQ,MAAM,CAAC;EAClD,MAAM,QAAQ,aAAa,UAAU;AACrC,SAAO,KAAK,QACV,gBAAgB,QAAQ,IAAI,UAAU,MACtC,EAAE,QAAQ,OAAO,CAClB;;;AASL,IAAa,qBAAb,MAAgC;CAK9B,YACE,SAIA,QAIA;AARiB,OAAA,UAAA;AAIA,OAAA,SAAA;;CAMnB,MAAM,OAA+B;AACnC,SAAO,KAAK,QAAuB,iBAAiB,EAAE,QAAQ,OAAO,CAAC;;CAGxE,MAAM,IAAI,IAAkC;AAC1C,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,OAAO,MAAoC;AAC/C,SAAO,KAAK,QAAqB,iBAAiB;GAChD,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OAAO,IAAY,MAAoC;AAC3D,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OAAO,IAA2B;AACtC,QAAM,KAAK,QAAmB,iBAAiB,mBAAmB,GAAG,IAAI,EACvE,QAAQ,UACT,CAAC;;;;;;;CAQJ,MAAM,WAAW,IAAY,SAAwC;AACnE,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;GACjC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;;;CAOH,MAAM,SACJ,IACA,OAA4C,EAAE,EAChB;EAC9B,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,KAAK,UAAU,KAAA,EAAW,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;AACrE,MAAI,KAAK,WAAW,KAAA,EAAW,QAAO,IAAI,UAAU,KAAK,OAAO;EAChE,MAAM,QAAQ,OAAO,UAAU;AAC/B,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,OAAO,QAAQ,IAAI,UAAU,MACrE,EAAE,QAAQ,OAAO,CAClB;;;;;;;;;;;;;;CAeH,MAAM,IACJ,IACA,QACA,OAAiC,EAAE,EACF;EACjC,MAAM,YAAY,WAAW,KAAA,KAAa,OAAO,KAAK,OAAO,CAAC,SAAS;AACvE,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,OACxC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,YAAY,EAAE,QAAQ,GAAG,EAAE,CAAC;GACjD,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAC/C,CACF;;;;;;;;CASH,MAAM,OACJ,IACA,OACA,OAAiC,EAAE,EACJ;AAC/B,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,IACzE;GAAE,QAAQ;GAAO,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAAG,CACnE;;;;;;;;;;;CAYH,MAAM,OACJ,IACA,OACA,OAAiC,EAAE,EACE;AACrC,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,CAAC,UAC1E;GAAE,QAAQ;GAAQ,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAAG,CACpE;;;;;;;;;;;;;;;;CAiBH,OAAO,SACL,IACA,OACA,OAAiC,EAAE,EACQ;EAC3C,MAAM,aAAa,KAAK;AACxB,MAAI,CAAC,WACH,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SACE;GACH,CAAC;EAaJ,MAAM,UAAS,MAXI,WACjB,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,CAAC,UAC1E;GACE,QAAQ;GACR,SAAS,EAAE,QAAQ,qBAAqB;GACxC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAC/C,CACF,EAImB,WAAW;EAC/B,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,SAAS,IAAI,eAAwB,EACzC,YAAY,QAAQ;AAClB,OAAI;AACF,WAAO,KAAK,MAAM,IAAI;WAChB;AACN,WAAO;;KAGZ,CAAC;AACF,MAAI;AACF,YAAS;IACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;IAC3C,MAAM,OAAO,OACT,QAAQ,QAAQ,GAChB,QAAQ,OAAO,OAAO,EAAE,QAAQ,MAAM,CAAC;IAC3C,MAAM,eAAe,OACjB,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,GAAG,OAAO,OAAO,CAAC,GACzC,OAAO,KAAK,KAAK;AACrB,SAAK,MAAM,UAAU,cAAc;KACjC,MAAM,QAAQ,iBAAiB,OAAO,WAAW,OAAO,KAAK;AAC7D,SAAI,CAAC,MAAO;AACZ,WAAM;AAEN,SAAI,MAAM,SAAS,cAAc,MAAM,SAAS,cAAe;;AAEjE,QAAI,KAAM;;YAEJ;AAOR,SAAM,OAAO,QAAQ,CAAC,YAAY,GAAG;;;;;;;;;;;;;;;;;;CAmBzC,MAAM,WACJ,IACA,OACA,OAII,EAAE,EACyB;EAC/B,MAAM,iBAAiB,KAAK,kBAAkB;AAG9C,MAAI,CAAC,OAAO,SAAS,eAAe,IAAI,kBAAkB,EACxD,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,4DAA4D,KAAK,eAAe;GAC1F,CAAC;AAEJ,MACE,KAAK,cAAc,KAAA,MAClB,CAAC,OAAO,SAAS,KAAK,UAAU,IAAI,KAAK,aAAa,GAEvD,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,uDAAuD,KAAK,UAAU;GAChF,CAAC;EAEJ,MAAM,WACJ,KAAK,cAAc,KAAA,IAAY,KAAK,KAAK,GAAG,KAAK,YAAY;EAC/D,MAAM,gBAAgB,WACpB,IAAI,YAAY;GACd,MAAM;GACN,SAAS,gBAAgB,MAAM,yCAAyC,KAAK,UAAU,IAAI,SAAS,kBAAkB,OAAO,KAAK;GAClI,SAAS;IAAE;IAAO;IAAQ,WAAW,KAAK;IAAW;GACtD,CAAC;EACJ,IAAI;AACJ,WAAS;AACP,OAAI,KAAK,QAAQ,QACf,OAAM,KAAK,OAAO,0BAAU,IAAI,MAAM,4BAA4B;GAEpE,MAAM,cAAc,aAAa,OAAO,WAAW,KAAK,KAAK,GAAG;AAChE,OAAI,gBAAgB,QAAQ,eAAe,EACzC,OAAM,aAAa,WAAW;GAIhC,MAAM,aAAa,oBAAoB,KAAK,QAAQ,YAAY;GAChE,IAAI;AACJ,OAAI;AACF,UAAM,MAAM,KAAK,OACf,IACA,OACA,aAAa,EAAE,QAAQ,YAAY,GAAG,EAAE,CACzC;YACM,KAAK;AAGZ,QAAI,KAAK,QAAQ,QAAS,OAAM;AAChC,QAAI,aAAa,QAAQ,aAAa,IAAI,CACxC,OAAM,aAAa,WAAW;AAChC,UAAM;;AAER,gBAAa,IAAI;AAIjB,OAAI,IAAI,WAAW,YAAY,IAAI,WAAW,UAAW,QAAO;GAIhE,MAAM,mBAAmB,aAAa,OAAO,WAAW,KAAK,KAAK,GAAG;AACrE,OAAI,qBAAqB,QAAQ,oBAAoB,EACnD,OAAM,aAAa,WAAW;AAEhC,SAAM,MACJ,qBAAqB,OACjB,KAAK,IAAI,gBAAgB,iBAAiB,GAC1C,gBACJ,KAAK,OACN;;;CAIL,MAAM,SAAS,MAAoD;AACjE,SAAO,KAAK,QAAqC,0BAA0B;GACzE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,SAA6C;AACjD,SAAO,KAAK,QAAmC,wBAAwB,EACrE,QAAQ,OACT,CAAC"}
+{"version":3,"file":"index.js","names":["isRecord"],"sources":["../src/redaction.ts","../src/client.ts","../src/event-delivery.ts"],"sourcesContent":["const SECRET_KEY_PATTERN =\n  /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;\nconst SECRET_VALUE_PATTERN =\n  /\\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\\b/g;\n\nexport function redactHubValue(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    return value.replace(SECRET_VALUE_PATTERN, \"[REDACTED]\");\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactHubValue(item));\n  }\n\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entryValue]) => [\n        key,\n        SECRET_KEY_PATTERN.test(key)\n          ? \"[REDACTED]\"\n          : redactHubValue(entryValue),\n      ]),\n    );\n  }\n\n  return value;\n}\n","import { SSEChunkParser } from \"@tangle-network/sdk-telemetry\";\nimport { redactHubValue } from \"./redaction.js\";\nimport type {\n  HubAllowWritesResponse,\n  HubApiKeyConnectResponse,\n  HubApprovalDecisionResponse,\n  HubApprovalListResponse,\n  HubAuditListRequest,\n  HubAuditResponse,\n  HubChannelCreateResponse,\n  HubChannelDeleteResponse,\n  HubChannelsResponse,\n  HubConnectionDeleteResponse,\n  HubConnectionHealthResponse,\n  HubConnectionsResponse,\n  HubEmailChannelCreateRequest,\n  HubErrorBody,\n  HubErrorEnvelope,\n  HubEventSubscriptionCreateRequest,\n  HubEventSubscriptionCreateResponse,\n  HubEventSubscriptionDeleteResponse,\n  HubEventSubscriptionsResponse,\n  HubExecResponse,\n  HubGithubAppInstallationResponse,\n  HubGithubAppIsRepoInstalledResponse,\n  HubGithubAppListReposResponse,\n  HubGithubAppMintInstallationTokenRequest,\n  HubGithubAppMintInstallationTokenResponse,\n  HubOAuthStartResponse,\n  HubPolicyDeleteRequest,\n  HubPolicyDeleteResponse,\n  HubPolicyListResponse,\n  HubPolicyResponse,\n  HubPolicyUpdateRequest,\n  HubProvidersResponse,\n  HubRevertWritesResponse,\n  HubStatusResponse,\n  HubSuccessEnvelope,\n  HubTokenMintResponse,\n  HubTokenRevokeResponse,\n  HubTokensListResponse,\n  HubToolSourcesResponse,\n  HubToolsDescribeResponse,\n  HubToolsSearchResponse,\n  HubWhatsappEmbeddedSignupCompleteRequest,\n  HubWhatsappEmbeddedSignupCompleteResponse,\n  HubWhatsappEmbeddedSignupStartRequest,\n  HubWhatsappEmbeddedSignupStartResponse,\n  HubWorkflow,\n  HubWorkflowRunCancelResult,\n  HubWorkflowRunDetail,\n  HubWorkflowRunEnqueued,\n  HubWorkflowRunInputs,\n  HubWorkflowRunStatus,\n  HubWorkflowRunStreamEvent,\n  HubWorkflowRunsPage,\n  HubWorkflowSchemaResponse,\n  HubWorkflowValidateResponse,\n} from \"./types.js\";\n\nexport type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;\n\nexport interface HubClientOptions {\n  baseUrl: string;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\nexport class HubSdkError extends Error {\n  readonly code: HubErrorBody[\"code\"];\n  readonly details?: unknown;\n  readonly status?: number;\n\n  constructor(error: HubErrorBody, options: { status?: number } = {}) {\n    super(String(redactHubValue(error.message)));\n    this.name = \"HubSdkError\";\n    this.code = error.code;\n    this.details = redactHubValue(error.details);\n    this.status = options.status;\n  }\n}\n\n// Cap a response body at a readable length for inclusion in an error's\n// `details.bodySnippet`. The HubSdkError constructor runs the result through\n// `redactHubValue`, so token-shaped substrings in an upstream error page are\n// scrubbed before they reach the snippet.\nfunction bodySnippet(body: string, max = 200): string {\n  const trimmed = body.trim();\n  return trimmed.length > max ? `${trimmed.slice(0, max)}…` : trimmed;\n}\n\n// Transport-level failure: the response was not a hub envelope. Carries the\n// numeric HTTP status on both `code` (HUB_HTTP_<status>) and `status`, plus a\n// body snippet, so callers see the real status instead of a JSON parse error.\nfunction httpError(\n  path: string,\n  status: number,\n  statusText: string,\n  body: string,\n  contentType: string,\n): HubSdkError {\n  const suffix = statusText ? ` ${statusText}` : \"\";\n  return new HubSdkError(\n    {\n      code: `HUB_HTTP_${status}`,\n      message: `Hub request ${path} failed: HTTP ${status}${suffix}`,\n      details: {\n        status,\n        path,\n        contentType: contentType || null,\n        bodySnippet: bodySnippet(body),\n      },\n    },\n    { status },\n  );\n}\n\nfunction isHubErrorEnvelope(value: unknown): value is HubErrorEnvelope {\n  if (typeof value !== \"object\" || value === null) return false;\n  const candidate = value as { success?: unknown; error?: unknown };\n  if (candidate.success !== false) return false;\n  const error = candidate.error as { code?: unknown } | undefined;\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    typeof error.code === \"string\"\n  );\n}\n\nfunction isHubSuccessEnvelope<TData>(\n  value: unknown,\n): value is HubSuccessEnvelope<TData> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { success?: unknown }).success === true\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction optString(value: unknown): string {\n  return typeof value === \"string\" ? value : \"\";\n}\n\n/** An agent iteration's terminal status (`iteration.ended`) — only ever\n *  succeeded/failed; an iteration is never guard-skipped. */\nfunction isIterationStatus(value: unknown): value is \"succeeded\" | \"failed\" {\n  return value === \"succeeded\" || value === \"failed\";\n}\n\n/** An action's terminal status on `action.finished`. Beyond succeeded/failed a\n *  guarded action can end `skipped` (its `if` resolved false, so it never ran) —\n *  accepted here so a skipped event is surfaced, not dropped as malformed. */\nfunction isActionFinishedStatus(\n  value: unknown,\n): value is \"succeeded\" | \"failed\" | \"skipped\" {\n  return value === \"succeeded\" || value === \"failed\" || value === \"skipped\";\n}\n\n/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`\n *  (a user cancel) — a value neither the action nor iteration status checkers\n *  accept — so `run.done` uses this rather than them, which would drop a\n *  cancelled terminal event and hang the stream. */\nfunction isRunDoneStatus(\n  value: unknown,\n): value is \"succeeded\" | \"failed\" | \"cancelled\" {\n  return value === \"succeeded\" || value === \"failed\" || value === \"cancelled\";\n}\n\n/**\n * Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed\n * run-stream event, validating the fields each variant declares rather than\n * blindly casting the wire payload. A frame that doesn't match its event's\n * shape (or an unknown event name) returns null so the consumer skips it — a\n * malformed `token` can never reach a consumer as `{ delta: undefined }`, and\n * new server event kinds don't break older clients.\n */\nfunction toRunStreamEvent(\n  eventType: string | undefined,\n  data: unknown,\n): HubWorkflowRunStreamEvent | null {\n  if (eventType === \"ping\") return { type: \"ping\" };\n  if (!isRecord(data)) return null;\n  switch (eventType) {\n    case \"snapshot\":\n      // The snapshot payload is the full run detail. HubWorkflowRunDetail narrows\n      // status/actionResults from optional to REQUIRED, so validate those anchors\n      // (not just id/workflowId) before the cast — otherwise a contract-breaking\n      // server response would hand consumers `undefined` where the type promises a\n      // value. `status` is checked as a present string rather than against the\n      // enum so a new server-side status doesn't drop an otherwise-valid snapshot.\n      return typeof data.id === \"string\" &&\n        typeof data.workflowId === \"string\" &&\n        typeof data.status === \"string\" &&\n        Array.isArray(data.actionResults)\n        ? { type: \"snapshot\", run: data as unknown as HubWorkflowRunDetail }\n        : null;\n    case \"token\":\n      // `delta` is the one field a consumer writes to stdout raw, so a\n      // non-string drops the frame instead of crashing downstream.\n      return typeof data.delta === \"string\" &&\n        typeof data.actionIndex === \"number\"\n        ? {\n            type: \"token\",\n            actionIndex: data.actionIndex,\n            delta: data.delta,\n            at: optString(data.at),\n          }\n        : null;\n    case \"run.done\":\n      // The terminal signal — a bad status must not masquerade as completion,\n      // but `cancelled` is a valid terminal outcome (a user-cancelled run) and\n      // must be surfaced, not dropped, so the stream ends instead of hanging.\n      return isRunDoneStatus(data.status)\n        ? {\n            type: \"run.done\",\n            status: data.status,\n            error: typeof data.error === \"string\" ? data.error : null,\n            ...(typeof data.at === \"string\" ? { at: data.at } : {}),\n          }\n        : null;\n    case \"run.waiting\":\n      // The run PARKED on a human `decision` step — non-terminal, but it ENDS the\n      // live stream (no further ticks until it resumes, a fresh execution). Surface\n      // it with the pending decision id so a consumer stops watching and prompts\n      // for a resolution instead of hanging or reading it as completion. Require a\n      // NON-EMPTY decisionId: a blank one is unactionable (the consumer couldn't\n      // resolve it), so drop the frame rather than end the stream on a dead id.\n      return typeof data.decisionId === \"string\" && data.decisionId.length > 0\n        ? {\n            type: \"run.waiting\",\n            decisionId: data.decisionId,\n            ...(typeof data.at === \"string\" ? { at: data.at } : {}),\n          }\n        : null;\n    // Lifecycle events: construct the result from the SSE frame's `eventType`\n    // with the required fields validated, so the yielded `.type` always matches\n    // the frame (never the payload's own `type`, which may drift or be absent)\n    // and only validated optional fields are copied.\n    case \"action.started\":\n      return typeof data.index === \"number\" &&\n        typeof data.kind === \"string\" &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"action.started\",\n            index: data.index,\n            kind: data.kind,\n            at: data.at,\n          }\n        : null;\n    case \"action.finished\":\n      return typeof data.index === \"number\" &&\n        typeof data.kind === \"string\" &&\n        isActionFinishedStatus(data.status) &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"action.finished\",\n            index: data.index,\n            kind: data.kind,\n            status: data.status,\n            at: data.at,\n            ...(typeof data.costUsd === \"number\"\n              ? { costUsd: data.costUsd }\n              : {}),\n            ...(typeof data.error === \"string\" ? { error: data.error } : {}),\n          }\n        : null;\n    case \"iteration.started\":\n      return typeof data.actionIndex === \"number\" &&\n        typeof data.iterationIndex === \"number\" &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"iteration.started\",\n            actionIndex: data.actionIndex,\n            iterationIndex: data.iterationIndex,\n            at: data.at,\n            ...(typeof data.model === \"string\" ? { model: data.model } : {}),\n          }\n        : null;\n    case \"iteration.ended\":\n      return typeof data.actionIndex === \"number\" &&\n        typeof data.iterationIndex === \"number\" &&\n        isIterationStatus(data.status) &&\n        typeof data.at === \"string\"\n        ? {\n            type: \"iteration.ended\",\n            actionIndex: data.actionIndex,\n            iterationIndex: data.iterationIndex,\n            status: data.status,\n            at: data.at,\n            ...(typeof data.outputPreview === \"string\"\n              ? { outputPreview: data.outputPreview }\n              : {}),\n            ...(typeof data.inputTokens === \"number\"\n              ? { inputTokens: data.inputTokens }\n              : {}),\n            ...(typeof data.outputTokens === \"number\"\n              ? { outputTokens: data.outputTokens }\n              : {}),\n            ...(typeof data.costUsd === \"number\"\n              ? { costUsd: data.costUsd }\n              : {}),\n          }\n        : null;\n    default:\n      return null;\n  }\n}\n\n/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the\n *  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`\n *  (AbortSignal.timeout). */\nfunction isAbortError(err: unknown): boolean {\n  return (\n    err instanceof Error &&\n    (err.name === \"AbortError\" || err.name === \"TimeoutError\")\n  );\n}\n\n/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.\n *  Returns undefined when neither bound applies (no per-request abort needed). */\nfunction combineAbortSignals(\n  caller: AbortSignal | undefined,\n  timeoutMs: number | null,\n): AbortSignal | undefined {\n  const signals: AbortSignal[] = [];\n  if (caller) signals.push(caller);\n  if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));\n  if (signals.length === 0) return undefined;\n  return signals.length === 1 ? signals[0] : AbortSignal.any(signals);\n}\n\n/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on\n *  abort so a cancelled wait leaves nothing pending. */\nfunction delay(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason ?? new Error(\"The operation was aborted\"));\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal?.reason ?? new Error(\"The operation was aborted\"));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n\n// Wire-contract env var names. Mirrored from\n// products/platform/api/src/lib/hub-sandbox-contract.ts where the same\n// literals are pinned by `z.literal(...)`. Any drift here is a contract break.\nexport const HUB_URL_ENV_VAR = \"TANGLE_HUB_URL\" as const;\nexport const HUB_API_KEY_ENV_VAR = \"TANGLE_API_KEY\" as const;\nexport const HUB_CAPABILITY_TOKEN_ENV_VAR =\n  \"TANGLE_HUB_CAPABILITY_TOKEN\" as const;\n\nexport type HubEnv = Record<string, string | undefined>;\n\nexport interface HubClientFromEnvOptions {\n  env?: HubEnv;\n  apiKey?: string;\n  authHeaders?: HubAuthHeaders;\n  fetch?: typeof fetch;\n}\n\n// Read TANGLE_HUB_URL from env. Strips trailing slashes and the optional\n// `/v1/hub` suffix so the result is the platform root the SDK appends\n// `/v1/hub/...` to. No default — throws HubSdkError on undefined / empty /\n// non-URL. SaaS vs on-prem flips via env only.\nexport function resolveHubBaseUrl(env: HubEnv = readProcessEnv()): string {\n  const raw = env[HUB_URL_ENV_VAR];\n  if (raw === undefined || raw.trim() === \"\") {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `${HUB_URL_ENV_VAR} is required`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  const trimmed = raw.trim();\n  try {\n    new URL(trimmed);\n  } catch {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `${HUB_URL_ENV_VAR} is not a valid URL`,\n      details: { envVar: HUB_URL_ENV_VAR },\n    });\n  }\n\n  return trimmed.replace(/\\/+$/, \"\").replace(/\\/v1\\/hub$/, \"\");\n}\n\n// Read exactly one Hub auth credential. Mirrors the\n// `exactly-one-api-key-or-capability-token` rule on the platform-api\n// hubSandboxEnvironmentSchema superRefine. No default; throws on none-or-both.\nexport function resolveHubAuth(env: HubEnv = readProcessEnv()): string {\n  const apiKey = nonEmpty(env[HUB_API_KEY_ENV_VAR]);\n  const capabilityToken = nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR]);\n  const present = [apiKey, capabilityToken].filter(\n    (value): value is string => value !== undefined,\n  );\n\n  if (present.length === 0) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_MISSING\",\n      message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n  if (present.length > 1) {\n    throw new HubSdkError({\n      code: \"HUB_CONFIG_INVALID\",\n      message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,\n      details: {\n        envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR],\n      },\n    });\n  }\n\n  return present[0];\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n  if (value === undefined) return undefined;\n  const trimmed = value.trim();\n  return trimmed.length === 0 ? undefined : trimmed;\n}\n\nfunction readProcessEnv(): HubEnv {\n  // Browsers / Workers may not expose `process`. Callers there must pass `env`.\n  const proc = (globalThis as { process?: { env?: HubEnv } }).process;\n  return proc?.env ?? {};\n}\n\nexport class HubClient {\n  readonly baseUrl: string;\n  readonly fetch: typeof fetch;\n  readonly apiKey?: string;\n  readonly authHeaders?: HubAuthHeaders;\n  readonly connections: HubConnectionsClient;\n  readonly channels: HubChannelsClient;\n  readonly eventSubscriptions: HubEventSubscriptionsClient;\n  readonly permissions: HubPermissionsClient;\n  readonly tokens: HubTokensClient;\n  readonly tools: HubToolsClient;\n  readonly approvals: HubApprovalsClient;\n  readonly audit: HubAuditClient;\n  readonly githubApp: HubGithubAppClient;\n  readonly workflows: HubWorkflowsClient;\n\n  constructor(options: HubClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = options.apiKey;\n    this.authHeaders = options.authHeaders;\n    // Cloudflare Workers' global fetch throws \"Illegal invocation\" when called as\n    // a method (this.fetch(...)) with a non-global `this`. Bind the default to\n    // globalThis so HubClient works in the Worker runtime; a caller-supplied\n    // fetch is used as-is (the caller owns its binding).\n    this.fetch = options.fetch ?? fetch.bind(globalThis);\n    this.connections = new HubConnectionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.channels = new HubChannelsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.permissions = new HubPermissionsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.tokens = new HubTokensClient((path, init) => this.request(path, init));\n    this.tools = new HubToolsClient((path, init) => this.request(path, init));\n    this.approvals = new HubApprovalsClient((path, init) =>\n      this.request(path, init),\n    );\n    this.audit = new HubAuditClient((path, init) => this.request(path, init));\n    this.githubApp = new HubGithubAppClient((path, init) =>\n      this.request(path, init),\n    );\n    this.workflows = new HubWorkflowsClient(\n      (path, init) => this.request(path, init),\n      (path, init) => this.stream(path, init),\n    );\n  }\n\n  // Static factory: construct a HubClient from environment variables.\n  // Required: TANGLE_HUB_URL. Auth: exactly one of TANGLE_API_KEY or\n  // TANGLE_HUB_CAPABILITY_TOKEN (skip the env auth resolve by passing\n  // `apiKey` / `authHeaders` explicitly). No fallback — throws HubSdkError\n  // with HUB_CONFIG_MISSING / HUB_CONFIG_INVALID when env is incomplete.\n  // SaaS vs on-prem flips via env only.\n  static fromEnv(options: HubClientFromEnvOptions = {}): HubClient {\n    const env = options.env ?? readProcessEnv();\n    const baseUrl = resolveHubBaseUrl(env);\n    const apiKey =\n      options.apiKey ?? (options.authHeaders ? undefined : resolveHubAuth(env));\n    return new HubClient({\n      baseUrl,\n      apiKey,\n      authHeaders: options.authHeaders,\n      fetch: options.fetch,\n    });\n  }\n\n  async status(): Promise<HubStatusResponse> {\n    return this.request<HubStatusResponse>(\"/v1/hub/status\", { method: \"GET\" });\n  }\n\n  private async request<TData>(\n    path: string,\n    init: RequestInit,\n  ): Promise<TData> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n\n    const status = response.status;\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    const bodyText = await response.text();\n\n    // The hub envelope is always JSON. A non-JSON body (gateway/HTML error\n    // page, redirect, plaintext, wrong host) is not an envelope — surface the\n    // HTTP status + a body snippet rather than letting JSON parsing throw an\n    // opaque SyntaxError that hides the real status.\n    if (!contentType.includes(\"application/json\")) {\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(bodyText);\n    } catch {\n      // JSON content-type but an unparseable body — still a transport-level\n      // failure, not a hub envelope.\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    // A typed error envelope (success: false) keeps the server's code/status,\n    // including on non-2xx responses (e.g. HUB_NOT_FOUND on 404).\n    if (isHubErrorEnvelope(parsed)) {\n      throw new HubSdkError(parsed.error, { status });\n    }\n    if (isHubSuccessEnvelope<TData>(parsed)) {\n      return parsed.data;\n    }\n\n    // Valid JSON, but not a hub envelope (e.g. a proxy's own error shape).\n    throw httpError(path, status, response.statusText, bodyText, contentType);\n  }\n\n  /**\n   * Open a streaming (Server-Sent Events) response and return its raw body.\n   * Shares auth-header building + `fetch` with {@link request}, but does NOT\n   * buffer or JSON-parse the body — the caller consumes the stream.\n   *\n   * A successful stream comes back as `text/event-stream`. Anything else is an\n   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML\n   * page); it is surfaced the same way {@link request} surfaces errors — a\n   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an\n   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.\n   */\n  private async stream(\n    path: string,\n    init: RequestInit,\n  ): Promise<ReadableStream<Uint8Array>> {\n    const response = await this.fetch(`${this.baseUrl}${path}`, {\n      ...init,\n      headers: await this.buildHeaders(init.headers),\n    });\n\n    const status = response.status;\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    // A non-2xx response is an error even when it carries a text/event-stream\n    // content-type (a misconfigured upstream / proxy error page) — route it into\n    // the error path below instead of handing it to the consumer as a live\n    // stream, which would hang waiting for events that never come.\n    if (!response.ok || !contentType.includes(\"text/event-stream\")) {\n      const bodyText = await response.text().catch(() => \"\");\n      if (contentType.includes(\"application/json\")) {\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(bodyText);\n        } catch {\n          parsed = undefined;\n        }\n        if (isHubErrorEnvelope(parsed)) {\n          throw new HubSdkError(parsed.error, { status });\n        }\n      }\n      throw httpError(path, status, response.statusText, bodyText, contentType);\n    }\n\n    if (!response.body) {\n      throw httpError(\n        path,\n        status,\n        response.statusText,\n        \"event-stream response had no body\",\n        contentType,\n      );\n    }\n    return response.body;\n  }\n\n  private async buildHeaders(headers: HeadersInit | undefined) {\n    const mergedHeaders = new Headers(headers);\n    // Default Accept to JSON only when the caller didn't set one — a streaming\n    // caller (watchRun) passes `Accept: text/event-stream` and must keep it, so\n    // the SSE Accept is correct by construction, not by header re-merge order.\n    if (!mergedHeaders.has(\"Accept\")) {\n      mergedHeaders.set(\"Accept\", \"application/json\");\n    }\n\n    if (this.apiKey) {\n      mergedHeaders.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    }\n\n    if (this.authHeaders) {\n      for (const [key, value] of new Headers(await this.authHeaders())) {\n        mergedHeaders.set(key, value);\n      }\n    }\n\n    for (const [key, value] of new Headers(headers)) {\n      mergedHeaders.set(key, value);\n    }\n\n    return mergedHeaders;\n  }\n}\n\nexport interface HubTokenListOptions {\n  includeExpired?: boolean;\n}\n\nexport class HubTokensClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mint(options: {\n    actionPath: string;\n    connectionId?: string;\n    provider?: string;\n    ttlSeconds?: number;\n  }): Promise<HubTokenMintResponse> {\n    return this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify(options),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async list(\n    options: HubTokenListOptions = {},\n  ): Promise<HubTokensListResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.includeExpired) searchParams.set(\"includeExpired\", \"true\");\n    const query = searchParams.toString();\n    const response = await this.request<HubTokensListResponse>(\n      `/v1/hub/tokens${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n    return {\n      tokens: response.tokens.map((token) => ({\n        id: token.id,\n        providerId: token.providerId,\n        connectionId: token.connectionId,\n        connectionDisplay: token.connectionDisplay,\n        actionPath: token.actionPath,\n        expiresAt: token.expiresAt,\n        status: token.status,\n        principalKind: token.principalKind,\n        createdAt: token.createdAt,\n      })),\n    };\n  }\n\n  async revoke(tokenId: string): Promise<HubTokenRevokeResponse> {\n    const response = await this.request<HubTokenRevokeResponse>(\n      `/v1/hub/tokens/${encodeURIComponent(tokenId)}`,\n      { method: \"DELETE\" },\n    );\n    return {\n      tokenId: response.tokenId,\n      status: response.status,\n    };\n  }\n}\n\nexport class HubPermissionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(connectionId: string): Promise<HubPolicyListResponse> {\n    return this.request<HubPolicyListResponse>(\n      `/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse> {\n    return this.request<HubPolicyResponse>(\"/v1/hub/policies\", {\n      method: \"PUT\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  /** Reset an action to its default by deleting any stored override. */\n  async delete(\n    input: HubPolicyDeleteRequest,\n  ): Promise<HubPolicyDeleteResponse> {\n    return this.request<HubPolicyDeleteResponse>(\"/v1/hub/policies\", {\n      method: \"DELETE\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  /** Bulk-allow every write action of a connection's provider. Reads are\n   *  already allowed for sandbox agents; destructive actions stay `ask`.\n   *  Idempotent: actions with an existing policy are left untouched. */\n  async allowWrites(connectionId: string): Promise<HubAllowWritesResponse> {\n    return this.request<HubAllowWritesResponse>(\n      \"/v1/hub/policies/allow-writes\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ connectionId }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /** Inverse of `allowWrites`: delete only the rows it created for this\n   *  connection. Manual per-action decisions are left intact. */\n  async revertWrites(connectionId: string): Promise<HubRevertWritesResponse> {\n    return this.request<HubRevertWritesResponse>(\n      \"/v1/hub/policies/revert-writes\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ connectionId }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n\nexport interface HubToolSearchOptions {\n  provider?: string;\n  /** Max tools to return. The server defaults to a relevance-ranked shortlist\n   *  (20); pass a higher value (bounded server-side) to enumerate a provider's\n   *  full action list, e.g. for a catalog/browse UI. The cap bounds the MERGED\n   *  response across sources — with no `provider` set, a low limit can exclude\n   *  some providers' tools, so scope by `provider` when you need one connector's\n   *  complete list. */\n  limit?: number;\n}\n\nexport interface HubToolInvokeOptions {\n  connectionId?: string;\n  approve?: boolean;\n}\n\nexport class HubToolsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async search(\n    query: string,\n    options: HubToolSearchOptions = {},\n  ): Promise<HubToolsSearchResponse> {\n    return this.request<HubToolsSearchResponse>(\"/v1/hub/tools/search\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        query,\n        provider: options.provider,\n        limit: options.limit,\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async sources(): Promise<HubToolSourcesResponse> {\n    return this.request<HubToolSourcesResponse>(\"/v1/hub/tools/sources\", {\n      method: \"GET\",\n    });\n  }\n\n  async describe(path: string): Promise<HubToolsDescribeResponse> {\n    return this.request<HubToolsDescribeResponse>(\"/v1/hub/tools/describe\", {\n      method: \"POST\",\n      body: JSON.stringify({ path }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async invoke<TResult = unknown>(\n    path: string,\n    input: unknown,\n    options: HubToolInvokeOptions = {},\n  ): Promise<HubExecResponse<TResult>> {\n    const execInit = this.buildExecInit(path, input, options.connectionId);\n    try {\n      return await this.request<HubExecResponse<TResult>>(\n        \"/v1/hub/exec\",\n        execInit,\n      );\n    } catch (error) {\n      if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) {\n        throw error;\n      }\n      if (options.approve) {\n        const approvalId = getApprovalId(error);\n        if (!approvalId) throw error;\n        const approved = await this.request<HubApprovalDecisionResponse>(\n          `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n          { method: \"POST\" },\n        );\n        validateApprovedExecution(approved, path, options.connectionId);\n        if (!approved.capabilityToken?.token) {\n          throw new HubSdkError({\n            code: \"HUB_CONFIG_MISSING\",\n            message: \"Hub approval did not return a capability token\",\n            details: { approvalId },\n          });\n        }\n        return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n          ...execInit,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${approved.capabilityToken.token}`,\n          },\n        });\n      }\n    }\n\n    const minted = await this.request<HubTokenMintResponse>(\"/v1/hub/tokens\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        actionPath: path,\n        connectionId: options.connectionId,\n        provider: options.connectionId ? undefined : path.split(\".\")[0],\n      }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n\n    return this.request<HubExecResponse<TResult>>(\"/v1/hub/exec\", {\n      ...execInit,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${minted.token}`,\n      },\n    });\n  }\n\n  private buildExecInit(\n    path: string,\n    input: unknown,\n    connectionId: string | undefined,\n  ): RequestInit {\n    return {\n      method: \"POST\",\n      body: JSON.stringify({ path, input, connectionId }),\n      headers: { \"Content-Type\": \"application/json\" },\n    };\n  }\n}\n\nfunction requiresCapabilityToken(error: HubSdkError): boolean {\n  return error.code === \"HUB_APPROVAL_REQUIRED\";\n}\n\nfunction getApprovalId(error: HubSdkError): string | undefined {\n  const id = (error.details as { approval?: { id?: unknown } } | undefined)\n    ?.approval?.id;\n  return typeof id === \"string\" ? id : undefined;\n}\n\nfunction validateApprovedExecution(\n  approved: HubApprovalDecisionResponse,\n  path: string,\n  connectionId: string | undefined,\n): void {\n  if (approved.approval.actionPath !== path) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval action does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedActionPath: path,\n        approvalActionPath: approved.approval.actionPath,\n      },\n    });\n  }\n  if (\n    connectionId !== undefined &&\n    approved.approval.connectionId !== connectionId\n  ) {\n    throw new HubSdkError({\n      code: \"HUB_POLICY_DENIED\",\n      message: \"Hub approval connection does not match requested execution\",\n      details: {\n        approvalId: approved.approval.id,\n        expectedConnectionId: connectionId,\n        approvalConnectionId: approved.approval.connectionId,\n      },\n    });\n  }\n}\n\nexport interface HubConnectionStartOptions {\n  returnUrl?: string;\n  cli?: boolean;\n}\n\nexport class HubChannelsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubChannelsResponse> {\n    return this.request<HubChannelsResponse>(\"/v1/hub/channels\", {\n      method: \"GET\",\n    });\n  }\n\n  async createEmail(\n    input: HubEmailChannelCreateRequest = {},\n  ): Promise<HubChannelCreateResponse> {\n    return this.request<HubChannelCreateResponse>(\"/v1/hub/channels/email\", {\n      method: \"POST\",\n      body: JSON.stringify(input),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async delete(channelId: string): Promise<HubChannelDeleteResponse> {\n    return this.request<HubChannelDeleteResponse>(\n      `/v1/hub/channels/${encodeURIComponent(channelId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n}\n\nexport class HubEventSubscriptionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubEventSubscriptionsResponse> {\n    return this.request<HubEventSubscriptionsResponse>(\n      \"/v1/hub/event-subscriptions\",\n      { method: \"GET\" },\n    );\n  }\n\n  async create(\n    input: HubEventSubscriptionCreateRequest,\n  ): Promise<HubEventSubscriptionCreateResponse> {\n    return this.request<HubEventSubscriptionCreateResponse>(\n      \"/v1/hub/event-subscriptions\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async delete(\n    subscriptionId: string,\n  ): Promise<HubEventSubscriptionDeleteResponse> {\n    return this.request<HubEventSubscriptionDeleteResponse>(\n      `/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n}\n\nexport class HubConnectionsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubConnectionsResponse> {\n    return this.request<HubConnectionsResponse>(\"/v1/hub/connections\", {\n      method: \"GET\",\n    });\n  }\n\n  /** Connector catalog: every provider the hub can expose, each flagged with\n   *  `configured` (whether its OAuth app credentials are wired). Callers render\n   *  this alongside `list()` to offer Connect for not-yet-connected providers. */\n  async providers(): Promise<HubProvidersResponse> {\n    return this.request<HubProvidersResponse>(\"/v1/hub/providers\", {\n      method: \"GET\",\n    });\n  }\n\n  async start(\n    provider: string,\n    options: HubConnectionStartOptions = {},\n  ): Promise<HubOAuthStartResponse> {\n    return this.request<HubOAuthStartResponse>(\n      `/v1/hub/connections/${encodeURIComponent(provider)}/start`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({\n          returnUrl: options.returnUrl,\n          cli: options.cli,\n        }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async startWhatsappEmbeddedSignup(\n    options: HubWhatsappEmbeddedSignupStartRequest = {},\n  ): Promise<HubWhatsappEmbeddedSignupStartResponse> {\n    return this.request<HubWhatsappEmbeddedSignupStartResponse>(\n      \"/v1/hub/connections/whatsapp-business/embedded-signup/start\",\n      {\n        method: \"POST\",\n        body: JSON.stringify({ returnUrl: options.returnUrl }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async completeWhatsappEmbeddedSignup(\n    input: HubWhatsappEmbeddedSignupCompleteRequest,\n  ): Promise<HubWhatsappEmbeddedSignupCompleteResponse> {\n    return this.request<HubWhatsappEmbeddedSignupCompleteResponse>(\n      \"/v1/hub/connections/whatsapp-business/embedded-signup/complete\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /** Connect a non-OAuth (api-key) connector by submitting the user's key.\n   *  The server validates the key with a live probe before persisting and\n   *  returns the created (or reconnected) connection — there is no redirect,\n   *  unlike `start`. */\n  async connectApiKey(\n    provider: string,\n    apiKey: string,\n  ): Promise<HubApiKeyConnectResponse> {\n    return this.request<HubApiKeyConnectResponse>(\n      `/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({ apiKey }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async revoke(connectionId: string): Promise<HubConnectionDeleteResponse> {\n    return this.request<HubConnectionDeleteResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async health(connectionId: string): Promise<HubConnectionHealthResponse> {\n    return this.request<HubConnectionHealthResponse>(\n      `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`,\n      { method: \"POST\" },\n    );\n  }\n}\n\nexport class HubApprovalsClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(): Promise<HubApprovalListResponse> {\n    return this.request<HubApprovalListResponse>(\"/v1/hub/approvals\", {\n      method: \"GET\",\n    });\n  }\n\n  async approve(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`,\n      { method: \"POST\" },\n    );\n  }\n\n  async deny(approvalId: string): Promise<HubApprovalDecisionResponse> {\n    return this.request<HubApprovalDecisionResponse>(\n      `/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`,\n      { method: \"POST\" },\n    );\n  }\n}\n\n// GitHub App primitive. The hub holds the App PEM + the per-tenant\n// installation grants; consumers (intelligence autonomous-improvement loop,\n// future code reviewers) ask the hub to mint a short-lived repo-scoped\n// installation token. The mint call MUST be principal-authed; the hub refuses\n// without a matching grant for the calling principal.\nexport class HubGithubAppClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async mintInstallationToken(\n    input: HubGithubAppMintInstallationTokenRequest,\n  ): Promise<HubGithubAppMintInstallationTokenResponse> {\n    return this.request<HubGithubAppMintInstallationTokenResponse>(\n      \"/v1/hub/github-app/mint-installation-token\",\n      {\n        method: \"POST\",\n        body: JSON.stringify(input),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async getInstallation(\n    installationId: number,\n  ): Promise<HubGithubAppInstallationResponse> {\n    return this.request<HubGithubAppInstallationResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async listRepos(\n    installationId: number,\n  ): Promise<HubGithubAppListReposResponse> {\n    return this.request<HubGithubAppListReposResponse>(\n      `/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/repos`,\n      { method: \"GET\" },\n    );\n  }\n\n  async isRepoInstalled(input: {\n    owner: string;\n    repo: string;\n  }): Promise<HubGithubAppIsRepoInstalledResponse> {\n    const params = new URLSearchParams({\n      owner: input.owner,\n      repo: input.repo,\n    });\n    return this.request<HubGithubAppIsRepoInstalledResponse>(\n      `/v1/hub/github-app/is-repo-installed?${params.toString()}`,\n      { method: \"GET\" },\n    );\n  }\n}\n\nexport class HubAuditClient {\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n  ) {}\n\n  async list(options: HubAuditListRequest = {}): Promise<HubAuditResponse> {\n    const searchParams = new URLSearchParams();\n    if (options.provider !== undefined)\n      searchParams.set(\"provider\", options.provider);\n    if (options.action !== undefined)\n      searchParams.set(\"action\", options.action);\n    if (options.status !== undefined)\n      searchParams.set(\"status\", options.status);\n    if (options.since !== undefined) searchParams.set(\"since\", options.since);\n    if (options.until !== undefined) searchParams.set(\"until\", options.until);\n    if (options.cursor !== undefined)\n      searchParams.set(\"cursor\", options.cursor);\n    if (options.limit !== undefined)\n      searchParams.set(\"limit\", String(options.limit));\n    const query = searchParams.toString();\n    return this.request<HubAuditResponse>(\n      `/v1/hub/audit${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n  }\n}\n\n// Workflow resource. Unlike the rest of the hub surface these endpoints live\n// at `/v1/workflows` (the platform root, not `/v1/hub`), but they share the\n// same auth + envelope, so they ride the same client. YAML is the durable\n// representation — create/update take a raw YAML string and the platform\n// compiles it to the engine's run model.\nexport class HubWorkflowsClient {\n  // `stream` is optional so the exported constructor stays source-compatible\n  // with the pre-streaming `new HubWorkflowsClient(request)` shape. `HubClient`\n  // always supplies it; only `watchRun` needs it, and it fails loudly when a\n  // client was built without it.\n  constructor(\n    private readonly request: <TData>(\n      path: string,\n      init: RequestInit,\n    ) => Promise<TData>,\n    private readonly stream?: (\n      path: string,\n      init: RequestInit,\n    ) => Promise<ReadableStream<Uint8Array>>,\n  ) {}\n\n  async list(): Promise<HubWorkflow[]> {\n    return this.request<HubWorkflow[]>(\"/v1/workflows\", { method: \"GET\" });\n  }\n\n  async get(id: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      { method: \"GET\" },\n    );\n  }\n\n  async create(yaml: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\"/v1/workflows\", {\n      method: \"POST\",\n      body: JSON.stringify({ yaml }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async update(id: string, yaml: string): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      {\n        method: \"PUT\",\n        body: JSON.stringify({ yaml }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  async delete(id: string): Promise<void> {\n    await this.request<undefined>(`/v1/workflows/${encodeURIComponent(id)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  /**\n   * Enable or disable a workflow without editing its YAML. Works even when the\n   * workflow's connection was revoked (a disabled workflow can't be recompiled\n   * via `update`, but it can still be paused/resumed here).\n   */\n  async setEnabled(id: string, enabled: boolean): Promise<HubWorkflow> {\n    return this.request<HubWorkflow>(\n      `/v1/workflows/${encodeURIComponent(id)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ enabled }),\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  /**\n   * One page of run history, newest first. Pass the previous page's\n   * `nextCursor` to fetch the next; a null `nextCursor` means the last page.\n   */\n  async listRuns(\n    id: string,\n    opts: { limit?: number; cursor?: string } = {},\n  ): Promise<HubWorkflowRunsPage> {\n    const params = new URLSearchParams();\n    if (opts.limit !== undefined) params.set(\"limit\", String(opts.limit));\n    if (opts.cursor !== undefined) params.set(\"cursor\", opts.cursor);\n    const query = params.toString();\n    return this.request<HubWorkflowRunsPage>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs${query ? `?${query}` : \"\"}`,\n      { method: \"GET\" },\n    );\n  }\n\n  /**\n   * Enqueue an immediate (\"Run now\") run and return its `runId`. The run goes\n   * through the identical execution path a trigger delivery uses.\n   *\n   * `inputs` supplies the trigger fields the workflow reads (its\n   * {@link HubWorkflow.manualRunInputs}), as a flat `{ path: value }` map — e.g.\n   * `{ \"pull_request.number\": \"123\" }`. Omit it for a one-click run of a\n   * workflow that reads no trigger fields. Throws `HubSdkError`:\n   * `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`\n   * names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`\n   * for an unknown/foreign id. Pass `opts.signal` to abort a slow request.\n   */\n  async run(\n    id: string,\n    inputs?: HubWorkflowRunInputs,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunEnqueued> {\n    const hasInputs = inputs !== undefined && Object.keys(inputs).length > 0;\n    return this.request<HubWorkflowRunEnqueued>(\n      `/v1/workflows/${encodeURIComponent(id)}/run`,\n      {\n        method: \"POST\",\n        body: JSON.stringify(hasInputs ? { inputs } : {}),\n        headers: { \"Content-Type\": \"application/json\" },\n        ...(opts.signal ? { signal: opts.signal } : {}),\n      },\n    );\n  }\n\n  /**\n   * A single run's full detail: per-action `output` + `agentRun` execution\n   * detail (size-capped server-side) and the trigger context — the deep \"why\n   * did this run do what it did\" view. `NOT_FOUND` when the run is unknown or\n   * does not belong to both the caller and this workflow.\n   */\n  async getRun(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunDetail> {\n    return this.request<HubWorkflowRunDetail>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}`,\n      { method: \"GET\", ...(opts.signal ? { signal: opts.signal } : {}) },\n    );\n  }\n\n  /**\n   * Stop a queued or in-flight run. A `queued` run is cancelled synchronously\n   * and comes back `{ status: \"cancelled\" }` (already terminal); a `running` run\n   * is signalled to abort and comes back `{ status: \"cancelling\", signalled }` —\n   * it settles `cancelled` a moment later as its current action tears down, which\n   * a {@link watchRun}/{@link getRun} observes. Throws `HubSdkError`:\n   * `RUN_NOT_CANCELLABLE` when the run already finished, `NOT_FOUND` for an\n   * unknown/foreign run id. Pass `opts.signal` to abort a slow request.\n   */\n  async cancel(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): Promise<HubWorkflowRunCancelResult> {\n    return this.request<HubWorkflowRunCancelResult>(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/cancel`,\n      { method: \"POST\", ...(opts.signal ? { signal: opts.signal } : {}) },\n    );\n  }\n\n  /**\n   * Stream a run's live progress as an async iterable of typed events. The\n   * first event is always a `snapshot` of the current persisted state; then\n   * `action.*` / `iteration.*` / `token` ticks arrive as the run executes;\n   * `ping` is a keepalive; a terminal `run.done` ends the iteration. If the run\n   * is already finished when the stream opens, it yields the snapshot then\n   * `run.done` and completes.\n   *\n   * Live ticks require the worker executing the run to share the API process;\n   * across instances only `snapshot` + `run.done` (from the server's terminal\n   * poll) arrive — the persisted record, read via {@link getRun}, stays the\n   * source of truth. Pass `signal` to cancel; iterating to `run.done` (or\n   * breaking early) releases the connection.\n   */\n  async *watchRun(\n    id: string,\n    runId: string,\n    opts: { signal?: AbortSignal } = {},\n  ): AsyncGenerator<HubWorkflowRunStreamEvent> {\n    const openStream = this.stream;\n    if (!openStream) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message:\n          \"watchRun needs a streaming transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly\",\n      });\n    }\n    const body = await openStream(\n      `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`,\n      {\n        method: \"GET\",\n        headers: { Accept: \"text/event-stream\" },\n        ...(opts.signal ? { signal: opts.signal } : {}),\n      },\n    );\n    // Frame + parse with the shared SSE primitive (`SSEChunkParser` from\n    // sdk-telemetry). A malformed `data:` payload becomes null and is skipped\n    // rather than throwing mid-stream.\n    const reader = body.getReader();\n    const decoder = new TextDecoder();\n    const parser = new SSEChunkParser<unknown>({\n      transform: (raw) => {\n        try {\n          return JSON.parse(raw);\n        } catch {\n          return null;\n        }\n      },\n    });\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        const text = done\n          ? decoder.decode()\n          : decoder.decode(value, { stream: true });\n        const parsedEvents = done\n          ? [...parser.push(text), ...parser.flush()]\n          : parser.push(text);\n        for (const parsed of parsedEvents) {\n          const event = toRunStreamEvent(parsed.eventType, parsed.data);\n          if (!event) continue;\n          yield event;\n          // Both terminal completion and a decision park end the stream.\n          if (event.type === \"run.done\" || event.type === \"run.waiting\") return;\n        }\n        if (done) return;\n      }\n    } finally {\n      // Cancel through the reader on every exit (early break, run.done, throw)\n      // to tear down the HTTP/SSE connection; it's a safe no-op once the stream\n      // has closed on its own. NOT releaseLock() — cancelling via the reader\n      // already tears down the source, and releaseLock() after cancel risks a\n      // TypeError if a read is still settling. (body.cancel() can't be used here\n      // — getReader() locks the body.)\n      await reader.cancel().catch(() => {});\n    }\n  }\n\n  /**\n   * Poll {@link getRun} until the run reaches a terminal state (`succeeded` or\n   * `failed`) and return its detail. The scripting primitive behind \"run and\n   * print the result\": pairs with {@link run} for a one-call trigger-and-wait.\n   *\n   * Returns as soon as the run leaves the active set (`queued` / `running`) —\n   * i.e. on `succeeded`, `failed`, or any future non-active status — so a new\n   * terminal state can never hang the wait. Polls every `pollIntervalMs`\n   * (default 2000). With `timeoutMs` set, throws\n   * `HubSdkError(WORKFLOW_RUN_TIMEOUT)` — carrying the last observed status on\n   * `details.status` — only once the deadline has actually passed; the last\n   * wait is clamped to the remaining time so a `timeoutMs` shorter than the\n   * poll interval still waits the full requested window rather than giving up a\n   * poll early. Pass `signal` to cancel the wait between polls.\n   */\n  async waitForRun(\n    id: string,\n    runId: string,\n    opts: {\n      pollIntervalMs?: number;\n      timeoutMs?: number;\n      signal?: AbortSignal;\n    } = {},\n  ): Promise<HubWorkflowRunDetail> {\n    const pollIntervalMs = opts.pollIntervalMs ?? 2000;\n    // Guard against a bad poll cadence turning the loop into a getRun hot-loop\n    // (e.g. 0 / NaN → zero-delay timers).\n    if (!Number.isFinite(pollIntervalMs) || pollIntervalMs <= 0) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message: `waitForRun pollIntervalMs must be a positive number (got ${opts.pollIntervalMs})`,\n      });\n    }\n    if (\n      opts.timeoutMs !== undefined &&\n      (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs <= 0)\n    ) {\n      throw new HubSdkError({\n        code: \"HUB_CONFIG_INVALID\",\n        message: `waitForRun timeoutMs must be a positive number (got ${opts.timeoutMs})`,\n      });\n    }\n    const deadline =\n      opts.timeoutMs !== undefined ? Date.now() + opts.timeoutMs : null;\n    const timeoutError = (status: HubWorkflowRunStatus | undefined) =>\n      new HubSdkError({\n        code: \"WORKFLOW_RUN_TIMEOUT\",\n        message: `Workflow run ${runId} did not reach a terminal state within ${opts.timeoutMs}ms${status ? ` (last status: ${status})` : \"\"}`,\n        details: { runId, status, timeoutMs: opts.timeoutMs },\n      });\n    let lastStatus: HubWorkflowRunStatus | undefined;\n    for (;;) {\n      if (opts.signal?.aborted) {\n        throw opts.signal.reason ?? new Error(\"The operation was aborted\");\n      }\n      const remainingMs = deadline !== null ? deadline - Date.now() : null;\n      if (remainingMs !== null && remainingMs <= 0)\n        throw timeoutError(lastStatus);\n\n      // Abort the in-flight poll if the caller aborts OR the deadline elapses\n      // mid-request, so a hung getRun can't outlive `timeoutMs` / ignore `signal`.\n      const pollSignal = combineAbortSignals(opts.signal, remainingMs);\n      let run: HubWorkflowRunDetail;\n      try {\n        run = await this.getRun(\n          id,\n          runId,\n          pollSignal ? { signal: pollSignal } : {},\n        );\n      } catch (err) {\n        // Caller cancellation propagates as-is; a deadline-driven abort becomes\n        // the typed timeout.\n        if (opts.signal?.aborted) throw err;\n        if (deadline !== null && isAbortError(err))\n          throw timeoutError(lastStatus);\n        throw err;\n      }\n      lastStatus = run.status;\n      // Terminal = anything not still in flight. Waiting for a fixed\n      // {succeeded,failed} allow-list would hang forever if the run reached a\n      // status added later (e.g. a future `cancelled`).\n      if (run.status !== \"queued\" && run.status !== \"running\") return run;\n      // Recompute the remaining budget AFTER the poll — `getRun` may have\n      // consumed most of it — so the wait is clamped to what's actually left\n      // and can never overshoot `timeoutMs`.\n      const delayRemainingMs = deadline !== null ? deadline - Date.now() : null;\n      if (delayRemainingMs !== null && delayRemainingMs <= 0) {\n        throw timeoutError(lastStatus);\n      }\n      await delay(\n        delayRemainingMs !== null\n          ? Math.min(pollIntervalMs, delayRemainingMs)\n          : pollIntervalMs,\n        opts.signal,\n      );\n    }\n  }\n\n  async validate(yaml: string): Promise<HubWorkflowValidateResponse> {\n    return this.request<HubWorkflowValidateResponse>(\"/v1/workflows/validate\", {\n      method: \"POST\",\n      body: JSON.stringify({ yaml }),\n      headers: { \"Content-Type\": \"application/json\" },\n    });\n  }\n\n  async schema(): Promise<HubWorkflowSchemaResponse> {\n    return this.request<HubWorkflowSchemaResponse>(\"/v1/workflows/schema\", {\n      method: \"GET\",\n    });\n  }\n}\n","import type { HubEventDelivery } from \"./types.js\";\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\nconst MAX_TOLERANCE_SECONDS = 3_600;\nconst MAX_SIGNATURE_HEADER_LENGTH = 1_024;\nconst MAX_SIGNATURES = 5;\nconst SHA256_HEX_LENGTH = 64;\nconst MIN_CALLBACK_SECRET_BYTES = 32;\nconst MAX_SECRET_SCOPE_COMPONENT_BYTES = 512;\nconst DEFAULT_MAX_CALLBACK_BODY_BYTES = 5 * 1024 * 1024 + 64 * 1024;\nconst MAX_CALLBACK_BODY_BYTES = 10 * 1024 * 1024;\n\nexport type HubEventSignatureFailure =\n  | \"missing\"\n  | \"malformed\"\n  | \"stale\"\n  | \"mismatch\";\n\nexport type HubEventSignatureResult =\n  | { valid: true; timestamp: number }\n  | { valid: false; reason: HubEventSignatureFailure };\n\nexport interface VerifyHubEventSignatureInput {\n  body: string;\n  signature: string | null | undefined;\n  secret: string;\n  toleranceSeconds?: number;\n  now?: number | Date;\n}\n\nexport interface DeriveHubEventCallbackSecretInput {\n  /** App-level secret stored only in the product's server environment. */\n  rootSecret: string;\n  /** Stable product slug, such as `relationships`. */\n  productId: string;\n  /** Stable Tangle owner id; user and team ids are both valid. */\n  ownerId: string;\n  /** Stable product-local binding id used in the callback route. */\n  bindingId: string;\n}\n\nexport type HubEventRequestFailureCode =\n  | \"METHOD_NOT_ALLOWED\"\n  | \"UNEXPECTED_EVENT\"\n  | \"UNSUPPORTED_MEDIA_TYPE\"\n  | \"PAYLOAD_TOO_LARGE\"\n  | \"INVALID_SIGNATURE\"\n  | \"INVALID_DELIVERY\"\n  | \"DELIVERY_ID_MISMATCH\";\n\nexport type HubEventRequestResult =\n  | { ok: true; delivery: HubEventDelivery }\n  | {\n      ok: false;\n      code: HubEventRequestFailureCode;\n      response: Response;\n    };\n\nexport interface AuthenticateHubEventRequestInput {\n  request: Request;\n  /** The per-binding secret supplied when the subscription was created. */\n  secret: string;\n  /** Defaults to 5 MiB plus envelope overhead; hard-capped at 10 MiB. */\n  maxBodyBytes?: number;\n  toleranceSeconds?: number;\n  now?: number | Date;\n}\n\nexport class HubEventDeliveryError extends Error {\n  readonly code:\n    | \"INVALID_JSON\"\n    | \"INVALID_PAYLOAD\"\n    | \"CRYPTO_UNAVAILABLE\"\n    | \"INVALID_TOLERANCE\"\n    | \"INVALID_CALLBACK_SECRET\"\n    | \"INVALID_SECRET_SCOPE\"\n    | \"INVALID_BODY_LIMIT\";\n\n  constructor(code: HubEventDeliveryError[\"code\"], message: string) {\n    super(message);\n    this.name = \"HubEventDeliveryError\";\n    this.code = code;\n  }\n}\n\n/**\n * Derive one callback secret per product binding from a single server-held root\n * secret. Products persist only the binding id; the derived secret can be\n * reproduced for callback authentication without another secret table.\n */\nexport async function deriveHubEventCallbackSecret(\n  input: DeriveHubEventCallbackSecretInput,\n): Promise<string> {\n  const encoder = new TextEncoder();\n  if (encoder.encode(input.rootSecret).byteLength < MIN_CALLBACK_SECRET_BYTES) {\n    throw new HubEventDeliveryError(\n      \"INVALID_CALLBACK_SECRET\",\n      `Hub event root secret must contain at least ${MIN_CALLBACK_SECRET_BYTES} UTF-8 bytes`,\n    );\n  }\n  for (const [name, value] of [\n    [\"productId\", input.productId],\n    [\"ownerId\", input.ownerId],\n    [\"bindingId\", input.bindingId],\n  ] as const) {\n    const bytes = encoder.encode(value).byteLength;\n    if (bytes === 0 || bytes > MAX_SECRET_SCOPE_COMPONENT_BYTES) {\n      throw new HubEventDeliveryError(\n        \"INVALID_SECRET_SCOPE\",\n        `${name} must contain 1-${MAX_SECRET_SCOPE_COMPONENT_BYTES} UTF-8 bytes`,\n      );\n    }\n  }\n  const subtle = requireSubtleCrypto();\n  const key = await subtle.importKey(\n    \"raw\",\n    encoder.encode(input.rootSecret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const scope = JSON.stringify([\n    \"tangle-hub-event-callback\",\n    1,\n    input.productId,\n    input.ownerId,\n    input.bindingId,\n  ]);\n  const signature = new Uint8Array(\n    await subtle.sign(\"HMAC\", key, encoder.encode(scope)),\n  );\n  return bytesToBase64Url(signature);\n}\n\n/**\n * Authenticate and parse the platform's callback as one operation. The exact\n * raw body is read once with a size limit before its signature is checked.\n *\n * A successful callback can be retried. Use `delivery.runId` as the durable\n * idempotency key before starting product work.\n */\nexport async function authenticateHubEventRequest(\n  input: AuthenticateHubEventRequestInput,\n): Promise<HubEventRequestResult> {\n  if (input.request.method !== \"POST\") {\n    return requestFailure(\"METHOD_NOT_ALLOWED\", 405, \"method_not_allowed\", {\n      Allow: \"POST\",\n    });\n  }\n  if (input.request.headers.get(\"x-tangle-event\") !== \"hub.event\") {\n    return requestFailure(\"UNEXPECTED_EVENT\", 400, \"invalid_hub_event\");\n  }\n  const contentType = input.request.headers.get(\"content-type\") ?? \"\";\n  if (!/^application\\/json(?:\\s*;|$)/i.test(contentType)) {\n    return requestFailure(\n      \"UNSUPPORTED_MEDIA_TYPE\",\n      415,\n      \"unsupported_media_type\",\n    );\n  }\n  const maxBodyBytes = input.maxBodyBytes ?? DEFAULT_MAX_CALLBACK_BODY_BYTES;\n  if (\n    !Number.isSafeInteger(maxBodyBytes) ||\n    maxBodyBytes < 1 ||\n    maxBodyBytes > MAX_CALLBACK_BODY_BYTES\n  ) {\n    throw new HubEventDeliveryError(\n      \"INVALID_BODY_LIMIT\",\n      `Hub event body limit must be an integer from 1 to ${MAX_CALLBACK_BODY_BYTES} bytes`,\n    );\n  }\n  if (\n    new TextEncoder().encode(input.secret).byteLength <\n    MIN_CALLBACK_SECRET_BYTES\n  ) {\n    throw new HubEventDeliveryError(\n      \"INVALID_CALLBACK_SECRET\",\n      `Hub event callback secret must contain at least ${MIN_CALLBACK_SECRET_BYTES} UTF-8 bytes`,\n    );\n  }\n  const declaredLength = input.request.headers.get(\"content-length\");\n  if (\n    declaredLength !== null &&\n    /^\\d+$/.test(declaredLength) &&\n    Number(declaredLength) > maxBodyBytes\n  ) {\n    return requestFailure(\"PAYLOAD_TOO_LARGE\", 413, \"payload_too_large\");\n  }\n  const body = await readRequestBody(input.request, maxBodyBytes);\n  if (body === null) {\n    return requestFailure(\"PAYLOAD_TOO_LARGE\", 413, \"payload_too_large\");\n  }\n  const signature = await verifyHubEventSignature({\n    body,\n    signature: input.request.headers.get(\"x-tangle-signature\"),\n    secret: input.secret,\n    ...(input.toleranceSeconds !== undefined\n      ? { toleranceSeconds: input.toleranceSeconds }\n      : {}),\n    ...(input.now !== undefined ? { now: input.now } : {}),\n  });\n  if (!signature.valid) {\n    return requestFailure(\"INVALID_SIGNATURE\", 401, \"invalid_signature\");\n  }\n  let delivery: HubEventDelivery;\n  try {\n    delivery = parseHubEventDelivery(body);\n  } catch (error) {\n    if (error instanceof HubEventDeliveryError) {\n      return requestFailure(\"INVALID_DELIVERY\", 400, \"invalid_delivery\");\n    }\n    throw error;\n  }\n  if (input.request.headers.get(\"x-tangle-delivery-id\") !== delivery.runId) {\n    return requestFailure(\"DELIVERY_ID_MISMATCH\", 400, \"invalid_delivery\");\n  }\n  return { ok: true, delivery };\n}\n\n/**\n * Authenticate a Hub event callback against its exact raw request body.\n * The timestamp window rejects captured-request replay, and byte-wise\n * comparison avoids secret-dependent string comparison behavior.\n */\nexport async function verifyHubEventSignature(\n  input: VerifyHubEventSignatureInput,\n): Promise<HubEventSignatureResult> {\n  if (!input.signature) return { valid: false, reason: \"missing\" };\n  if (input.signature.length > MAX_SIGNATURE_HEADER_LENGTH) {\n    return { valid: false, reason: \"malformed\" };\n  }\n  const parsed = parseSignatureHeader(input.signature);\n  if (!parsed) return { valid: false, reason: \"malformed\" };\n\n  const tolerance = input.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  if (\n    !Number.isFinite(tolerance) ||\n    !Number.isInteger(tolerance) ||\n    tolerance < 0 ||\n    tolerance > MAX_TOLERANCE_SECONDS\n  ) {\n    throw new HubEventDeliveryError(\n      \"INVALID_TOLERANCE\",\n      `Signature tolerance must be an integer from 0 to ${MAX_TOLERANCE_SECONDS} seconds`,\n    );\n  }\n  const nowMs =\n    input.now instanceof Date\n      ? input.now.getTime()\n      : typeof input.now === \"number\"\n        ? input.now\n        : Date.now();\n  if (\n    !Number.isFinite(nowMs) ||\n    Math.abs(Math.floor(nowMs / 1_000) - parsed.timestamp) > tolerance\n  ) {\n    return { valid: false, reason: \"stale\" };\n  }\n\n  const subtle = requireSubtleCrypto();\n  const encoder = new TextEncoder();\n  const key = await subtle.importKey(\n    \"raw\",\n    encoder.encode(input.secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const expected = new Uint8Array(\n    await subtle.sign(\n      \"HMAC\",\n      key,\n      encoder.encode(`${parsed.timestamp}.${input.body}`),\n    ),\n  );\n  let matched = 0;\n  for (const signature of parsed.signatures) {\n    matched |= constantTimeEqual(expected, signature);\n  }\n  return matched === 1\n    ? { valid: true, timestamp: parsed.timestamp }\n    : { valid: false, reason: \"mismatch\" };\n}\n\nexport function parseHubEventDelivery(\n  input: string | unknown,\n): HubEventDelivery {\n  let value: unknown = input;\n  if (typeof input === \"string\") {\n    try {\n      value = JSON.parse(input);\n    } catch {\n      throw new HubEventDeliveryError(\n        \"INVALID_JSON\",\n        \"Hub event callback body is not valid JSON\",\n      );\n    }\n  }\n  if (!isRecord(value)) return invalidDelivery();\n  const source = value.source;\n  const providerEvent = value.providerEvent;\n  if (\n    !nonEmptyString(value.subscriptionId) ||\n    !nonEmptyString(value.workflowId) ||\n    !nonEmptyString(value.runId) ||\n    !isRecord(source) ||\n    (source.kind !== \"channel\" && source.kind !== \"connection\") ||\n    !nonEmptyString(source.id) ||\n    !nonEmptyString(source.provider) ||\n    !nonEmptyString(source.event) ||\n    !isRecord(providerEvent) ||\n    !nonEmptyString(providerEvent.provider) ||\n    !nonEmptyString(providerEvent.connectionId) ||\n    !nonEmptyString(providerEvent.type) ||\n    providerEvent.provider !== source.provider ||\n    providerEvent.type !== source.event ||\n    !Object.hasOwn(providerEvent, \"payload\") ||\n    !optionalString(providerEvent.action) ||\n    !optionalString(providerEvent.repo) ||\n    !optionalString(providerEvent.deliveryId) ||\n    !nonEmptyString(value.firedAt) ||\n    !Number.isFinite(Date.parse(value.firedAt))\n  ) {\n    return invalidDelivery();\n  }\n  return {\n    subscriptionId: value.subscriptionId,\n    workflowId: value.workflowId,\n    runId: value.runId,\n    source: {\n      kind: source.kind,\n      id: source.id,\n      provider: source.provider,\n      event: source.event,\n    },\n    providerEvent: {\n      provider: providerEvent.provider,\n      connectionId: providerEvent.connectionId,\n      type: providerEvent.type,\n      ...(typeof providerEvent.action === \"string\"\n        ? { action: providerEvent.action }\n        : {}),\n      ...(typeof providerEvent.repo === \"string\"\n        ? { repo: providerEvent.repo }\n        : {}),\n      ...(typeof providerEvent.deliveryId === \"string\"\n        ? { deliveryId: providerEvent.deliveryId }\n        : {}),\n      payload: providerEvent.payload,\n    },\n    firedAt: value.firedAt,\n  };\n}\n\nfunction parseSignatureHeader(\n  header: string,\n): { timestamp: number; signatures: Uint8Array[] } | null {\n  let timestamp: number | undefined;\n  const signatures: Uint8Array[] = [];\n  for (const segment of header.split(\",\")) {\n    const separator = segment.indexOf(\"=\");\n    if (separator <= 0) return null;\n    const key = segment.slice(0, separator).trim();\n    const value = segment.slice(separator + 1).trim();\n    if (key === \"t\") {\n      if (timestamp !== undefined || !/^\\d+$/.test(value)) return null;\n      const candidate = Number(value);\n      if (!Number.isSafeInteger(candidate) || candidate <= 0) return null;\n      timestamp = candidate;\n    } else if (key === \"v1\") {\n      if (\n        signatures.length >= MAX_SIGNATURES ||\n        value.length !== SHA256_HEX_LENGTH ||\n        !/^[0-9a-f]+$/i.test(value)\n      ) {\n        return null;\n      }\n      signatures.push(hexToBytes(value));\n    }\n  }\n  return timestamp !== undefined && signatures.length > 0\n    ? { timestamp, signatures }\n    : null;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let index = 0; index < bytes.length; index += 1) {\n    bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nfunction constantTimeEqual(expected: Uint8Array, actual: Uint8Array): number {\n  let difference = expected.length ^ actual.length;\n  const length = Math.max(expected.length, actual.length);\n  for (let index = 0; index < length; index += 1) {\n    difference |=\n      (expected[index % expected.length] ?? 0) ^\n      (actual[index % actual.length] ?? 0);\n  }\n  return difference === 0 ? 1 : 0;\n}\n\nfunction nonEmptyString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n\nfunction optionalString(value: unknown): boolean {\n  return value === undefined || nonEmptyString(value);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction invalidDelivery(): never {\n  throw new HubEventDeliveryError(\n    \"INVALID_PAYLOAD\",\n    \"Hub event callback body does not match the delivery contract\",\n  );\n}\n\nfunction requireSubtleCrypto(): SubtleCrypto {\n  const subtle = globalThis.crypto?.subtle;\n  if (!subtle) {\n    throw new HubEventDeliveryError(\n      \"CRYPTO_UNAVAILABLE\",\n      \"Web Crypto is required for Hub event callback authentication\",\n    );\n  }\n  return subtle;\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n\nasync function readRequestBody(\n  request: Request,\n  maxBytes: number,\n): Promise<string | null> {\n  const reader = request.body?.getReader();\n  if (!reader) return \"\";\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  try {\n    while (true) {\n      const next = await reader.read();\n      if (next.done) break;\n      total += next.value.byteLength;\n      if (total > maxBytes) return null;\n      chunks.push(next.value);\n    }\n  } finally {\n    await reader.cancel().catch(() => {});\n  }\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return new TextDecoder().decode(body);\n}\n\nfunction requestFailure(\n  code: HubEventRequestFailureCode,\n  status: number,\n  error: string,\n  headers?: HeadersInit,\n): Extract<HubEventRequestResult, { ok: false }> {\n  return {\n    ok: false,\n    code,\n    response: Response.json(\n      { error },\n      {\n        status,\n        headers: {\n          \"cache-control\": \"no-store\",\n          ...(headers ? Object.fromEntries(new Headers(headers)) : {}),\n        },\n      },\n    ),\n  };\n}\n"],"mappings":";;AAAA,MAAM,qBACJ;AACF,MAAM,uBACJ;AAEF,SAAgB,eAAe,OAAyB;AACtD,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,QAAQ,sBAAsB,aAAa;AAG1D,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,KAAK,CAAC;AAGlD,KAAI,SAAS,OAAO,UAAU,SAC5B,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAC/C,KACA,mBAAmB,KAAK,IAAI,GACxB,eACA,eAAe,WAAW,CAC/B,CAAC,CACH;AAGH,QAAO;;;;AC4CT,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CAEA,YAAY,OAAqB,UAA+B,EAAE,EAAE;AAClE,QAAM,OAAO,eAAe,MAAM,QAAQ,CAAC,CAAC;AAC5C,OAAK,OAAO;AACZ,OAAK,OAAO,MAAM;AAClB,OAAK,UAAU,eAAe,MAAM,QAAQ;AAC5C,OAAK,SAAS,QAAQ;;;AAQ1B,SAAS,YAAY,MAAc,MAAM,KAAa;CACpD,MAAM,UAAU,KAAK,MAAM;AAC3B,QAAO,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,IAAI,CAAC,KAAK;;AAM9D,SAAS,UACP,MACA,QACA,YACA,MACA,aACa;CACb,MAAM,SAAS,aAAa,IAAI,eAAe;AAC/C,QAAO,IAAI,YACT;EACE,MAAM,YAAY;EAClB,SAAS,eAAe,KAAK,gBAAgB,SAAS;EACtD,SAAS;GACP;GACA;GACA,aAAa,eAAe;GAC5B,aAAa,YAAY,KAAK;GAC/B;EACF,EACD,EAAE,QAAQ,CACX;;AAGH,SAAS,mBAAmB,OAA2C;AACrE,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;CACxD,MAAM,YAAY;AAClB,KAAI,UAAU,YAAY,MAAO,QAAO;CACxC,MAAM,QAAQ,UAAU;AACxB,QACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAO,MAAM,SAAS;;AAI1B,SAAS,qBACP,OACoC;AACpC,QACE,OAAO,UAAU,YACjB,UAAU,QACT,MAAgC,YAAY;;AAIjD,SAASA,WAAS,OAAkD;AAClE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAGhD,SAAS,UAAU,OAAwB;AACzC,QAAO,OAAO,UAAU,WAAW,QAAQ;;;;AAK7C,SAAS,kBAAkB,OAAiD;AAC1E,QAAO,UAAU,eAAe,UAAU;;;;;AAM5C,SAAS,uBACP,OAC6C;AAC7C,QAAO,UAAU,eAAe,UAAU,YAAY,UAAU;;;;;;AAOlE,SAAS,gBACP,OAC+C;AAC/C,QAAO,UAAU,eAAe,UAAU,YAAY,UAAU;;;;;;;;;;AAWlE,SAAS,iBACP,WACA,MACkC;AAClC,KAAI,cAAc,OAAQ,QAAO,EAAE,MAAM,QAAQ;AACjD,KAAI,CAACA,WAAS,KAAK,CAAE,QAAO;AAC5B,SAAQ,WAAR;EACE,KAAK,WAOH,QAAO,OAAO,KAAK,OAAO,YACxB,OAAO,KAAK,eAAe,YAC3B,OAAO,KAAK,WAAW,YACvB,MAAM,QAAQ,KAAK,cAAc,GAC/B;GAAE,MAAM;GAAY,KAAK;GAAyC,GAClE;EACN,KAAK,QAGH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,gBAAgB,WAC1B;GACE,MAAM;GACN,aAAa,KAAK;GAClB,OAAO,KAAK;GACZ,IAAI,UAAU,KAAK,GAAG;GACvB,GACD;EACN,KAAK,WAIH,QAAO,gBAAgB,KAAK,OAAO,GAC/B;GACE,MAAM;GACN,QAAQ,KAAK;GACb,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;GACrD,GAAI,OAAO,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,IAAI,GAAG,EAAE;GACvD,GACD;EACN,KAAK,cAOH,QAAO,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,SAAS,IACnE;GACE,MAAM;GACN,YAAY,KAAK;GACjB,GAAI,OAAO,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,IAAI,GAAG,EAAE;GACvD,GACD;EAKN,KAAK,iBACH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,SAAS,YACrB,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,IAAI,KAAK;GACV,GACD;EACN,KAAK,kBACH,QAAO,OAAO,KAAK,UAAU,YAC3B,OAAO,KAAK,SAAS,YACrB,uBAAuB,KAAK,OAAO,IACnC,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,YAAY,WACxB,EAAE,SAAS,KAAK,SAAS,GACzB,EAAE;GACN,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;GAChE,GACD;EACN,KAAK,oBACH,QAAO,OAAO,KAAK,gBAAgB,YACjC,OAAO,KAAK,mBAAmB,YAC/B,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,aAAa,KAAK;GAClB,gBAAgB,KAAK;GACrB,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;GAChE,GACD;EACN,KAAK,kBACH,QAAO,OAAO,KAAK,gBAAgB,YACjC,OAAO,KAAK,mBAAmB,YAC/B,kBAAkB,KAAK,OAAO,IAC9B,OAAO,KAAK,OAAO,WACjB;GACE,MAAM;GACN,aAAa,KAAK;GAClB,gBAAgB,KAAK;GACrB,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,GAAI,OAAO,KAAK,kBAAkB,WAC9B,EAAE,eAAe,KAAK,eAAe,GACrC,EAAE;GACN,GAAI,OAAO,KAAK,gBAAgB,WAC5B,EAAE,aAAa,KAAK,aAAa,GACjC,EAAE;GACN,GAAI,OAAO,KAAK,iBAAiB,WAC7B,EAAE,cAAc,KAAK,cAAc,GACnC,EAAE;GACN,GAAI,OAAO,KAAK,YAAY,WACxB,EAAE,SAAS,KAAK,SAAS,GACzB,EAAE;GACP,GACD;EACN,QACE,QAAO;;;;;;AAOb,SAAS,aAAa,KAAuB;AAC3C,QACE,eAAe,UACd,IAAI,SAAS,gBAAgB,IAAI,SAAS;;;;AAM/C,SAAS,oBACP,QACA,WACyB;CACzB,MAAM,UAAyB,EAAE;AACjC,KAAI,OAAQ,SAAQ,KAAK,OAAO;AAChC,KAAI,cAAc,KAAM,SAAQ,KAAK,YAAY,QAAQ,UAAU,CAAC;AACpE,KAAI,QAAQ,WAAW,EAAG,QAAO,KAAA;AACjC,QAAO,QAAQ,WAAW,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ;;;;AAKrE,SAAS,MAAM,IAAY,QAAqC;AAC9D,QAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,MAAI,QAAQ,SAAS;AACnB,UAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;AAC/D;;EAEF,MAAM,gBAAgB;AACpB,gBAAa,MAAM;AACnB,UAAO,QAAQ,0BAAU,IAAI,MAAM,4BAA4B,CAAC;;EAElE,MAAM,QAAQ,iBAAiB;AAC7B,WAAQ,oBAAoB,SAAS,QAAQ;AAC7C,YAAS;KACR,GAAG;AACN,UAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;GAC1D;;AAMJ,MAAa,kBAAkB;AAC/B,MAAa,sBAAsB;AACnC,MAAa,+BACX;AAeF,SAAgB,kBAAkB,MAAc,gBAAgB,EAAU;CACxE,MAAM,MAAM,IAAI;AAChB,KAAI,QAAQ,KAAA,KAAa,IAAI,MAAM,KAAK,GACtC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,GAAG,gBAAgB;EAC5B,SAAS,EAAE,QAAQ,iBAAiB;EACrC,CAAC;CAGJ,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI;AACF,MAAI,IAAI,QAAQ;SACV;AACN,QAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,GAAG,gBAAgB;GAC5B,SAAS,EAAE,QAAQ,iBAAiB;GACrC,CAAC;;AAGJ,QAAO,QAAQ,QAAQ,QAAQ,GAAG,CAAC,QAAQ,cAAc,GAAG;;AAM9D,SAAgB,eAAe,MAAc,gBAAgB,EAAU;CAGrE,MAAM,UAAU,CAFD,SAAS,IAAI,qBAEL,EADC,SAAS,IAAI,8BACG,CAAC,CAAC,QACvC,UAA2B,UAAU,KAAA,EACvC;AAED,KAAI,QAAQ,WAAW,EACrB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,UAAU,oBAAoB,MAAM,6BAA6B;EAC1E,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAEJ,KAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS,sBAAsB,oBAAoB,MAAM,6BAA6B;EACtF,SAAS,EACP,SAAS,CAAC,qBAAqB,6BAA6B,EAC7D;EACF,CAAC;AAGJ,QAAO,QAAQ;;AAGjB,SAAS,SAAS,OAA+C;AAC/D,KAAI,UAAU,KAAA,EAAW,QAAO,KAAA;CAChC,MAAM,UAAU,MAAM,MAAM;AAC5B,QAAO,QAAQ,WAAW,IAAI,KAAA,IAAY;;AAG5C,SAAS,iBAAyB;AAGhC,QADc,WAA8C,SAC/C,OAAO,EAAE;;AAGxB,IAAa,YAAb,MAAa,UAAU;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA2B;AACrC,OAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,SAAS,QAAQ;AACtB,OAAK,cAAc,QAAQ;AAK3B,OAAK,QAAQ,QAAQ,SAAS,MAAM,KAAK,WAAW;AACpD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,WAAW,IAAI,mBAAmB,MAAM,SAC3C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,qBAAqB,IAAI,6BAA6B,MAAM,SAC/D,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,cAAc,IAAI,sBAAsB,MAAM,SACjD,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,SAAS,IAAI,iBAAiB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AAC3E,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,QAAQ,IAAI,gBAAgB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,CAAC;AACzE,OAAK,YAAY,IAAI,oBAAoB,MAAM,SAC7C,KAAK,QAAQ,MAAM,KAAK,CACzB;AACD,OAAK,YAAY,IAAI,oBAClB,MAAM,SAAS,KAAK,QAAQ,MAAM,KAAK,GACvC,MAAM,SAAS,KAAK,OAAO,MAAM,KAAK,CACxC;;CASH,OAAO,QAAQ,UAAmC,EAAE,EAAa;EAC/D,MAAM,MAAM,QAAQ,OAAO,gBAAgB;AAI3C,SAAO,IAAI,UAAU;GACnB,SAJc,kBAAkB,IAIzB;GACP,QAHA,QAAQ,WAAW,QAAQ,cAAc,KAAA,IAAY,eAAe,IAAI;GAIxE,aAAa,QAAQ;GACrB,OAAO,QAAQ;GAChB,CAAC;;CAGJ,MAAM,SAAqC;AACzC,SAAO,KAAK,QAA2B,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;CAG7E,MAAc,QACZ,MACA,MACgB;EAChB,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EAEF,MAAM,SAAS,SAAS;EACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;EAC5D,MAAM,WAAW,MAAM,SAAS,MAAM;AAMtC,MAAI,CAAC,YAAY,SAAS,mBAAmB,CAC3C,OAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;EAG3E,IAAI;AACJ,MAAI;AACF,YAAS,KAAK,MAAM,SAAS;UACvB;AAGN,SAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;AAK3E,MAAI,mBAAmB,OAAO,CAC5B,OAAM,IAAI,YAAY,OAAO,OAAO,EAAE,QAAQ,CAAC;AAEjD,MAAI,qBAA4B,OAAO,CACrC,QAAO,OAAO;AAIhB,QAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;;;;;;;;;;;;CAc3E,MAAc,OACZ,MACA,MACqC;EACrC,MAAM,WAAW,MAAM,KAAK,MAAM,GAAG,KAAK,UAAU,QAAQ;GAC1D,GAAG;GACH,SAAS,MAAM,KAAK,aAAa,KAAK,QAAQ;GAC/C,CAAC;EAEF,MAAM,SAAS,SAAS;EACxB,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;AAK5D,MAAI,CAAC,SAAS,MAAM,CAAC,YAAY,SAAS,oBAAoB,EAAE;GAC9D,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,YAAY,GAAG;AACtD,OAAI,YAAY,SAAS,mBAAmB,EAAE;IAC5C,IAAI;AACJ,QAAI;AACF,cAAS,KAAK,MAAM,SAAS;YACvB;AACN,cAAS,KAAA;;AAEX,QAAI,mBAAmB,OAAO,CAC5B,OAAM,IAAI,YAAY,OAAO,OAAO,EAAE,QAAQ,CAAC;;AAGnD,SAAM,UAAU,MAAM,QAAQ,SAAS,YAAY,UAAU,YAAY;;AAG3E,MAAI,CAAC,SAAS,KACZ,OAAM,UACJ,MACA,QACA,SAAS,YACT,qCACA,YACD;AAEH,SAAO,SAAS;;CAGlB,MAAc,aAAa,SAAkC;EAC3D,MAAM,gBAAgB,IAAI,QAAQ,QAAQ;AAI1C,MAAI,CAAC,cAAc,IAAI,SAAS,CAC9B,eAAc,IAAI,UAAU,mBAAmB;AAGjD,MAAI,KAAK,OACP,eAAc,IAAI,iBAAiB,UAAU,KAAK,SAAS;AAG7D,MAAI,KAAK,YACP,MAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,MAAM,KAAK,aAAa,CAAC,CAC9D,eAAc,IAAI,KAAK,MAAM;AAIjC,OAAK,MAAM,CAAC,KAAK,UAAU,IAAI,QAAQ,QAAQ,CAC7C,eAAc,IAAI,KAAK,MAAM;AAG/B,SAAO;;;AAQX,IAAa,kBAAb,MAA6B;CAC3B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,SAKuB;AAChC,SAAO,KAAK,QAA8B,kBAAkB;GAC1D,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ;GAC7B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,KACJ,UAA+B,EAAE,EACD;EAChC,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,eAAgB,cAAa,IAAI,kBAAkB,OAAO;EACtE,MAAM,QAAQ,aAAa,UAAU;AAKrC,SAAO,EACL,SAAQ,MALa,KAAK,QAC1B,iBAAiB,QAAQ,IAAI,UAAU,MACvC,EAAE,QAAQ,OAAO,CAClB,EAEkB,OAAO,KAAK,WAAW;GACtC,IAAI,MAAM;GACV,YAAY,MAAM;GAClB,cAAc,MAAM;GACpB,mBAAmB,MAAM;GACzB,YAAY,MAAM;GAClB,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,eAAe,MAAM;GACrB,WAAW,MAAM;GAClB,EAAE,EACJ;;CAGH,MAAM,OAAO,SAAkD;EAC7D,MAAM,WAAW,MAAM,KAAK,QAC1B,kBAAkB,mBAAmB,QAAQ,IAC7C,EAAE,QAAQ,UAAU,CACrB;AACD,SAAO;GACL,SAAS,SAAS;GAClB,QAAQ,SAAS;GAClB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,cAAsD;AAC/D,SAAO,KAAK,QACV,iCAAiC,mBAAmB,aAAa,IACjE,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,IAAI,OAA2D;AACnE,SAAO,KAAK,QAA2B,oBAAoB;GACzD,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;CAIJ,MAAM,OACJ,OACkC;AAClC,SAAO,KAAK,QAAiC,oBAAoB;GAC/D,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;;;;CAMJ,MAAM,YAAY,cAAuD;AACvE,SAAO,KAAK,QACV,iCACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;GACtC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;CAKH,MAAM,aAAa,cAAwD;AACzE,SAAO,KAAK,QACV,kCACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,cAAc,CAAC;GACtC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;AAoBL,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OACJ,OACA,UAAgC,EAAE,EACD;AACjC,SAAO,KAAK,QAAgC,wBAAwB;GAClE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,UAAU,QAAQ;IAClB,OAAO,QAAQ;IAChB,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,UAA2C;AAC/C,SAAO,KAAK,QAAgC,yBAAyB,EACnE,QAAQ,OACT,CAAC;;CAGJ,MAAM,SAAS,MAAiD;AAC9D,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OACJ,MACA,OACA,UAAgC,EAAE,EACC;EACnC,MAAM,WAAW,KAAK,cAAc,MAAM,OAAO,QAAQ,aAAa;AACtE,MAAI;AACF,UAAO,MAAM,KAAK,QAChB,gBACA,SACD;WACM,OAAO;AACd,OAAI,EAAE,iBAAiB,gBAAgB,CAAC,wBAAwB,MAAM,CACpE,OAAM;AAER,OAAI,QAAQ,SAAS;IACnB,MAAM,aAAa,cAAc,MAAM;AACvC,QAAI,CAAC,WAAY,OAAM;IACvB,MAAM,WAAW,MAAM,KAAK,QAC1B,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;AACD,8BAA0B,UAAU,MAAM,QAAQ,aAAa;AAC/D,QAAI,CAAC,SAAS,iBAAiB,MAC7B,OAAM,IAAI,YAAY;KACpB,MAAM;KACN,SAAS;KACT,SAAS,EAAE,YAAY;KACxB,CAAC;AAEJ,WAAO,KAAK,QAAkC,gBAAgB;KAC5D,GAAG;KACH,SAAS;MACP,gBAAgB;MAChB,eAAe,UAAU,SAAS,gBAAgB;MACnD;KACF,CAAC;;;EAIN,MAAM,SAAS,MAAM,KAAK,QAA8B,kBAAkB;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,cAAc,QAAQ;IACtB,UAAU,QAAQ,eAAe,KAAA,IAAY,KAAK,MAAM,IAAI,CAAC;IAC9D,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;AAEF,SAAO,KAAK,QAAkC,gBAAgB;GAC5D,GAAG;GACH,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,OAAO;IACjC;GACF,CAAC;;CAGJ,cACE,MACA,OACA,cACa;AACb,SAAO;GACL,QAAQ;GACR,MAAM,KAAK,UAAU;IAAE;IAAM;IAAO;IAAc,CAAC;GACnD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD;;;AAIL,SAAS,wBAAwB,OAA6B;AAC5D,QAAO,MAAM,SAAS;;AAGxB,SAAS,cAAc,OAAwC;CAC7D,MAAM,KAAM,MAAM,SACd,UAAU;AACd,QAAO,OAAO,OAAO,WAAW,KAAK,KAAA;;AAGvC,SAAS,0BACP,UACA,MACA,cACM;AACN,KAAI,SAAS,SAAS,eAAe,KACnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,oBAAoB;GACpB,oBAAoB,SAAS,SAAS;GACvC;EACF,CAAC;AAEJ,KACE,iBAAiB,KAAA,KACjB,SAAS,SAAS,iBAAiB,aAEnC,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,SAAS;GACP,YAAY,SAAS,SAAS;GAC9B,sBAAsB;GACtB,sBAAsB,SAAS,SAAS;GACzC;EACF,CAAC;;AASN,IAAa,oBAAb,MAA+B;CAC7B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAqC;AACzC,SAAO,KAAK,QAA6B,oBAAoB,EAC3D,QAAQ,OACT,CAAC;;CAGJ,MAAM,YACJ,QAAsC,EAAE,EACL;AACnC,SAAO,KAAK,QAAkC,0BAA0B;GACtE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OAAO,WAAsD;AACjE,SAAO,KAAK,QACV,oBAAoB,mBAAmB,UAAU,IACjD,EAAE,QAAQ,UAAU,CACrB;;;AAIL,IAAa,8BAAb,MAAyC;CACvC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAA+C;AACnD,SAAO,KAAK,QACV,+BACA,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,OACJ,OAC6C;AAC7C,SAAO,KAAK,QACV,+BACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OACJ,gBAC6C;AAC7C,SAAO,KAAK,QACV,+BAA+B,mBAAmB,eAAe,IACjE,EAAE,QAAQ,UAAU,CACrB;;;AAIL,IAAa,uBAAb,MAAkC;CAChC,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAwC;AAC5C,SAAO,KAAK,QAAgC,uBAAuB,EACjE,QAAQ,OACT,CAAC;;;;;CAMJ,MAAM,YAA2C;AAC/C,SAAO,KAAK,QAA8B,qBAAqB,EAC7D,QAAQ,OACT,CAAC;;CAGJ,MAAM,MACJ,UACA,UAAqC,EAAE,EACP;AAChC,SAAO,KAAK,QACV,uBAAuB,mBAAmB,SAAS,CAAC,SACpD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB,WAAW,QAAQ;IACnB,KAAK,QAAQ;IACd,CAAC;GACF,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,4BACJ,UAAiD,EAAE,EACF;AACjD,SAAO,KAAK,QACV,+DACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,WAAW,QAAQ,WAAW,CAAC;GACtD,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,+BACJ,OACoD;AACpD,SAAO,KAAK,QACV,kEACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;;;CAOH,MAAM,cACJ,UACA,QACmC;AACnC,SAAO,KAAK,QACV,uBAAuB,mBAAmB,SAAS,CAAC,eACpD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GAChC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,IACvD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,OAAO,cAA4D;AACvE,SAAO,KAAK,QACV,uBAAuB,mBAAmB,aAAa,CAAC,UACxD,EAAE,QAAQ,QAAQ,CACnB;;;AAIL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,OAAyC;AAC7C,SAAO,KAAK,QAAiC,qBAAqB,EAChE,QAAQ,OACT,CAAC;;CAGJ,MAAM,QAAQ,YAA0D;AACtE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,WACpD,EAAE,QAAQ,QAAQ,CACnB;;CAGH,MAAM,KAAK,YAA0D;AACnE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,WAAW,CAAC,QACpD,EAAE,QAAQ,QAAQ,CACnB;;;AASL,IAAa,qBAAb,MAAgC;CAC9B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,sBACJ,OACoD;AACpD,SAAO,KAAK,QACV,8CACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC3B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,gBACJ,gBAC2C;AAC3C,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,IAC9E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,UACJ,gBACwC;AACxC,SAAO,KAAK,QACV,oCAAoC,mBAAmB,OAAO,eAAe,CAAC,CAAC,SAC/E,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,gBAAgB,OAG2B;EAC/C,MAAM,SAAS,IAAI,gBAAgB;GACjC,OAAO,MAAM;GACb,MAAM,MAAM;GACb,CAAC;AACF,SAAO,KAAK,QACV,wCAAwC,OAAO,UAAU,IACzD,EAAE,QAAQ,OAAO,CAClB;;;AAIL,IAAa,iBAAb,MAA4B;CAC1B,YACE,SAIA;AAJiB,OAAA,UAAA;;CAMnB,MAAM,KAAK,UAA+B,EAAE,EAA6B;EACvE,MAAM,eAAe,IAAI,iBAAiB;AAC1C,MAAI,QAAQ,aAAa,KAAA,EACvB,cAAa,IAAI,YAAY,QAAQ,SAAS;AAChD,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,UAAU,KAAA,EAAW,cAAa,IAAI,SAAS,QAAQ,MAAM;AACzE,MAAI,QAAQ,WAAW,KAAA,EACrB,cAAa,IAAI,UAAU,QAAQ,OAAO;AAC5C,MAAI,QAAQ,UAAU,KAAA,EACpB,cAAa,IAAI,SAAS,OAAO,QAAQ,MAAM,CAAC;EAClD,MAAM,QAAQ,aAAa,UAAU;AACrC,SAAO,KAAK,QACV,gBAAgB,QAAQ,IAAI,UAAU,MACtC,EAAE,QAAQ,OAAO,CAClB;;;AASL,IAAa,qBAAb,MAAgC;CAK9B,YACE,SAIA,QAIA;AARiB,OAAA,UAAA;AAIA,OAAA,SAAA;;CAMnB,MAAM,OAA+B;AACnC,SAAO,KAAK,QAAuB,iBAAiB,EAAE,QAAQ,OAAO,CAAC;;CAGxE,MAAM,IAAI,IAAkC;AAC1C,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC,EAAE,QAAQ,OAAO,CAClB;;CAGH,MAAM,OAAO,MAAoC;AAC/C,SAAO,KAAK,QAAqB,iBAAiB;GAChD,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,OAAO,IAAY,MAAoC;AAC3D,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;CAGH,MAAM,OAAO,IAA2B;AACtC,QAAM,KAAK,QAAmB,iBAAiB,mBAAmB,GAAG,IAAI,EACvE,QAAQ,UACT,CAAC;;;;;;;CAQJ,MAAM,WAAW,IAAY,SAAwC;AACnE,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,IACvC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;GACjC,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;;;;;;CAOH,MAAM,SACJ,IACA,OAA4C,EAAE,EAChB;EAC9B,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,KAAK,UAAU,KAAA,EAAW,QAAO,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;AACrE,MAAI,KAAK,WAAW,KAAA,EAAW,QAAO,IAAI,UAAU,KAAK,OAAO;EAChE,MAAM,QAAQ,OAAO,UAAU;AAC/B,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,OAAO,QAAQ,IAAI,UAAU,MACrE,EAAE,QAAQ,OAAO,CAClB;;;;;;;;;;;;;;CAeH,MAAM,IACJ,IACA,QACA,OAAiC,EAAE,EACF;EACjC,MAAM,YAAY,WAAW,KAAA,KAAa,OAAO,KAAK,OAAO,CAAC,SAAS;AACvE,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,OACxC;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,YAAY,EAAE,QAAQ,GAAG,EAAE,CAAC;GACjD,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAC/C,CACF;;;;;;;;CASH,MAAM,OACJ,IACA,OACA,OAAiC,EAAE,EACJ;AAC/B,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,IACzE;GAAE,QAAQ;GAAO,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAAG,CACnE;;;;;;;;;;;CAYH,MAAM,OACJ,IACA,OACA,OAAiC,EAAE,EACE;AACrC,SAAO,KAAK,QACV,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,CAAC,UAC1E;GAAE,QAAQ;GAAQ,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAAG,CACpE;;;;;;;;;;;;;;;;CAiBH,OAAO,SACL,IACA,OACA,OAAiC,EAAE,EACQ;EAC3C,MAAM,aAAa,KAAK;AACxB,MAAI,CAAC,WACH,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SACE;GACH,CAAC;EAaJ,MAAM,UAAS,MAXI,WACjB,iBAAiB,mBAAmB,GAAG,CAAC,QAAQ,mBAAmB,MAAM,CAAC,UAC1E;GACE,QAAQ;GACR,SAAS,EAAE,QAAQ,qBAAqB;GACxC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;GAC/C,CACF,EAImB,WAAW;EAC/B,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,SAAS,IAAI,eAAwB,EACzC,YAAY,QAAQ;AAClB,OAAI;AACF,WAAO,KAAK,MAAM,IAAI;WAChB;AACN,WAAO;;KAGZ,CAAC;AACF,MAAI;AACF,YAAS;IACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;IAC3C,MAAM,OAAO,OACT,QAAQ,QAAQ,GAChB,QAAQ,OAAO,OAAO,EAAE,QAAQ,MAAM,CAAC;IAC3C,MAAM,eAAe,OACjB,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,GAAG,OAAO,OAAO,CAAC,GACzC,OAAO,KAAK,KAAK;AACrB,SAAK,MAAM,UAAU,cAAc;KACjC,MAAM,QAAQ,iBAAiB,OAAO,WAAW,OAAO,KAAK;AAC7D,SAAI,CAAC,MAAO;AACZ,WAAM;AAEN,SAAI,MAAM,SAAS,cAAc,MAAM,SAAS,cAAe;;AAEjE,QAAI,KAAM;;YAEJ;AAOR,SAAM,OAAO,QAAQ,CAAC,YAAY,GAAG;;;;;;;;;;;;;;;;;;CAmBzC,MAAM,WACJ,IACA,OACA,OAII,EAAE,EACyB;EAC/B,MAAM,iBAAiB,KAAK,kBAAkB;AAG9C,MAAI,CAAC,OAAO,SAAS,eAAe,IAAI,kBAAkB,EACxD,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,4DAA4D,KAAK,eAAe;GAC1F,CAAC;AAEJ,MACE,KAAK,cAAc,KAAA,MAClB,CAAC,OAAO,SAAS,KAAK,UAAU,IAAI,KAAK,aAAa,GAEvD,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS,uDAAuD,KAAK,UAAU;GAChF,CAAC;EAEJ,MAAM,WACJ,KAAK,cAAc,KAAA,IAAY,KAAK,KAAK,GAAG,KAAK,YAAY;EAC/D,MAAM,gBAAgB,WACpB,IAAI,YAAY;GACd,MAAM;GACN,SAAS,gBAAgB,MAAM,yCAAyC,KAAK,UAAU,IAAI,SAAS,kBAAkB,OAAO,KAAK;GAClI,SAAS;IAAE;IAAO;IAAQ,WAAW,KAAK;IAAW;GACtD,CAAC;EACJ,IAAI;AACJ,WAAS;AACP,OAAI,KAAK,QAAQ,QACf,OAAM,KAAK,OAAO,0BAAU,IAAI,MAAM,4BAA4B;GAEpE,MAAM,cAAc,aAAa,OAAO,WAAW,KAAK,KAAK,GAAG;AAChE,OAAI,gBAAgB,QAAQ,eAAe,EACzC,OAAM,aAAa,WAAW;GAIhC,MAAM,aAAa,oBAAoB,KAAK,QAAQ,YAAY;GAChE,IAAI;AACJ,OAAI;AACF,UAAM,MAAM,KAAK,OACf,IACA,OACA,aAAa,EAAE,QAAQ,YAAY,GAAG,EAAE,CACzC;YACM,KAAK;AAGZ,QAAI,KAAK,QAAQ,QAAS,OAAM;AAChC,QAAI,aAAa,QAAQ,aAAa,IAAI,CACxC,OAAM,aAAa,WAAW;AAChC,UAAM;;AAER,gBAAa,IAAI;AAIjB,OAAI,IAAI,WAAW,YAAY,IAAI,WAAW,UAAW,QAAO;GAIhE,MAAM,mBAAmB,aAAa,OAAO,WAAW,KAAK,KAAK,GAAG;AACrE,OAAI,qBAAqB,QAAQ,oBAAoB,EACnD,OAAM,aAAa,WAAW;AAEhC,SAAM,MACJ,qBAAqB,OACjB,KAAK,IAAI,gBAAgB,iBAAiB,GAC1C,gBACJ,KAAK,OACN;;;CAIL,MAAM,SAAS,MAAoD;AACjE,SAAO,KAAK,QAAqC,0BAA0B;GACzE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;GAC9B,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CAAC;;CAGJ,MAAM,SAA6C;AACjD,SAAO,KAAK,QAAmC,wBAAwB,EACrE,QAAQ,OACT,CAAC;;;;;ACjiDN,MAAM,4BAA4B;AAClC,MAAM,wBAAwB;AAC9B,MAAM,8BAA8B;AACpC,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,4BAA4B;AAClC,MAAM,mCAAmC;AACzC,MAAM,kCAAkC;AACxC,MAAM,0BAA0B,KAAK,OAAO;AA0D5C,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CASA,YAAY,MAAqC,SAAiB;AAChE,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;;;AAShB,eAAsB,6BACpB,OACiB;CACjB,MAAM,UAAU,IAAI,aAAa;AACjC,KAAI,QAAQ,OAAO,MAAM,WAAW,CAAC,aAAa,0BAChD,OAAM,IAAI,sBACR,2BACA,+CAA+C,0BAA0B,cAC1E;AAEH,MAAK,MAAM,CAAC,MAAM,UAAU;EAC1B,CAAC,aAAa,MAAM,UAAU;EAC9B,CAAC,WAAW,MAAM,QAAQ;EAC1B,CAAC,aAAa,MAAM,UAAU;EAC/B,EAAW;EACV,MAAM,QAAQ,QAAQ,OAAO,MAAM,CAAC;AACpC,MAAI,UAAU,KAAK,QAAQ,iCACzB,OAAM,IAAI,sBACR,wBACA,GAAG,KAAK,kBAAkB,iCAAiC,cAC5D;;CAGL,MAAM,SAAS,qBAAqB;CACpC,MAAM,MAAM,MAAM,OAAO,UACvB,OACA,QAAQ,OAAO,MAAM,WAAW,EAChC;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACT;CACD,MAAM,QAAQ,KAAK,UAAU;EAC3B;EACA;EACA,MAAM;EACN,MAAM;EACN,MAAM;EACP,CAAC;AAIF,QAAO,iBAAiB,IAHF,WACpB,MAAM,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,MAAM,CAAC,CAEtB,CAAC;;;;;;;;;AAUpC,eAAsB,4BACpB,OACgC;AAChC,KAAI,MAAM,QAAQ,WAAW,OAC3B,QAAO,eAAe,sBAAsB,KAAK,sBAAsB,EACrE,OAAO,QACR,CAAC;AAEJ,KAAI,MAAM,QAAQ,QAAQ,IAAI,iBAAiB,KAAK,YAClD,QAAO,eAAe,oBAAoB,KAAK,oBAAoB;CAErE,MAAM,cAAc,MAAM,QAAQ,QAAQ,IAAI,eAAe,IAAI;AACjE,KAAI,CAAC,gCAAgC,KAAK,YAAY,CACpD,QAAO,eACL,0BACA,KACA,yBACD;CAEH,MAAM,eAAe,MAAM,gBAAgB;AAC3C,KACE,CAAC,OAAO,cAAc,aAAa,IACnC,eAAe,KACf,eAAe,wBAEf,OAAM,IAAI,sBACR,sBACA,qDAAqD,wBAAwB,QAC9E;AAEH,KACE,IAAI,aAAa,CAAC,OAAO,MAAM,OAAO,CAAC,aACvC,0BAEA,OAAM,IAAI,sBACR,2BACA,mDAAmD,0BAA0B,cAC9E;CAEH,MAAM,iBAAiB,MAAM,QAAQ,QAAQ,IAAI,iBAAiB;AAClE,KACE,mBAAmB,QACnB,QAAQ,KAAK,eAAe,IAC5B,OAAO,eAAe,GAAG,aAEzB,QAAO,eAAe,qBAAqB,KAAK,oBAAoB;CAEtE,MAAM,OAAO,MAAM,gBAAgB,MAAM,SAAS,aAAa;AAC/D,KAAI,SAAS,KACX,QAAO,eAAe,qBAAqB,KAAK,oBAAoB;AAWtE,KAAI,EAAC,MATmB,wBAAwB;EAC9C;EACA,WAAW,MAAM,QAAQ,QAAQ,IAAI,qBAAqB;EAC1D,QAAQ,MAAM;EACd,GAAI,MAAM,qBAAqB,KAAA,IAC3B,EAAE,kBAAkB,MAAM,kBAAkB,GAC5C,EAAE;EACN,GAAI,MAAM,QAAQ,KAAA,IAAY,EAAE,KAAK,MAAM,KAAK,GAAG,EAAE;EACtD,CAAC,EACa,MACb,QAAO,eAAe,qBAAqB,KAAK,oBAAoB;CAEtE,IAAI;AACJ,KAAI;AACF,aAAW,sBAAsB,KAAK;UAC/B,OAAO;AACd,MAAI,iBAAiB,sBACnB,QAAO,eAAe,oBAAoB,KAAK,mBAAmB;AAEpE,QAAM;;AAER,KAAI,MAAM,QAAQ,QAAQ,IAAI,uBAAuB,KAAK,SAAS,MACjE,QAAO,eAAe,wBAAwB,KAAK,mBAAmB;AAExE,QAAO;EAAE,IAAI;EAAM;EAAU;;;;;;;AAQ/B,eAAsB,wBACpB,OACkC;AAClC,KAAI,CAAC,MAAM,UAAW,QAAO;EAAE,OAAO;EAAO,QAAQ;EAAW;AAChE,KAAI,MAAM,UAAU,SAAS,4BAC3B,QAAO;EAAE,OAAO;EAAO,QAAQ;EAAa;CAE9C,MAAM,SAAS,qBAAqB,MAAM,UAAU;AACpD,KAAI,CAAC,OAAQ,QAAO;EAAE,OAAO;EAAO,QAAQ;EAAa;CAEzD,MAAM,YAAY,MAAM,oBAAoB;AAC5C,KACE,CAAC,OAAO,SAAS,UAAU,IAC3B,CAAC,OAAO,UAAU,UAAU,IAC5B,YAAY,KACZ,YAAY,sBAEZ,OAAM,IAAI,sBACR,qBACA,oDAAoD,sBAAsB,UAC3E;CAEH,MAAM,QACJ,MAAM,eAAe,OACjB,MAAM,IAAI,SAAS,GACnB,OAAO,MAAM,QAAQ,WACnB,MAAM,MACN,KAAK,KAAK;AAClB,KACE,CAAC,OAAO,SAAS,MAAM,IACvB,KAAK,IAAI,KAAK,MAAM,QAAQ,IAAM,GAAG,OAAO,UAAU,GAAG,UAEzD,QAAO;EAAE,OAAO;EAAO,QAAQ;EAAS;CAG1C,MAAM,SAAS,qBAAqB;CACpC,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,UACvB,OACA,QAAQ,OAAO,MAAM,OAAO,EAC5B;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,OAAO,CACT;CACD,MAAM,WAAW,IAAI,WACnB,MAAM,OAAO,KACX,QACA,KACA,QAAQ,OAAO,GAAG,OAAO,UAAU,GAAG,MAAM,OAAO,CACpD,CACF;CACD,IAAI,UAAU;AACd,MAAK,MAAM,aAAa,OAAO,WAC7B,YAAW,kBAAkB,UAAU,UAAU;AAEnD,QAAO,YAAY,IACf;EAAE,OAAO;EAAM,WAAW,OAAO;EAAW,GAC5C;EAAE,OAAO;EAAO,QAAQ;EAAY;;AAG1C,SAAgB,sBACd,OACkB;CAClB,IAAI,QAAiB;AACrB,KAAI,OAAO,UAAU,SACnB,KAAI;AACF,UAAQ,KAAK,MAAM,MAAM;SACnB;AACN,QAAM,IAAI,sBACR,gBACA,4CACD;;AAGL,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO,iBAAiB;CAC9C,MAAM,SAAS,MAAM;CACrB,MAAM,gBAAgB,MAAM;AAC5B,KACE,CAAC,eAAe,MAAM,eAAe,IACrC,CAAC,eAAe,MAAM,WAAW,IACjC,CAAC,eAAe,MAAM,MAAM,IAC5B,CAAC,SAAS,OAAO,IAChB,OAAO,SAAS,aAAa,OAAO,SAAS,gBAC9C,CAAC,eAAe,OAAO,GAAG,IAC1B,CAAC,eAAe,OAAO,SAAS,IAChC,CAAC,eAAe,OAAO,MAAM,IAC7B,CAAC,SAAS,cAAc,IACxB,CAAC,eAAe,cAAc,SAAS,IACvC,CAAC,eAAe,cAAc,aAAa,IAC3C,CAAC,eAAe,cAAc,KAAK,IACnC,cAAc,aAAa,OAAO,YAClC,cAAc,SAAS,OAAO,SAC9B,CAAC,OAAO,OAAO,eAAe,UAAU,IACxC,CAAC,eAAe,cAAc,OAAO,IACrC,CAAC,eAAe,cAAc,KAAK,IACnC,CAAC,eAAe,cAAc,WAAW,IACzC,CAAC,eAAe,MAAM,QAAQ,IAC9B,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,QAAQ,CAAC,CAE3C,QAAO,iBAAiB;AAE1B,QAAO;EACL,gBAAgB,MAAM;EACtB,YAAY,MAAM;EAClB,OAAO,MAAM;EACb,QAAQ;GACN,MAAM,OAAO;GACb,IAAI,OAAO;GACX,UAAU,OAAO;GACjB,OAAO,OAAO;GACf;EACD,eAAe;GACb,UAAU,cAAc;GACxB,cAAc,cAAc;GAC5B,MAAM,cAAc;GACpB,GAAI,OAAO,cAAc,WAAW,WAChC,EAAE,QAAQ,cAAc,QAAQ,GAChC,EAAE;GACN,GAAI,OAAO,cAAc,SAAS,WAC9B,EAAE,MAAM,cAAc,MAAM,GAC5B,EAAE;GACN,GAAI,OAAO,cAAc,eAAe,WACpC,EAAE,YAAY,cAAc,YAAY,GACxC,EAAE;GACN,SAAS,cAAc;GACxB;EACD,SAAS,MAAM;EAChB;;AAGH,SAAS,qBACP,QACwD;CACxD,IAAI;CACJ,MAAM,aAA2B,EAAE;AACnC,MAAK,MAAM,WAAW,OAAO,MAAM,IAAI,EAAE;EACvC,MAAM,YAAY,QAAQ,QAAQ,IAAI;AACtC,MAAI,aAAa,EAAG,QAAO;EAC3B,MAAM,MAAM,QAAQ,MAAM,GAAG,UAAU,CAAC,MAAM;EAC9C,MAAM,QAAQ,QAAQ,MAAM,YAAY,EAAE,CAAC,MAAM;AACjD,MAAI,QAAQ,KAAK;AACf,OAAI,cAAc,KAAA,KAAa,CAAC,QAAQ,KAAK,MAAM,CAAE,QAAO;GAC5D,MAAM,YAAY,OAAO,MAAM;AAC/B,OAAI,CAAC,OAAO,cAAc,UAAU,IAAI,aAAa,EAAG,QAAO;AAC/D,eAAY;aACH,QAAQ,MAAM;AACvB,OACE,WAAW,UAAU,kBACrB,MAAM,WAAW,qBACjB,CAAC,eAAe,KAAK,MAAM,CAE3B,QAAO;AAET,cAAW,KAAK,WAAW,MAAM,CAAC;;;AAGtC,QAAO,cAAc,KAAA,KAAa,WAAW,SAAS,IAClD;EAAE;EAAW;EAAY,GACzB;;AAGN,SAAS,WAAW,KAAyB;CAC3C,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,EAAE;AAC5C,MAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,EACjD,OAAM,SAAS,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,EAAE,GAAG;AAEzE,QAAO;;AAGT,SAAS,kBAAkB,UAAsB,QAA4B;CAC3E,IAAI,aAAa,SAAS,SAAS,OAAO;CAC1C,MAAM,SAAS,KAAK,IAAI,SAAS,QAAQ,OAAO,OAAO;AACvD,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,SAAS,EAC3C,gBACG,SAAS,QAAQ,SAAS,WAAW,MACrC,OAAO,QAAQ,OAAO,WAAW;AAEtC,QAAO,eAAe,IAAI,IAAI;;AAGhC,SAAS,eAAe,OAAiC;AACvD,QAAO,OAAO,UAAU,YAAY,MAAM,SAAS;;AAGrD,SAAS,eAAe,OAAyB;AAC/C,QAAO,UAAU,KAAA,KAAa,eAAe,MAAM;;AAGrD,SAAS,SAAS,OAAkD;AAClE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG7E,SAAS,kBAAyB;AAChC,OAAM,IAAI,sBACR,mBACA,+DACD;;AAGH,SAAS,sBAAoC;CAC3C,MAAM,SAAS,WAAW,QAAQ;AAClC,KAAI,CAAC,OACH,OAAM,IAAI,sBACR,sBACA,+DACD;AAEH,QAAO;;AAGT,SAAS,iBAAiB,OAA2B;CACnD,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MAAO,WAAU,OAAO,aAAa,KAAK;AAC7D,QAAO,KAAK,OAAO,CAChB,QAAQ,OAAO,IAAI,CACnB,QAAQ,OAAO,IAAI,CACnB,QAAQ,QAAQ,GAAG;;AAGxB,eAAe,gBACb,SACA,UACwB;CACxB,MAAM,SAAS,QAAQ,MAAM,WAAW;AACxC,KAAI,CAAC,OAAQ,QAAO;CACpB,MAAM,SAAuB,EAAE;CAC/B,IAAI,QAAQ;AACZ,KAAI;AACF,SAAO,MAAM;GACX,MAAM,OAAO,MAAM,OAAO,MAAM;AAChC,OAAI,KAAK,KAAM;AACf,YAAS,KAAK,MAAM;AACpB,OAAI,QAAQ,SAAU,QAAO;AAC7B,UAAO,KAAK,KAAK,MAAM;;WAEjB;AACR,QAAM,OAAO,QAAQ,CAAC,YAAY,GAAG;;CAEvC,MAAM,OAAO,IAAI,WAAW,MAAM;CAClC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC1B,OAAK,IAAI,OAAO,OAAO;AACvB,YAAU,MAAM;;AAElB,QAAO,IAAI,aAAa,CAAC,OAAO,KAAK;;AAGvC,SAAS,eACP,MACA,QACA,OACA,SAC+C;AAC/C,QAAO;EACL,IAAI;EACJ;EACA,UAAU,SAAS,KACjB,EAAE,OAAO,EACT;GACE;GACA,SAAS;IACP,iBAAiB;IACjB,GAAI,UAAU,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC,GAAG,EAAE;IAC5D;GACF,CACF;EACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/hub-sdk",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Typed SDK for Tangle Hub tool discovery and execution",
   "type": "module",
   "main": "dist/index.js",
@@ -11,11 +11,15 @@
       "types": "./dist/index.d.ts"
     }
   },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
   "files": [
     "dist"
   ],
   "dependencies": {
-    "@tangle-network/sdk-telemetry": "0.1.8"
+    "@tangle-network/sdk-telemetry": "0.1.9"
   },
   "devDependencies": {
     "@types/node": "25.6.0",
@@ -23,7 +27,7 @@
     "tsdown": "0.21.10",
     "typescript": "^6.0.3",
     "vitest": "^4.1.5",
-    "@tangle-network/sandbox": "0.12.0"
+    "@tangle-network/sandbox": "0.15.2"
   },
   "scripts": {
     "build": "tsdown",