npm - @tangle-network/hub-sdk - Versions diffs - 0.32.0-develop.20260826055638.8c2f7a4 → 0.32.0 - Mend

@tangle-network/hub-sdk 0.32.0-develop.20260826055638.8c2f7a4 → 0.32.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/index.js CHANGED Viewed

@@ -1,7 +1,317 @@
-import { SSEChunkParser } from "@tangle-network/sdk-telemetry";
+import { SSEChunkParser } from "@tangle-network/agent-core/sse";
+//#region src/json-init.ts
+/** The init of a request whose body is JSON. Every client builds its bodies
+* here, so the content type cannot drift from the encoding. */
+function jsonInit(method, body) {
+	return {
+		method,
+		body: JSON.stringify(body),
+		headers: { "Content-Type": "application/json" }
+	};
+}
+//#endregion
+//#region src/allowances.ts
+var HubAllowancesClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async plan(meter) {
+		return (await this.request(this.path(meter), { method: "GET" })).plan;
+	}
+	async setPlan(meter, plan) {
+		return (await this.request(this.path(meter), this.body("PUT", plan))).plan;
+	}
+	/** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+	async admit(meter, input) {
+		return (await this.request(`${this.path(meter)}/turns`, this.body("POST", input))).allowance;
+	}
+	/** What the member's next turn would get, without counting anything. */
+	async status(meter, subject) {
+		const query = new URLSearchParams();
+		if (subject.role) query.set("role", subject.role);
+		if (subject.payer) query.set("payer", subject.payer);
+		if (subject.payerRole) query.set("payerRole", subject.payerRole);
+		const suffix = query.size ? `?${query}` : "";
+		return (await this.request(`${this.memberPath(meter, subject.member)}${suffix}`, { method: "GET" })).allowance;
+	}
+	/** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+	async grant(meter, member, input) {
+		return (await this.request(`${this.memberPath(meter, member)}/grant`, this.body("PUT", {
+			tier: "paid",
+			...input
+		}))).grant;
+	}
+	/** Synchronize a paid grant by durable product revision. Null expiry writes
+	* a retained revocation. A delayed older update is refused, never reactivated.
+	* There is no fallback to the unversioned grant endpoint on older servers. */
+	async syncGrant(meter, member, input) {
+		const { grant } = await this.request(`${this.memberPath(meter, member)}/grant/sync`, this.body("PUT", input));
+		if (grant.member !== member || grant.source !== input.source || grant.revision !== input.revision || grant.reference !== input.reference || grant.expiresAt !== (input.expiresAt === null ? null : new Date(input.expiresAt).toISOString())) throw new Error("The Hub returned a mismatched grant synchronization receipt");
+		return grant;
+	}
+	async revoke(meter, member) {
+		await this.request(`${this.memberPath(meter, member)}/grant`, { method: "DELETE" });
+	}
+	/** Turns per member and per line on one UTC day (default today). */
+	async usage(meter, day) {
+		const suffix = day ? `?day=${encodeURIComponent(day)}` : "";
+		return (await this.request(`${this.path(meter)}/usage${suffix}`, { method: "GET" })).usage;
+	}
+	path(meter) {
+		return `/v1/hub/allowances/${encodeURIComponent(meter)}`;
+	}
+	memberPath(meter, member) {
+		return `${this.path(meter)}/members/${encodeURIComponent(member)}`;
+	}
+	body(method, body) {
+		return jsonInit(method, body);
+	}
+};
+//#endregion
+//#region src/apps.ts
+function encodedId(id) {
+	if (typeof id !== "string" || !id || id.length > 256 || id === "." || id === "..") throw new Error("A bounded app or grant id is required");
+	return encodeURIComponent(id);
+}
+var HubAppsClient = class {
+	grants;
+	constructor(request) {
+		this.request = request;
+		this.grants = {
+			list: () => this.request("/v1/me/app-grants", { method: "GET" }),
+			revoke: async (grantId) => this.request(`/v1/me/app-grants/${encodedId(grantId)}/revoke`, { method: "POST" })
+		};
+	}
+	list() {
+		return this.request("/v1/apps", { method: "GET" });
+	}
+	/** The secret is returned only by creation; keep it in your server vault. */
+	create(input) {
+		return this.request("/v1/apps", jsonInit("POST", input));
+	}
+	/** Immutable association of two existing records with the same owner. */
+	async linkOAuthClient(appId, clientId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/oidc-client`, jsonInit("POST", { clientId }));
+	}
+	async revoke(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/revoke`, { method: "POST" });
+	}
+	/** Current latched compliance state and the BAA acceptance behind it. */
+	async getCompliance(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, { method: "GET" });
+	}
+	/**
+	* Latch HIPAA compliance for this app. The request MUST carry the exact
+	* `agreementVersion` the deployment currently offers — the acceptance is
+	* recorded before the claim exists, and the claim can never be cleared:
+	* `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+	*/
+	async setCompliance(appId, input) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, jsonInit("PUT", input));
+	}
+};
+//#endregion
+//#region src/knowledge-management.ts
+var HubKnowledgeManagementClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	materialize(input) {
+		return this.request("/v1/knowledge/attachments/materialize", jsonInit("POST", input));
+	}
+	authorization() {
+		return this.request("/v1/knowledge/authorization", { method: "GET" });
+	}
+	disconnectAuthorization() {
+		return this.request("/v1/knowledge/authorization", { method: "DELETE" });
+	}
+	capabilities() {
+		return this.request("/v1/knowledge/capabilities", { method: "GET" });
+	}
+	list() {
+		return this.request("/v1/knowledge/sources", { method: "GET" });
+	}
+	get(sourceId) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}`, { method: "GET" });
+	}
+	create(input) {
+		return this.request("/v1/knowledge/sources", jsonInit("POST", input));
+	}
+	refresh(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/refresh`, jsonInit("POST", input));
+	}
+	attach(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/attachments`, jsonInit("POST", input));
+	}
+	attachments(sandboxId) {
+		return this.request(`/v1/knowledge/attachments${sandboxId ? `?sandboxId=${encodeURIComponent(sandboxId)}` : ""}`, { method: "GET" });
+	}
+	detach(attachmentId) {
+		return this.request(`/v1/knowledge/attachments/${encodeURIComponent(attachmentId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/knowledge.ts
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+* scope on the server; neither a caller nor an agent can supply another scope. */
+var HubKnowledgeClient = class {
+	management;
+	constructor(request) {
+		this.request = request;
+		this.management = new HubKnowledgeManagementClient(request);
+	}
+	bindings() {
+		return this.request("/v1/knowledge/runtime/bindings", { method: "GET" });
+	}
+	query(input, options) {
+		return this.request("/v1/knowledge/runtime/query", {
+			...jsonInit("POST", {
+				query: input.query,
+				...input.expectedReferences !== void 0 ? { expectedReferences: input.expectedReferences } : {},
+				...input.limit !== void 0 ? { limit: input.limit } : {}
+			}),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/lines.ts
+/** The `on.schedule` mapping a Line schedule helper writes. */
+function scheduleYaml(cron, timezone, until) {
+	return `  schedule: { ${[
+		`cron: ${JSON.stringify(cron)}`,
+		`timezone: ${JSON.stringify(timezone)}`,
+		...until ? [`until: ${JSON.stringify(until)}`] : []
+	].join(", ")} }`;
+}
+/** Line calls share HubClient authentication and envelope handling. */
+var HubLinesClient = class {
+	members;
+	memberApplications;
+	checkins;
+	constructor(request, createWorkflow, requestApplicationDispatchCurrent) {
+		this.request = request;
+		this.createWorkflow = createWorkflow;
+		this.requestApplicationDispatchCurrent = requestApplicationDispatchCurrent;
+		this.members = { list: async (lineId) => (await this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/members`, { method: "GET" })).members };
+		const applicationPath = (lineId, memberId) => `/v1/hub/lines/${encodeURIComponent(lineId)}/members/${encodeURIComponent(memberId)}/application`;
+		this.memberApplications = {
+			get: async (lineId, memberId) => await this.request(applicationPath(lineId, memberId), { method: "GET" }),
+			select: async (lineId, memberId, input) => (await this.request(applicationPath(lineId, memberId), jsonInit("PUT", input))).selection,
+			clear: async (lineId, memberId, input) => {
+				await this.request(applicationPath(lineId, memberId), jsonInit("DELETE", input));
+			}
+		};
+		this.checkins = { schedule: (cron, options) => {
+			const name = options.name ?? `line-checkin-${crypto.randomUUID().slice(0, 8)}`;
+			const yaml = [
+				`name: ${JSON.stringify(name)}`,
+				"on:",
+				scheduleYaml(cron, options.timezone, options.until),
+				"do:",
+				"  - agent.run:",
+				"      line:",
+				`        id: ${JSON.stringify(options.lineId)}`,
+				`        member: ${JSON.stringify(options.member)}`,
+				`      prompt: ${JSON.stringify(options.prompt)}`
+			].join("\n");
+			return this.createWorkflow(yaml);
+		} };
+	}
+	async scheduleSend(cron, options) {
+		const name = options.name ?? `line-send-${crypto.randomUUID().slice(0, 8)}`;
+		const yaml = [
+			`name: ${JSON.stringify(name)}`,
+			"on:",
+			scheduleYaml(cron, options.timezone, options.until),
+			"do:",
+			"  - line.send:",
+			`      lineId: ${JSON.stringify(options.lineId)}`,
+			`      memberId: ${JSON.stringify(options.memberId)}`,
+			`      text: ${JSON.stringify(options.text)}`,
+			...options.notBefore ? [`      notBefore: ${JSON.stringify(options.notBefore)}`] : []
+		].join("\n");
+		return this.createWorkflow(yaml);
+	}
+	async context() {
+		return this.request("/v1/hub/lines/context", { method: "GET" });
+	}
+	async send(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/send`, jsonInit("POST", input));
+	}
+	/** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+	async sentMessage(lineId, messageId) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/outbox/${encodeURIComponent(messageId)}`, { method: "GET" });
+	}
+	async remind(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/remind`, jsonInit("POST", input));
+	}
+	async applicationDispatchCurrent(lineId, messageId, input, callbackBearer) {
+		if (!this.requestApplicationDispatchCurrent) throw new Error("Use HubClient to check application dispatch authority");
+		return (await this.requestApplicationDispatchCurrent(`/v1/hub/lines/${encodeURIComponent(lineId)}/messages/${encodeURIComponent(messageId)}/application-dispatch/current`, jsonInit("POST", input), callbackBearer)).current;
+	}
+};
+//#endregion
+//#region src/managed-numbers.ts
+/** Administrative number operations through Hub's authenticated transport.
+* A mutation is one attempt; an uncertain create reuses its quote and reference. */
+var HubManagedNumbersClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	readiness() {
+		return this.request("/v1/hub/numbers/readiness", { method: "GET" });
+	}
+	/** One page of orders. Scope by `clientReference` to ask about one binding,
+	* and follow `nextCursor` for the rest; a page is never ownership evidence. */
+	list(query = {}) {
+		const params = new URLSearchParams();
+		if (query.clientReference !== void 0) params.set("clientReference", query.clientReference);
+		if (query.cursor !== void 0) params.set("cursor", query.cursor);
+		if (query.limit !== void 0) params.set("limit", String(query.limit));
+		const search = params.toString();
+		return this.request(`/v1/hub/numbers${search ? `?${search}` : ""}`, { method: "GET" });
+	}
+	get(id) {
+		return this.request(this.path(id), { method: "GET" });
+	}
+	quote(input) {
+		return this.request("/v1/hub/numbers/quote", this.post(input));
+	}
+	/** `clientReference` and `transport`, when given, must match the signed
+	* quote or Hub refuses the purchase with a conflict. */
+	create(input) {
+		return this.request("/v1/hub/numbers", this.post(input));
+	}
+	/** Fences references so no order can take them again. Call it as the last
+	* step before retiring the resource they name: a purchase that races the
+	* retirement is then refused (`409 number_reference_fenced`) instead of
+	* binding a line to a resource that is gone. Refused with
+	* `409 number_reference_held` while a live order holds one of them; cancel
+	* it first. A cancelled order no longer holds its reference, so the fence
+	* succeeds as soon as `cancel` returns, whether or not its release is still
+	* pending. Repeating a fence is harmless. */
+	fence(input) {
+		return this.request("/v1/hub/numbers/fences", this.post(input));
+	}
+	advance(id) {
+		return this.request(`${this.path(id)}/advance`, this.post({}));
+	}
+	cancel(id) {
+		return this.request(`${this.path(id)}/cancel`, this.post({}));
+	}
+	path(id) {
+		if (!/^num_[a-f0-9]{36}$/.test(id)) throw new Error("Invalid managed number order id");
+		return `/v1/hub/numbers/${encodeURIComponent(id)}`;
+	}
+	post(body) {
+		return jsonInit("POST", body);
+	}
+};
+//#endregion
 //#region src/redaction.ts
 const SECRET_KEY_PATTERN = /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;
-const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\b/g;
+const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|lrc_|gh[pousr]_)[A-Za-z0-9_.=-]+\b/g;
 function redactHubValue(value) {
 	if (typeof value === "string") return value.replace(SECRET_VALUE_PATTERN, "[REDACTED]");
 	if (Array.isArray(value)) return value.map((item) => redactHubValue(item));
@@ -9,7 +319,7 @@ function redactHubValue(value) {
 	return value;
 }
 //#endregion
-//#region src/client.ts
+//#region src/transport.ts
 var HubSdkError = class extends Error {
 	code;
 	details;
@@ -26,16 +336,18 @@ function bodySnippet(body, max = 200) {
 	const trimmed = body.trim();
 	return trimmed.length > max ? `${trimmed.slice(0, max)}…` : trimmed;
 }
-function httpError(path, status, statusText, body, contentType) {
-	const suffix = statusText ? ` ${statusText}` : "";
+function httpError(path, status, statusText, body, contentType, omitResponseDetails = false) {
+	const suffix = !omitResponseDetails && statusText ? ` ${statusText}` : "";
 	return new HubSdkError({
 		code: `HUB_HTTP_${status}`,
 		message: `Hub request ${path} failed: HTTP ${status}${suffix}`,
 		details: {
 			status,
 			path,
-			contentType: contentType || null,
-			bodySnippet: bodySnippet(body)
+			...omitResponseDetails ? {} : {
+				contentType: contentType || null,
+				bodySnippet: bodySnippet(body)
+			}
 		}
 	}, { status });
 }
@@ -52,132 +364,82 @@ function isHubSuccessEnvelope(value) {
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
-/** Read a wire field as a string, or "" when the server sent anything else.
-*  `raw` is that field straight off the parsed payload, before any check. */
-function optString(raw) {
-	return typeof raw === "string" ? raw : "";
-}
-/** An agent iteration's terminal status (`iteration.ended`) — only ever
-*  succeeded/failed; an iteration is never guard-skipped. */
-function isIterationStatus(value) {
-	return value === "succeeded" || value === "failed";
-}
-/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
-*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
-*  accepted here so a skipped event is surfaced, not dropped as malformed. */
-function isActionFinishedStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "skipped";
-}
-/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
-*  (a user cancel) — a value neither the action nor iteration status checkers
-*  accept — so `run.done` uses this rather than them, which would drop a
-*  cancelled terminal event and hang the stream. */
-function isRunDoneStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "cancelled";
-}
-/**
-* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
-* run-stream event, validating the fields each variant declares rather than
-* blindly casting the wire payload. A frame that doesn't match its event's
-* shape (or an unknown event name) returns null so the consumer skips it — a
-* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
-* new server event kinds don't break older clients.
-*/
-function toRunStreamEvent(eventType, raw) {
-	if (eventType === "ping") return { type: "ping" };
-	if (!isRecord$1(raw)) return null;
-	switch (eventType) {
-		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
-			type: "snapshot",
-			run: raw
-		} : null;
-		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
-			type: "token",
-			actionIndex: raw.actionIndex,
-			delta: raw.delta,
-			at: optString(raw.at)
-		} : null;
-		case "run.done": return isRunDoneStatus(raw.status) ? {
-			type: "run.done",
-			status: raw.status,
-			error: typeof raw.error === "string" ? raw.error : null,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
-			type: "run.waiting",
-			decisionId: raw.decisionId,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
-			type: "action.started",
-			index: raw.index,
-			kind: raw.kind,
-			at: raw.at
-		} : null;
-		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "action.finished",
-			index: raw.index,
-			kind: raw.kind,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
-			...typeof raw.error === "string" ? { error: raw.error } : {}
-		} : null;
-		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
-			type: "iteration.started",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			at: raw.at,
-			...typeof raw.model === "string" ? { model: raw.model } : {}
-		} : null;
-		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "iteration.ended",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
-			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
-			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
-		} : null;
-		default: return null;
+var HubTransport = class {
+	baseUrl;
+	fetch;
+	authHeaders;
+	#apiKey;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.#apiKey = options.apiKey;
+		this.authHeaders = options.authHeaders;
+		this.fetch = options.fetch ?? fetch.bind(globalThis);
 	}
-}
-/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
-*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
-*  (AbortSignal.timeout). */
-function isAbortError(cause) {
-	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
-}
-/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
-*  Returns undefined when neither bound applies (no per-request abort needed). */
-function combineAbortSignals(caller, timeoutMs) {
-	const signals = [];
-	if (caller) signals.push(caller);
-	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
-	if (signals.length === 0) return void 0;
-	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-}
-/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
-*  abort so a cancelled wait leaves nothing pending. */
-function delay(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-			return;
+	/** The API key this client authenticates with, when it has one. */
+	get apiKey() {
+		return this.#apiKey;
+	}
+	async request(path, init, options = {}) {
+		const callerAuth = options.auth === "caller";
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers, callerAuth)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		const bodyText = await response.text();
+		if (!contentType.includes("application/json")) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
 		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
+		if (isHubErrorEnvelope(parsed)) {
+			if (callerAuth) throw new HubSdkError({
+				code: parsed.error.code,
+				message: `Hub request ${path} failed: HTTP ${status}`
+			}, { status });
+			throw new HubSdkError(parsed.error, { status });
+		}
+		if (isHubSuccessEnvelope(parsed)) {
+			if (callerAuth && !response.ok) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+			if (options.validateData && !options.validateData(parsed.data)) throw new HubSdkError({
+				code: `HUB_HTTP_${status}`,
+				message: `Hub request ${path} returned invalid data`,
+				details: {
+					status,
+					path
+				}
+			}, { status });
+			return parsed.data;
+		}
+		throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+	}
+	async buildHeaders(headers, callerAuth = false) {
+		const mergedHeaders = new Headers({ Accept: "application/json" });
+		if (!callerAuth && this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
+		if (!callerAuth && this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
+		for (const [key, value] of new Headers(headers)) mergedHeaders.set(key, value);
+		return mergedHeaders;
+	}
+};
+/** Decode a failed non-envelope response using the same redacted SDK errors. */
+async function throwHubResponseError(path, response, status, contentType) {
+	const bodyText = await response.text().catch(() => "");
+	if (contentType.includes("application/json")) {
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			parsed = void 0;
+		}
+		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
+	}
+	throw httpError(path, status, response.statusText, bodyText, contentType);
 }
+//#endregion
+//#region src/environment.ts
 const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
 const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
 const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
@@ -204,171 +466,32 @@ function resolveHubAuth(env = readProcessEnv()) {
 	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
 	if (present.length === 0) throw new HubSdkError({
 		code: "HUB_CONFIG_MISSING",
-		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	if (present.length > 1) throw new HubSdkError({
-		code: "HUB_CONFIG_INVALID",
-		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	return present[0];
-}
-function nonEmpty(value) {
-	if (value === void 0) return void 0;
-	const trimmed = value.trim();
-	return trimmed.length === 0 ? void 0 : trimmed;
-}
-function readProcessEnv() {
-	return globalThis.process?.env ?? {};
-}
-var HubClient = class HubClient {
-	baseUrl;
-	fetch;
-	apiKey;
-	authHeaders;
-	connections;
-	channels;
-	eventSubscriptions;
-	permissions;
-	tokens;
-	tools;
-	approvals;
-	audit;
-	githubApp;
-	workflows;
-	constructor(options) {
-		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.apiKey = options.apiKey;
-		this.authHeaders = options.authHeaders;
-		this.fetch = options.fetch ?? fetch.bind(globalThis);
-		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
-		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
-		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
-		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
-		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
-		this.tools = new HubToolsClient((path, init) => this.request(path, init));
-		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
-		this.audit = new HubAuditClient((path, init) => this.request(path, init));
-		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
-		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
-	}
-	static fromEnv(options = {}) {
-		const env = options.env ?? readProcessEnv();
-		return new HubClient({
-			baseUrl: resolveHubBaseUrl(env),
-			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
-			authHeaders: options.authHeaders,
-			fetch: options.fetch
-		});
-	}
-	async status() {
-		return this.request("/v1/hub/status", { method: "GET" });
-	}
-	async request(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		const bodyText = await response.text();
-		if (!contentType.includes("application/json")) throw httpError(path, status, response.statusText, bodyText, contentType);
-		let parsed;
-		try {
-			parsed = JSON.parse(bodyText);
-		} catch {
-			throw httpError(path, status, response.statusText, bodyText, contentType);
-		}
-		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-		if (isHubSuccessEnvelope(parsed)) return parsed.data;
-		throw httpError(path, status, response.statusText, bodyText, contentType);
-	}
-	/**
-	* Open a streaming (Server-Sent Events) response and return its raw body.
-	* Shares auth-header building + `fetch` with {@link request}, but does NOT
-	* buffer or JSON-parse the body — the caller consumes the stream.
-	*
-	* A successful stream comes back as `text/event-stream`. Anything else is an
-	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-	* page); it is surfaced the same way {@link request} surfaces errors — a
-	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-	*/
-	async stream(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok || !contentType.includes("text/event-stream")) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
-				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
-		}
-		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
-		return response.body;
-	}
-	/**
-	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-	* the artifact's own content type, not JSON. Error responses on such routes
-	* are still the standard envelope, so a failure surfaces exactly like
-	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-	* otherwise an `HUB_HTTP_<status>` transport error.
-	*/
-	async requestBytes(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
-				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
-		}
-		return {
-			bytes: new Uint8Array(await response.arrayBuffer()),
-			contentType
-		};
-	}
-	async buildHeaders(headers) {
-		const mergedHeaders = new Headers(headers);
-		if (!mergedHeaders.has("Accept")) mergedHeaders.set("Accept", "application/json");
-		if (this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
-		if (this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
-		for (const [key, value] of new Headers(headers)) mergedHeaders.set(key, value);
-		return mergedHeaders;
-	}
-};
+		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	if (present.length > 1) throw new HubSdkError({
+		code: "HUB_CONFIG_INVALID",
+		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	return present[0];
+}
+function nonEmpty(value) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+function readProcessEnv() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+//#region src/authorization.ts
 var HubTokensClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async mint(options) {
-		return this.request("/v1/hub/tokens", {
-			method: "POST",
-			body: JSON.stringify(options),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tokens", jsonInit("POST", options));
 	}
 	async list(options = {}) {
 		const searchParams = new URLSearchParams();
@@ -402,64 +525,56 @@ var HubPermissionsClient = class {
 		return this.request(`/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`, { method: "GET" });
 	}
 	async set(input) {
-		return this.request("/v1/hub/policies", {
-			method: "PUT",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies", jsonInit("PUT", input));
 	}
 	/** Reset an action to its default by deleting any stored override. */
 	async delete(input) {
-		return this.request("/v1/hub/policies", {
-			method: "DELETE",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies", jsonInit("DELETE", input));
 	}
 	/** Bulk-allow every write action of a connection's provider. Reads are
 	*  already allowed for sandbox agents; destructive actions stay `ask`.
 	*  Idempotent: actions with an existing policy are left untouched. */
 	async allowWrites(connectionId) {
-		return this.request("/v1/hub/policies/allow-writes", {
-			method: "POST",
-			body: JSON.stringify({ connectionId }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies/allow-writes", jsonInit("POST", { connectionId }));
 	}
 	/** Inverse of `allowWrites`: delete only the rows it created for this
 	*  connection. Manual per-action decisions are left intact. */
 	async revertWrites(connectionId) {
-		return this.request("/v1/hub/policies/revert-writes", {
-			method: "POST",
-			body: JSON.stringify({ connectionId }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies/revert-writes", jsonInit("POST", { connectionId }));
+	}
+};
+var HubApprovalsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/approvals", { method: "GET" });
+	}
+	async approve(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	}
+	async deny(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
 	}
 };
+//#endregion
+//#region src/tools.ts
 var HubToolsClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async search(query, options = {}) {
-		return this.request("/v1/hub/tools/search", {
-			method: "POST",
-			body: JSON.stringify({
-				query,
-				provider: options.provider,
-				limit: options.limit
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tools/search", jsonInit("POST", {
+			query,
+			provider: options.provider,
+			limit: options.limit
+		}));
 	}
 	async sources() {
 		return this.request("/v1/hub/tools/sources", { method: "GET" });
 	}
 	async describe(path) {
-		return this.request("/v1/hub/tools/describe", {
-			method: "POST",
-			body: JSON.stringify({ path }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tools/describe", jsonInit("POST", { path }));
 	}
 	/**
 	* Run one hub tool. `raw` is the tool input: the SDK forwards it verbatim as
@@ -472,8 +587,9 @@ var HubToolsClient = class {
 			return await this.request("/v1/hub/exec", execInit);
 		} catch (error) {
 			if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) throw error;
+			const approvalId = getApprovalId(error);
+			if (approvalId && options.approve !== true) throw error;
 			if (options.approve) {
-				const approvalId = getApprovalId(error);
 				if (!approvalId) throw error;
 				const approved = await this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
 				validateApprovedExecution(approved, path, options.connectionId);
@@ -491,15 +607,11 @@ var HubToolsClient = class {
 				});
 			}
 		}
-		const minted = await this.request("/v1/hub/tokens", {
-			method: "POST",
-			body: JSON.stringify({
-				actionPath: path,
-				connectionId: options.connectionId,
-				provider: options.connectionId ? void 0 : path.split(".")[0]
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		const minted = await this.request("/v1/hub/tokens", jsonInit("POST", {
+			actionPath: path,
+			connectionId: options.connectionId,
+			provider: options.connectionId ? void 0 : path.split(".")[0]
+		}));
 		return this.request("/v1/hub/exec", {
 			...execInit,
 			headers: {
@@ -509,16 +621,12 @@ var HubToolsClient = class {
 		});
 	}
 	buildExecInit(path, raw, options) {
-		return {
-			method: "POST",
-			body: JSON.stringify({
-				path,
-				input: raw,
-				connectionId: options.connectionId,
-				idempotencyKey: options.idempotencyKey
-			}),
-			headers: { "Content-Type": "application/json" }
-		};
+		return jsonInit("POST", {
+			path,
+			input: raw,
+			connectionId: options.connectionId,
+			idempotencyKey: options.idempotencyKey
+		});
 	}
 };
 function requiresCapabilityToken(error) {
@@ -548,45 +656,50 @@ function validateApprovedExecution(approved, path, connectionId) {
 		}
 	});
 }
-var HubChannelsClient = class {
+//#endregion
+//#region src/inbound-webhooks.ts
+var HubInboundWebhooksClient = class {
 	constructor(request) {
 		this.request = request;
 	}
-	async list() {
-		return this.request("/v1/hub/channels", { method: "GET" });
-	}
-	async createEmail(input = {}) {
-		return this.request("/v1/hub/channels/email", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	async delete(channelId) {
-		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
+	async create(connectionId, options = {}) {
+		return this.request(this.path(connectionId), jsonInit("POST", options));
 	}
-};
-var HubEventSubscriptionsClient = class {
-	constructor(request) {
-		this.request = request;
+	async get(connectionId) {
+		return this.request(this.path(connectionId), { method: "GET" });
 	}
-	async list() {
-		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	/** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+	async ensurePhoneNumber(connectionId, phoneNumberId) {
+		if (!phoneNumberId || phoneNumberId.length > 128 || !/^[\x21-\x7e]+$/.test(phoneNumberId)) throw new Error("A bounded phone-number id is required");
+		return this.request(`${this.path(connectionId)}/phone-numbers/ensure`, jsonInit("POST", { phoneNumberId }));
 	}
-	async create(input) {
-		return this.request("/v1/hub/event-subscriptions", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+	/** Remove event subscriptions first. This does not silently rotate a live URL. */
+	async delete(connectionId) {
+		return this.request(this.path(connectionId), { method: "DELETE" });
 	}
-	async delete(subscriptionId) {
-		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
+	path(connectionId) {
+		if (!connectionId || connectionId.length > 256) throw new Error("A bounded connection id is required");
+		return `/v1/hub/connections/${encodeURIComponent(connectionId)}/inbound-webhook`;
 	}
 };
+//#endregion
+//#region src/connections.ts
+const GITHUB_EXACT_CONNECT_SCOPES = [
+	"read:user",
+	"repo",
+	"read:org"
+];
+function sameOAuthScopeSet(left, right) {
+	if (!Array.isArray(left)) return false;
+	const leftSet = new Set(left);
+	const rightSet = new Set(right);
+	return leftSet.size === left.length && rightSet.size === right.length && leftSet.size === rightSet.size && [...leftSet].every((scope) => rightSet.has(scope));
+}
 var HubConnectionsClient = class {
+	inboundWebhook;
 	constructor(request) {
 		this.request = request;
+		this.inboundWebhook = new HubInboundWebhooksClient(request);
 	}
 	async list() {
 		return this.request("/v1/hub/connections", { method: "GET" });
@@ -598,40 +711,38 @@ var HubConnectionsClient = class {
 		return this.request("/v1/hub/providers", { method: "GET" });
 	}
 	async start(provider, options = {}) {
-		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, {
-			method: "POST",
-			body: JSON.stringify({
-				returnUrl: options.returnUrl,
-				cli: options.cli,
-				connectionParameters: options.connectionParameters
-			}),
-			headers: { "Content-Type": "application/json" }
+		if (options.requestedScopes !== void 0 && (provider !== "github" || !sameOAuthScopeSet(options.requestedScopes, GITHUB_EXACT_CONNECT_SCOPES))) throw new HubSdkError({
+			code: "HUB_INVALID_INPUT",
+			message: "GitHub requestedScopes must be read:user, repo, and read:org"
 		});
+		const started = await this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, jsonInit("POST", {
+			returnUrl: options.returnUrl,
+			cli: options.cli,
+			connectionParameters: options.connectionParameters,
+			requestedScopes: options.requestedScopes
+		}));
+		if (options.requestedScopes !== void 0 && (started.provider !== provider || !sameOAuthScopeSet(started.scopes, options.requestedScopes))) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Hub did not preserve the requested OAuth scopes"
+		});
+		return started;
 	}
 	async startWhatsappEmbeddedSignup(options = {}) {
-		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/start", {
-			method: "POST",
-			body: JSON.stringify({ returnUrl: options.returnUrl }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/start", jsonInit("POST", { returnUrl: options.returnUrl }));
 	}
 	async completeWhatsappEmbeddedSignup(input) {
-		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/complete", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/complete", jsonInit("POST", input));
 	}
 	/** Connect a non-OAuth (api-key) connector by submitting the user's key.
 	*  The server validates the key with a live probe before persisting and
 	*  returns the created (or reconnected) connection — there is no redirect,
-	*  unlike `start`. */
-	async connectApiKey(provider, apiKey) {
-		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`, {
-			method: "POST",
-			body: JSON.stringify({ apiKey }),
-			headers: { "Content-Type": "application/json" }
-		});
+	*  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+	*  requires listing ID/PMS pairs; other providers have no metadata. */
+	async connectApiKey(provider, apiKey, metadata) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`, jsonInit("POST", {
+			apiKey,
+			...metadata === void 0 ? {} : { metadata }
+		}));
 	}
 	async revoke(connectionId) {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
@@ -640,30 +751,44 @@ var HubConnectionsClient = class {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
 	}
 };
-var HubApprovalsClient = class {
+//#endregion
+//#region src/channels.ts
+var HubChannelsClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async list() {
-		return this.request("/v1/hub/approvals", { method: "GET" });
+		return this.request("/v1/hub/channels", { method: "GET" });
 	}
-	async approve(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	async createEmail(input = {}) {
+		return this.request("/v1/hub/channels/email", jsonInit("POST", input));
 	}
-	async deny(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	async delete(channelId) {
+		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
+	}
+};
+var HubEventSubscriptionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	}
+	async create(input) {
+		return this.request("/v1/hub/event-subscriptions", jsonInit("POST", input));
+	}
+	async delete(subscriptionId) {
+		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
 	}
 };
+//#endregion
+//#region src/github-app.ts
 var HubGithubAppClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async mintInstallationToken(input) {
-		return this.request("/v1/hub/github-app/mint-installation-token", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/github-app/mint-installation-token", jsonInit("POST", input));
 	}
 	/** Every installation the caller may act through — their own and any org's
 	*  they were verified against. The management surface's read. */
@@ -698,26 +823,221 @@ var HubGithubAppClient = class {
 		return this.request(`/v1/hub/github-app/is-repo-installed?${params.toString()}`, { method: "GET" });
 	}
 };
+//#endregion
+//#region src/audit.ts
 var HubAuditClient = class {
 	constructor(request) {
 		this.request = request;
 	}
-	async list(options = {}) {
-		const searchParams = new URLSearchParams();
-		if (options.provider !== void 0) searchParams.set("provider", options.provider);
-		if (options.action !== void 0) searchParams.set("action", options.action);
-		if (options.status !== void 0) searchParams.set("status", options.status);
-		if (options.since !== void 0) searchParams.set("since", options.since);
-		if (options.until !== void 0) searchParams.set("until", options.until);
-		if (options.cursor !== void 0) searchParams.set("cursor", options.cursor);
-		if (options.limit !== void 0) searchParams.set("limit", String(options.limit));
-		const query = searchParams.toString();
-		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
+	async list(options = {}) {
+		const searchParams = new URLSearchParams();
+		if (options.provider !== void 0) searchParams.set("provider", options.provider);
+		if (options.action !== void 0) searchParams.set("action", options.action);
+		if (options.status !== void 0) searchParams.set("status", options.status);
+		if (options.since !== void 0) searchParams.set("since", options.since);
+		if (options.until !== void 0) searchParams.set("until", options.until);
+		if (options.cursor !== void 0) searchParams.set("cursor", options.cursor);
+		if (options.limit !== void 0) searchParams.set("limit", String(options.limit));
+		const query = searchParams.toString();
+		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
+	}
+};
+//#endregion
+//#region src/workflow-run-events.ts
+/** Read a wire field as a string, or "" when the server sent anything else.
+*  `raw` is that field straight off the parsed payload, before any check. */
+function optString(raw) {
+	return typeof raw === "string" ? raw : "";
+}
+/** An agent iteration's terminal status (`iteration.ended`) — only ever
+*  succeeded/failed; an iteration is never guard-skipped. */
+function isIterationStatus(value) {
+	return value === "succeeded" || value === "failed";
+}
+/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
+*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
+*  accepted here so a skipped event is surfaced, not dropped as malformed. */
+function isActionFinishedStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "skipped";
+}
+/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
+*  (a user cancel) — a value neither the action nor iteration status checkers
+*  accept — so `run.done` uses this rather than them, which would drop a
+*  cancelled terminal event and hang the stream. */
+function isRunDoneStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "cancelled";
+}
+/**
+* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
+* run-stream event, validating the fields each variant declares rather than
+* blindly casting the wire payload. A frame that doesn't match its event's
+* shape (or an unknown event name) returns null so the consumer skips it — a
+* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
+* new server event kinds don't break older clients.
+*/
+function toRunStreamEvent(eventType, raw) {
+	if (eventType === "ping") return { type: "ping" };
+	if (!isRecord$1(raw)) return null;
+	switch (eventType) {
+		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
+			type: "snapshot",
+			run: raw
+		} : null;
+		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
+			type: "token",
+			actionIndex: raw.actionIndex,
+			delta: raw.delta,
+			at: optString(raw.at)
+		} : null;
+		case "run.done": return isRunDoneStatus(raw.status) ? {
+			type: "run.done",
+			status: raw.status,
+			error: typeof raw.error === "string" ? raw.error : null,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
+			type: "run.waiting",
+			decisionId: raw.decisionId,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
+			type: "action.started",
+			index: raw.index,
+			kind: raw.kind,
+			at: raw.at
+		} : null;
+		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "action.finished",
+			index: raw.index,
+			kind: raw.kind,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
+			...typeof raw.error === "string" ? { error: raw.error } : {}
+		} : null;
+		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
+			type: "iteration.started",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			at: raw.at,
+			...typeof raw.model === "string" ? { model: raw.model } : {}
+		} : null;
+		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "iteration.ended",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
+			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
+			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
+		} : null;
+		default: return null;
+	}
+}
+//#endregion
+//#region src/workflows-kv.ts
+/** The workflow's durable keyspace, shared by all its runs. */
+var WorkflowKvResource = class {
+	constructor(request) {
+		this.request = request;
+	}
+	/**
+	* The workflow's whole keyspace as metadata (key, version, updatedAt — never
+	* values), key-ordered. Bounded by the server's per-workflow key cap.
+	*/
+	async listKv(id) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv`, { method: "GET" });
+	}
+	/** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
+	async getKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "GET" });
+	}
+	/**
+	* Upsert a key; returns the entry with its NEW version (increments on every
+	* write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
+	* or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
+	* value, stored and read back verbatim, so the client never gives it a shape.
+	*/
+	async putKv(id, key, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, jsonInit("PUT", { value: raw }));
+	}
+	/**
+	* Compare-and-swap: the write lands only when the stored version still
+	* equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
+	* (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
+	* caller's value, stored and read back verbatim, so the client never gives it
+	* a shape.
+	*/
+	async casKv(id, key, expectedVersion, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}/cas`, jsonInit("POST", {
+			expectedVersion,
+			value: raw
+		}));
+	}
+	/** Delete a key; idempotent — `deleted` reports whether a row was removed. */
+	async deleteKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "DELETE" });
 	}
 };
-var HubWorkflowsClient = class {
+//#endregion
+//#region src/workflows.ts
+/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
+*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
+*  (AbortSignal.timeout). */
+function isAbortError(cause) {
+	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
+}
+/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
+*  Returns undefined when neither bound applies (no per-request abort needed). */
+function combineAbortSignals(caller, timeoutMs) {
+	const signals = [];
+	if (caller) signals.push(caller);
+	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
+	if (signals.length === 0) return void 0;
+	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
+*  abort so a cancelled wait leaves nothing pending. */
+function delay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Wait before reopening a run event stream that a restart ended. */
+const STREAM_REOPEN_DELAY_MS = 1e3;
+/** Reopens in a row that deliver nothing before watchRun gives up. */
+const MAX_IDLE_STREAM_REOPENS = 30;
+function abortableDelay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+var HubWorkflowsClient = class extends WorkflowKvResource {
 	constructor(request, stream, download) {
-		this.request = request;
+		super(request);
 		this.stream = stream;
 		this.download = download;
 	}
@@ -738,11 +1058,7 @@ var HubWorkflowsClient = class {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "GET" });
 	}
 	async create(yaml) {
-		return this.request("/v1/workflows", {
-			method: "POST",
-			body: JSON.stringify({ yaml }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/workflows", jsonInit("POST", { yaml }));
 	}
 	/**
 	* Replace the workflow's definition from YAML (recompiled server-side,
@@ -753,14 +1069,10 @@ var HubWorkflowsClient = class {
 	* concurrent modification, `NOT_FOUND` for an unknown/foreign id.
 	*/
 	async update(id, yaml, opts = {}) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, {
-			method: "PUT",
-			body: JSON.stringify({
-				yaml,
-				...opts.note !== void 0 ? { note: opts.note } : {}
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PUT", {
+			yaml,
+			...opts.note !== void 0 ? { note: opts.note } : {}
+		}));
 	}
 	async delete(id) {
 		await this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "DELETE" });
@@ -771,11 +1083,7 @@ var HubWorkflowsClient = class {
 	* via `update`, but it can still be paused/resumed here).
 	*/
 	async setEnabled(id, enabled) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, {
-			method: "PATCH",
-			body: JSON.stringify({ enabled }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PATCH", { enabled }));
 	}
 	/**
 	* One page of run history, newest first. Pass the previous page's
@@ -797,15 +1105,14 @@ var HubWorkflowsClient = class {
 	* `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
 	* workflow that reads no trigger fields. Throws `HubSdkError`:
 	* `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
-	* names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`
-	* for an unknown/foreign id. Pass `opts.signal` to abort a slow request.
+	* names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+	* still runs once; pausing only stops its triggers. Pass `opts.signal` to
+	* abort a slow request.
 	*/
 	async run(id, inputs, opts = {}) {
 		const hasInputs = inputs !== void 0 && Object.keys(inputs).length > 0;
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/run`, {
-			method: "POST",
-			body: JSON.stringify(hasInputs ? { inputs } : {}),
-			headers: { "Content-Type": "application/json" },
+			...jsonInit("POST", hasInputs ? { inputs } : {}),
 			...opts.signal ? { signal: opts.signal } : {}
 		});
 	}
@@ -845,8 +1152,8 @@ var HubWorkflowsClient = class {
 	* follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
 	* other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
 	* terminal-failed/cancelled (queued/running/waiting, or succeeded),
-	* `WORKFLOW_DISABLED` when the workflow has since been disabled, `NOT_FOUND`
-	* for an unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+	* `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+	* failure still retries. Pass `opts.signal` to abort a slow request.
 	*/
 	async retryRun(id, runId, opts = {}) {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/retry`, {
@@ -867,6 +1174,12 @@ var HubWorkflowsClient = class {
 	* poll) arrive — the persisted record, read via {@link getRun}, stays the
 	* source of truth. Pass `signal` to cancel; iterating to `run.done` (or
 	* breaking early) releases the connection.
+	*
+	* A stream that ends before `run.done` or `run.waiting` (the Platform is
+	* restarting or handing over) is reopened after a second, as is one refused
+	* with `SERVICE_DRAINING`; the reopened stream starts with a fresh
+	* `snapshot`. After 30 reopens in a row that deliver nothing it throws
+	* `HubSdkError(WORKFLOW_STREAM_INTERRUPTED)`.
 	*/
 	async *watchRun(id, runId, opts = {}) {
 		const openStream = this.stream;
@@ -874,7 +1187,37 @@ var HubWorkflowsClient = class {
 			code: "HUB_CONFIG_INVALID",
 			message: "watchRun needs a streaming transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly"
 		});
-		const reader = (await openStream(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`, {
+		const path = `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`;
+		let idleReopens = 0;
+		for (;;) {
+			let delivered = false;
+			const connection = this.watchRunOnce(openStream, path, opts);
+			try {
+				for (;;) {
+					const next = await connection.next();
+					if (next.done) {
+						if (next.value === "ended") return;
+						break;
+					}
+					delivered = true;
+					yield next.value;
+				}
+			} catch (error) {
+				if (!(error instanceof HubSdkError) || error.code !== "SERVICE_DRAINING" || opts.signal?.aborted) throw error;
+			} finally {
+				await connection.return("interrupted");
+			}
+			idleReopens = delivered ? 0 : idleReopens + 1;
+			if (idleReopens > MAX_IDLE_STREAM_REOPENS) throw new HubSdkError({
+				code: "WORKFLOW_STREAM_INTERRUPTED",
+				message: `the run event stream ended ${MAX_IDLE_STREAM_REOPENS} times without delivering an event`
+			});
+			await abortableDelay(STREAM_REOPEN_DELAY_MS, opts.signal);
+		}
+	}
+	/** One connection's events, then how it ended. */
+	async *watchRunOnce(openStream, path, opts) {
+		const reader = (await openStream(path, {
 			method: "GET",
 			headers: { Accept: "text/event-stream" },
 			...opts.signal ? { signal: opts.signal } : {}
@@ -896,9 +1239,9 @@ var HubWorkflowsClient = class {
 					const event = toRunStreamEvent(parsed.eventType, parsed.data);
 					if (!event) continue;
 					yield event;
-					if (event.type === "run.done" || event.type === "run.waiting") return;
+					if (event.type === "run.done" || event.type === "run.waiting") return "ended";
 				}
-				if (done) return;
+				if (done) return "interrupted";
 			}
 		} finally {
 			await reader.cancel().catch(() => {});
@@ -984,11 +1327,7 @@ var HubWorkflowsClient = class {
 	* YAML no longer compiles, `CONFLICT` on a concurrent modification.
 	*/
 	async rollback(id, rev) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/rollback`, {
-			method: "POST",
-			body: JSON.stringify({ rev }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/rollback`, jsonInit("POST", { rev }));
 	}
 	/**
 	* Deterministic health stats over the workflow's last N terminal runs
@@ -1009,11 +1348,7 @@ var HubWorkflowsClient = class {
 	* until an owner approves.
 	*/
 	async propose(id, input) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals`, {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals`, jsonInit("POST", input));
 	}
 	/**
 	* Pending (proposed) and declined (rejected) revisions, newest first, with
@@ -1040,11 +1375,7 @@ var HubWorkflowsClient = class {
 	* pending proposal.
 	*/
 	async rejectProposal(id, rev, opts = {}) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals/${encodeURIComponent(String(rev))}/reject`, {
-			method: "POST",
-			body: JSON.stringify(opts.reason !== void 0 ? { reason: opts.reason } : {}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals/${encodeURIComponent(String(rev))}/reject`, jsonInit("POST", opts.reason !== void 0 ? { reason: opts.reason } : {}));
 	}
 	/**
 	* Mint a fresh webhook hook token, retiring the current one immediately.
@@ -1106,51 +1437,6 @@ var HubWorkflowsClient = class {
 		});
 		return downloadBytes(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}`, { method: "GET" });
 	}
-	/**
-	* The workflow's whole keyspace as metadata (key, version, updatedAt — never
-	* values), key-ordered. Bounded by the server's per-workflow key cap.
-	*/
-	async listKv(id) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv`, { method: "GET" });
-	}
-	/** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
-	async getKv(id, key) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "GET" });
-	}
-	/**
-	* Upsert a key; returns the entry with its NEW version (increments on every
-	* write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
-	* or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
-	* value, stored and read back verbatim, so the client never gives it a shape.
-	*/
-	async putKv(id, key, raw) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, {
-			method: "PUT",
-			body: JSON.stringify({ value: raw }),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/**
-	* Compare-and-swap: the write lands only when the stored version still
-	* equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
-	* (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
-	* caller's value, stored and read back verbatim, so the client never gives it
-	* a shape.
-	*/
-	async casKv(id, key, expectedVersion, raw) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}/cas`, {
-			method: "POST",
-			body: JSON.stringify({
-				expectedVersion,
-				value: raw
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/** Delete a key; idempotent — `deleted` reports whether a row was removed. */
-	async deleteKv(id, key) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "DELETE" });
-	}
 	/** The curated starter gallery runnable on THIS deployment: metadata,
 	*  parameters, referenced providers, and a concrete `previewYaml` per card. */
 	async listTemplates() {
@@ -1165,11 +1451,7 @@ var HubWorkflowsClient = class {
 	* (400); an unknown template id throws `NOT_FOUND`.
 	*/
 	async instantiateTemplate(templateId, parameters) {
-		return this.request(`/v1/workflows/templates/${encodeURIComponent(templateId)}/instantiate`, {
-			method: "POST",
-			body: JSON.stringify(parameters ? { parameters } : {}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/templates/${encodeURIComponent(templateId)}/instantiate`, jsonInit("POST", parameters ? { parameters } : {}));
 	}
 	/**
 	* The caller's open decisions across all workflows — the always-available
@@ -1196,11 +1478,7 @@ var HubWorkflowsClient = class {
 	* (409 — answered, timed out, or cancelled first).
 	*/
 	async resolveRunDecision(id, runId, input) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision/resolve`, {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision/resolve`, jsonInit("POST", input));
 	}
 	/**
 	* Dry-run a YAML definition against the platform compiler without saving it.
@@ -1213,17 +1491,203 @@ var HubWorkflowsClient = class {
 	* the unconnected providers is the point.
 	*/
 	async validate(yaml, opts = {}) {
-		return this.request("/v1/workflows/validate", {
+		return this.request("/v1/workflows/validate", jsonInit("POST", {
+			yaml,
+			...opts.structural ? { structural: true } : {}
+		}));
+	}
+	async schema() {
+		return this.request("/v1/workflows/schema", { method: "GET" });
+	}
+};
+//#endregion
+//#region src/client.ts
+function isDispatchCurrentData(value) {
+	return isRecord$1(value) && typeof value.current === "boolean";
+}
+var HubClient = class HubClient extends HubTransport {
+	knowledge;
+	allowances;
+	apps;
+	connections;
+	channels;
+	numbers;
+	eventSubscriptions;
+	permissions;
+	tokens;
+	tools;
+	approvals;
+	audit;
+	githubApp;
+	workflows;
+	lines;
+	constructor(options) {
+		super(options);
+		this.knowledge = new HubKnowledgeClient((path, init) => this.request(path, init));
+		this.allowances = new HubAllowancesClient((path, init) => this.request(path, init));
+		this.apps = new HubAppsClient((path, init) => this.request(path, init));
+		this.numbers = new HubManagedNumbersClient((path, init) => this.request(path, init));
+		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
+		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
+		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
+		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
+		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
+		this.audit = new HubAuditClient((path, init) => this.request(path, init));
+		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
+		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
+		this.lines = new HubLinesClient((path, init) => this.request(path, init), (yaml) => this.workflows.create(yaml), (path, init, callbackBearer) => {
+			if (typeof callbackBearer !== "string" || !/^[\x21-\x7e]{16,512}$/.test(callbackBearer)) throw new HubSdkError({
+				code: "HUB_INVALID_INPUT",
+				message: "Application callback bearer is invalid"
+			});
+			const headers = new Headers(init.headers);
+			headers.set("Authorization", `Bearer ${callbackBearer}`);
+			return this.request(path, {
+				...init,
+				headers,
+				credentials: "omit",
+				redirect: "manual"
+			}, {
+				auth: "caller",
+				validateData: isDispatchCurrentData
+			});
+		});
+	}
+	static fromEnv(options = {}) {
+		const env = options.env ?? readProcessEnv();
+		return new HubClient({
+			baseUrl: resolveHubBaseUrl(env),
+			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
+			authHeaders: options.authHeaders,
+			fetch: options.fetch
+		});
+	}
+	async status() {
+		return this.request("/v1/hub/status", { method: "GET" });
+	}
+	/**
+	* Open a streaming (Server-Sent Events) response and return its raw body.
+	* Shares auth-header building + `fetch` with {@link request}, but does NOT
+	* buffer or JSON-parse the body — the caller consumes the stream.
+	*
+	* A successful stream comes back as `text/event-stream`. Anything else is an
+	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+	* page); it is surfaced the same way {@link request} surfaces errors — a
+	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+	*/
+	async stream(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok || !contentType.includes("text/event-stream")) await throwHubResponseError(path, response, status, contentType);
+		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
+		return response.body;
+	}
+	/**
+	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+	* the artifact's own content type, not JSON. Error responses on such routes
+	* are still the standard envelope, so a failure surfaces exactly like
+	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+	* otherwise an `HUB_HTTP_<status>` transport error.
+	*/
+	async requestBytes(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok) await throwHubResponseError(path, response, status, contentType);
+		return {
+			bytes: new Uint8Array(await response.arrayBuffer()),
+			contentType
+		};
+	}
+};
+//#endregion
+//#region src/broker.ts
+/** Server-only client. App secrets never become a user's general API key.
+* Every invocation mints and consumes one short-lived, exact-grant token. */
+var HubAppBrokerClient = class {
+	baseUrl;
+	fetcher;
+	constructor(options) {
+		this.options = options;
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.fetcher = options.fetch ?? fetch.bind(globalThis);
+	}
+	async token(path, body) {
+		const response = await this.fetcher(`${this.baseUrl}${path}`, {
 			method: "POST",
+			redirect: "manual",
+			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({
-				yaml,
-				...opts.structural ? { structural: true } : {}
-			}),
-			headers: { "Content-Type": "application/json" }
+				...body,
+				client_id: this.options.clientId,
+				client_secret: this.options.clientSecret
+			})
+		});
+		const result = await response.json().catch(() => null);
+		if (!response.ok || !result || typeof result !== "object" || Array.isArray(result)) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Application authorization is unavailable"
+		}, { status: response.status });
+		return result;
+	}
+	readToken(body) {
+		if (typeof body.access_token !== "string" || !body.access_token.startsWith("sk-tan-broker-") || body.token_type !== "Bearer" || typeof body.expires_in !== "number" || !Number.isSafeInteger(body.expires_in) || body.expires_in <= 0 || typeof body.scope !== "string") throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Invalid application authorization response"
 		});
+		return {
+			accessToken: body.access_token,
+			expiresIn: body.expires_in,
+			scopes: body.scope.split(" ").filter(Boolean)
+		};
 	}
-	async schema() {
-		return this.request("/v1/workflows/schema", { method: "GET" });
+	async exchange(input) {
+		const body = await this.token("/v1/apps/oauth/token", {
+			grant_type: "authorization_code",
+			code: input.code,
+			redirect_uri: input.redirectUri,
+			...input.connectionId === void 0 ? {} : { connection_id: input.connectionId },
+			ttl_seconds: 60
+		});
+		const token = this.readToken(body);
+		if (typeof body.grant_id !== "string" || !body.grant_id || typeof body.connection_id !== "string" || !body.connection_id.trim() || input.connectionId !== void 0 && body.connection_id !== input.connectionId) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Application connection did not match consent"
+		});
+		return {
+			...token,
+			grantId: body.grant_id,
+			connectionId: body.connection_id
+		};
+	}
+	async mint(grantId) {
+		if (!/^[A-Za-z0-9_-]{1,256}$/.test(grantId)) throw new Error("Invalid application grant");
+		return this.readToken(await this.token(`/v1/apps/grants/${encodeURIComponent(grantId)}/mint-broker-token`, {
+			grant_id: grantId,
+			ttl_seconds: 60
+		}));
+	}
+	async invoke(grantId, connectionId, actionPath, input) {
+		const token = await this.mint(grantId);
+		if (!token.scopes.includes(actionPath)) throw new HubSdkError({
+			code: "HUB_POLICY_DENIED",
+			message: "This action was not granted to the application"
+		});
+		return new HubClient({
+			baseUrl: this.baseUrl,
+			apiKey: token.accessToken,
+			fetch: this.fetcher
+		}).tools.invoke(actionPath, input, { connectionId });
 	}
 };
 //#endregion
@@ -1484,6 +1948,93 @@ function requestFailure(code, status, error, headers) {
 	};
 }
 //#endregion
-export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubApprovalsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+//#region src/knowledge-approval.ts
+/** Called only after the owner reviews this exact pending effect and clicks
+* Approve. Re-read first: a stale tab cannot approve a substituted operation. */
+async function approveKnowledgeSource(input) {
+	const { source, port, approvals } = input;
+	if (source.status !== "awaiting-approval" || !source.approval || !source.refreshRequestId || source.approval.preview.sourceId !== source.id || source.approval.preview.requestId !== source.refreshRequestId) throw new Error("This source has no reviewable pending action. Reload knowledge.");
+	const current = await port.get(source.id);
+	if (current.id !== source.id || current.status !== "awaiting-approval" || current.refreshRequestId !== source.refreshRequestId || JSON.stringify(current.approval) !== JSON.stringify(source.approval)) throw new Error("The requested action changed. Reload knowledge and review it again.");
+	let approvalToken;
+	try {
+		const decision = await approvals.approve(source.approval.id);
+		if (decision.approval.id !== source.approval.id || decision.approval.actionPath !== source.approval.path || decision.approval.connectionId !== source.approval.preview.connectionId || decision.approval.providerId !== source.approval.preview.provider || decision.approval.status !== "consumed" || !decision.capabilityToken?.token) throw new Error("The approval did not return a matching one-time capability. Reload knowledge.");
+		approvalToken = decision.capabilityToken.token;
+		return await port.refresh(source.id, {
+			requestId: source.refreshRequestId,
+			approvalToken
+		});
+	} finally {
+		approvalToken = void 0;
+	}
+}
+//#endregion
+//#region src/line-grants.ts
+function path(binding, suffix = "") {
+	if (!binding.workspaceId || !binding.workspaceAgentId) throw new Error("A workspace and agent are required for a line grant");
+	return `/v1/hub/line-grants/current${suffix}?${new URLSearchParams({
+		workspaceId: binding.workspaceId,
+		workspaceAgentId: binding.workspaceAgentId
+	})}`;
+}
+/** Every call uses HubTransport's authHeaders, so one-use app broker tokens can be minted per request. */
+var HubLineGrantsClient = class extends HubTransport {
+	current(binding) {
+		return this.request(path(binding), { method: "GET" });
+	}
+	async line(binding) {
+		return (await this.request(path(binding, "/line"), { method: "GET" })).line;
+	}
+	async attach(binding, input) {
+		return (await this.request(path(binding, "/attachment"), jsonInit("PUT", input))).attachment;
+	}
+	detach(binding) {
+		return this.request(path(binding, "/attachment"), { method: "DELETE" });
+	}
+	async threads(binding) {
+		return (await this.request(path(binding, "/threads"), { method: "GET" })).threads;
+	}
+	async messages(binding, threadId) {
+		if (!threadId || threadId.length > 256) throw new Error("A bounded line thread id is required");
+		return (await this.request(path(binding, `/threads/${encodeURIComponent(threadId)}/messages`), { method: "GET" })).messages;
+	}
+	memberApplication(binding) {
+		return this.request(path(binding, "/member-application"), { method: "GET" });
+	}
+	/**
+	* Route the owner's texts to this app's callback; the incumbent attachment
+	* stays. `replaceSelectionId` moves them from another app on the owner's
+	* explicit choice.
+	*/
+	async selectApplication(binding, input) {
+		return (await this.request(path(binding, "/member-application"), jsonInit("PUT", input))).selection;
+	}
+	/** Return the owner's texts to the incumbent attachment. */
+	async clearApplication(binding, input) {
+		await this.request(path(binding, "/member-application"), jsonInit("DELETE", input));
+	}
+	/** Ask only the verified owner member named by this owner_asks grant. */
+	send(binding, input) {
+		return this.request(path(binding, "/send"), jsonInit("POST", input));
+	}
+	/** Only a send created by this same grant is visible. */
+	outbox(binding, messageId) {
+		if (!/^lmsg_[A-Za-z0-9_-]+$/.test(messageId)) throw new Error("A line message id is required");
+		return this.request(path(binding, `/outbox/${encodeURIComponent(messageId)}`), { method: "GET" });
+	}
+	revoke(binding, expectedGrantId) {
+		const target = path(binding);
+		return this.request(expectedGrantId === void 0 ? target : `${target}&expectedGrantId=${encodeURIComponent(expectedGrantId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/workflow-definition-types.ts
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+function workflowConnectionRequirementKey(ref) {
+	return `${ref.kind}:${ref.provider}`;
+}
+//#endregion
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubAllowancesClient, HubAppBrokerClient, HubApprovalsClient, HubAppsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, HubLineGrantsClient, HubLinesClient, HubManagedNumbersClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature, workflowConnectionRequirementKey };
 //# sourceMappingURL=index.js.map