@tangle-network/hub-sdk 0.33.0-develop.20260826210715.d2524fb → 0.33.0

package/dist/index.js

@@ -1,7 +1,317 @@
-import { SSEChunkParser } from "@tangle-network/sdk-telemetry";
+import { SSEChunkParser } from "@tangle-network/agent-core/sse";
+//#region src/json-init.ts
+/** The init of a request whose body is JSON. Every client builds its bodies
+* here, so the content type cannot drift from the encoding. */
+function jsonInit(method, body) {
+	return {
+		method,
+		body: JSON.stringify(body),
+		headers: { "Content-Type": "application/json" }
+	};
+}
+//#endregion
+//#region src/allowances.ts
+var HubAllowancesClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async plan(meter) {
+		return (await this.request(this.path(meter), { method: "GET" })).plan;
+	}
+	async setPlan(meter, plan) {
+		return (await this.request(this.path(meter), this.body("PUT", plan))).plan;
+	}
+	/** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+	async admit(meter, input) {
+		return (await this.request(`${this.path(meter)}/turns`, this.body("POST", input))).allowance;
+	}
+	/** What the member's next turn would get, without counting anything. */
+	async status(meter, subject) {
+		const query = new URLSearchParams();
+		if (subject.role) query.set("role", subject.role);
+		if (subject.payer) query.set("payer", subject.payer);
+		if (subject.payerRole) query.set("payerRole", subject.payerRole);
+		const suffix = query.size ? `?${query}` : "";
+		return (await this.request(`${this.memberPath(meter, subject.member)}${suffix}`, { method: "GET" })).allowance;
+	}
+	/** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+	async grant(meter, member, input) {
+		return (await this.request(`${this.memberPath(meter, member)}/grant`, this.body("PUT", {
+			tier: "paid",
+			...input
+		}))).grant;
+	}
+	/** Synchronize a paid grant by durable product revision. Null expiry writes
+	* a retained revocation. A delayed older update is refused, never reactivated.
+	* There is no fallback to the unversioned grant endpoint on older servers. */
+	async syncGrant(meter, member, input) {
+		const { grant } = await this.request(`${this.memberPath(meter, member)}/grant/sync`, this.body("PUT", input));
+		if (grant.member !== member || grant.source !== input.source || grant.revision !== input.revision || grant.reference !== input.reference || grant.expiresAt !== (input.expiresAt === null ? null : new Date(input.expiresAt).toISOString())) throw new Error("The Hub returned a mismatched grant synchronization receipt");
+		return grant;
+	}
+	async revoke(meter, member) {
+		await this.request(`${this.memberPath(meter, member)}/grant`, { method: "DELETE" });
+	}
+	/** Turns per member and per line on one UTC day (default today). */
+	async usage(meter, day) {
+		const suffix = day ? `?day=${encodeURIComponent(day)}` : "";
+		return (await this.request(`${this.path(meter)}/usage${suffix}`, { method: "GET" })).usage;
+	}
+	path(meter) {
+		return `/v1/hub/allowances/${encodeURIComponent(meter)}`;
+	}
+	memberPath(meter, member) {
+		return `${this.path(meter)}/members/${encodeURIComponent(member)}`;
+	}
+	body(method, body) {
+		return jsonInit(method, body);
+	}
+};
+//#endregion
+//#region src/apps.ts
+function encodedId(id) {
+	if (typeof id !== "string" || !id || id.length > 256 || id === "." || id === "..") throw new Error("A bounded app or grant id is required");
+	return encodeURIComponent(id);
+}
+var HubAppsClient = class {
+	grants;
+	constructor(request) {
+		this.request = request;
+		this.grants = {
+			list: () => this.request("/v1/me/app-grants", { method: "GET" }),
+			revoke: async (grantId) => this.request(`/v1/me/app-grants/${encodedId(grantId)}/revoke`, { method: "POST" })
+		};
+	}
+	list() {
+		return this.request("/v1/apps", { method: "GET" });
+	}
+	/** The secret is returned only by creation; keep it in your server vault. */
+	create(input) {
+		return this.request("/v1/apps", jsonInit("POST", input));
+	}
+	/** Immutable association of two existing records with the same owner. */
+	async linkOAuthClient(appId, clientId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/oidc-client`, jsonInit("POST", { clientId }));
+	}
+	async revoke(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/revoke`, { method: "POST" });
+	}
+	/** Current latched compliance state and the BAA acceptance behind it. */
+	async getCompliance(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, { method: "GET" });
+	}
+	/**
+	* Latch HIPAA compliance for this app. The request MUST carry the exact
+	* `agreementVersion` the deployment currently offers — the acceptance is
+	* recorded before the claim exists, and the claim can never be cleared:
+	* `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+	*/
+	async setCompliance(appId, input) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, jsonInit("PUT", input));
+	}
+};
+//#endregion
+//#region src/knowledge-management.ts
+var HubKnowledgeManagementClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	materialize(input) {
+		return this.request("/v1/knowledge/attachments/materialize", jsonInit("POST", input));
+	}
+	authorization() {
+		return this.request("/v1/knowledge/authorization", { method: "GET" });
+	}
+	disconnectAuthorization() {
+		return this.request("/v1/knowledge/authorization", { method: "DELETE" });
+	}
+	capabilities() {
+		return this.request("/v1/knowledge/capabilities", { method: "GET" });
+	}
+	list() {
+		return this.request("/v1/knowledge/sources", { method: "GET" });
+	}
+	get(sourceId) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}`, { method: "GET" });
+	}
+	create(input) {
+		return this.request("/v1/knowledge/sources", jsonInit("POST", input));
+	}
+	refresh(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/refresh`, jsonInit("POST", input));
+	}
+	attach(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/attachments`, jsonInit("POST", input));
+	}
+	attachments(sandboxId) {
+		return this.request(`/v1/knowledge/attachments${sandboxId ? `?sandboxId=${encodeURIComponent(sandboxId)}` : ""}`, { method: "GET" });
+	}
+	detach(attachmentId) {
+		return this.request(`/v1/knowledge/attachments/${encodeURIComponent(attachmentId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/knowledge.ts
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+* scope on the server; neither a caller nor an agent can supply another scope. */
+var HubKnowledgeClient = class {
+	management;
+	constructor(request) {
+		this.request = request;
+		this.management = new HubKnowledgeManagementClient(request);
+	}
+	bindings() {
+		return this.request("/v1/knowledge/runtime/bindings", { method: "GET" });
+	}
+	query(input, options) {
+		return this.request("/v1/knowledge/runtime/query", {
+			...jsonInit("POST", {
+				query: input.query,
+				...input.expectedReferences !== void 0 ? { expectedReferences: input.expectedReferences } : {},
+				...input.limit !== void 0 ? { limit: input.limit } : {}
+			}),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/lines.ts
+/** The `on.schedule` mapping a Line schedule helper writes. */
+function scheduleYaml(cron, timezone, until) {
+	return `  schedule: { ${[
+		`cron: ${JSON.stringify(cron)}`,
+		`timezone: ${JSON.stringify(timezone)}`,
+		...until ? [`until: ${JSON.stringify(until)}`] : []
+	].join(", ")} }`;
+}
+/** Line calls share HubClient authentication and envelope handling. */
+var HubLinesClient = class {
+	members;
+	memberApplications;
+	checkins;
+	constructor(request, createWorkflow, requestApplicationDispatchCurrent) {
+		this.request = request;
+		this.createWorkflow = createWorkflow;
+		this.requestApplicationDispatchCurrent = requestApplicationDispatchCurrent;
+		this.members = { list: async (lineId) => (await this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/members`, { method: "GET" })).members };
+		const applicationPath = (lineId, memberId) => `/v1/hub/lines/${encodeURIComponent(lineId)}/members/${encodeURIComponent(memberId)}/application`;
+		this.memberApplications = {
+			get: async (lineId, memberId) => await this.request(applicationPath(lineId, memberId), { method: "GET" }),
+			select: async (lineId, memberId, input) => (await this.request(applicationPath(lineId, memberId), jsonInit("PUT", input))).selection,
+			clear: async (lineId, memberId, input) => {
+				await this.request(applicationPath(lineId, memberId), jsonInit("DELETE", input));
+			}
+		};
+		this.checkins = { schedule: (cron, options) => {
+			const name = options.name ?? `line-checkin-${crypto.randomUUID().slice(0, 8)}`;
+			const yaml = [
+				`name: ${JSON.stringify(name)}`,
+				"on:",
+				scheduleYaml(cron, options.timezone, options.until),
+				"do:",
+				"  - agent.run:",
+				"      line:",
+				`        id: ${JSON.stringify(options.lineId)}`,
+				`        member: ${JSON.stringify(options.member)}`,
+				`      prompt: ${JSON.stringify(options.prompt)}`
+			].join("\n");
+			return this.createWorkflow(yaml);
+		} };
+	}
+	async scheduleSend(cron, options) {
+		const name = options.name ?? `line-send-${crypto.randomUUID().slice(0, 8)}`;
+		const yaml = [
+			`name: ${JSON.stringify(name)}`,
+			"on:",
+			scheduleYaml(cron, options.timezone, options.until),
+			"do:",
+			"  - line.send:",
+			`      lineId: ${JSON.stringify(options.lineId)}`,
+			`      memberId: ${JSON.stringify(options.memberId)}`,
+			`      text: ${JSON.stringify(options.text)}`,
+			...options.notBefore ? [`      notBefore: ${JSON.stringify(options.notBefore)}`] : []
+		].join("\n");
+		return this.createWorkflow(yaml);
+	}
+	async context() {
+		return this.request("/v1/hub/lines/context", { method: "GET" });
+	}
+	async send(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/send`, jsonInit("POST", input));
+	}
+	/** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+	async sentMessage(lineId, messageId) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/outbox/${encodeURIComponent(messageId)}`, { method: "GET" });
+	}
+	async remind(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/remind`, jsonInit("POST", input));
+	}
+	async applicationDispatchCurrent(lineId, messageId, input, callbackBearer) {
+		if (!this.requestApplicationDispatchCurrent) throw new Error("Use HubClient to check application dispatch authority");
+		return (await this.requestApplicationDispatchCurrent(`/v1/hub/lines/${encodeURIComponent(lineId)}/messages/${encodeURIComponent(messageId)}/application-dispatch/current`, jsonInit("POST", input), callbackBearer)).current;
+	}
+};
+//#endregion
+//#region src/managed-numbers.ts
+/** Administrative number operations through Hub's authenticated transport.
+* A mutation is one attempt; an uncertain create reuses its quote and reference. */
+var HubManagedNumbersClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	readiness() {
+		return this.request("/v1/hub/numbers/readiness", { method: "GET" });
+	}
+	/** One page of orders. Scope by `clientReference` to ask about one binding,
+	* and follow `nextCursor` for the rest; a page is never ownership evidence. */
+	list(query = {}) {
+		const params = new URLSearchParams();
+		if (query.clientReference !== void 0) params.set("clientReference", query.clientReference);
+		if (query.cursor !== void 0) params.set("cursor", query.cursor);
+		if (query.limit !== void 0) params.set("limit", String(query.limit));
+		const search = params.toString();
+		return this.request(`/v1/hub/numbers${search ? `?${search}` : ""}`, { method: "GET" });
+	}
+	get(id) {
+		return this.request(this.path(id), { method: "GET" });
+	}
+	quote(input) {
+		return this.request("/v1/hub/numbers/quote", this.post(input));
+	}
+	/** `clientReference` and `transport`, when given, must match the signed
+	* quote or Hub refuses the purchase with a conflict. */
+	create(input) {
+		return this.request("/v1/hub/numbers", this.post(input));
+	}
+	/** Fences references so no order can take them again. Call it as the last
+	* step before retiring the resource they name: a purchase that races the
+	* retirement is then refused (`409 number_reference_fenced`) instead of
+	* binding a line to a resource that is gone. Refused with
+	* `409 number_reference_held` while a live order holds one of them; cancel
+	* it first. A cancelled order no longer holds its reference, so the fence
+	* succeeds as soon as `cancel` returns, whether or not its release is still
+	* pending. Repeating a fence is harmless. */
+	fence(input) {
+		return this.request("/v1/hub/numbers/fences", this.post(input));
+	}
+	advance(id) {
+		return this.request(`${this.path(id)}/advance`, this.post({}));
+	}
+	cancel(id) {
+		return this.request(`${this.path(id)}/cancel`, this.post({}));
+	}
+	path(id) {
+		if (!/^num_[a-f0-9]{36}$/.test(id)) throw new Error("Invalid managed number order id");
+		return `/v1/hub/numbers/${encodeURIComponent(id)}`;
+	}
+	post(body) {
+		return jsonInit("POST", body);
+	}
+};
+//#endregion
 //#region src/redaction.ts
 const SECRET_KEY_PATTERN = /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;
-const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|gh[pousr]_)[A-Za-z0-9_=-]+\b/g;
+const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|lrc_|gh[pousr]_)[A-Za-z0-9_.=-]+\b/g;
 function redactHubValue(value) {
 	if (typeof value === "string") return value.replace(SECRET_VALUE_PATTERN, "[REDACTED]");
 	if (Array.isArray(value)) return value.map((item) => redactHubValue(item));
@@ -9,7 +319,7 @@ function redactHubValue(value) {
 	return value;
 }
 //#endregion
-//#region src/client.ts
+//#region src/transport.ts
 var HubSdkError = class extends Error {
 	code;
 	details;
@@ -26,16 +336,18 @@ function bodySnippet(body, max = 200) {
 	const trimmed = body.trim();
 	return trimmed.length > max ? `${trimmed.slice(0, max)}…` : trimmed;
 }
-function httpError(path, status, statusText, body, contentType) {
-	const suffix = statusText ? ` ${statusText}` : "";
+function httpError(path, status, statusText, body, contentType, omitResponseDetails = false) {
+	const suffix = !omitResponseDetails && statusText ? ` ${statusText}` : "";
 	return new HubSdkError({
 		code: `HUB_HTTP_${status}`,
 		message: `Hub request ${path} failed: HTTP ${status}${suffix}`,
 		details: {
 			status,
 			path,
-			contentType: contentType || null,
-			bodySnippet: bodySnippet(body)
+			...omitResponseDetails ? {} : {
+				contentType: contentType || null,
+				bodySnippet: bodySnippet(body)
+			}
 		}
 	}, { status });
 }
@@ -52,323 +364,134 @@ function isHubSuccessEnvelope(value) {
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
-/** Read a wire field as a string, or "" when the server sent anything else.
-*  `raw` is that field straight off the parsed payload, before any check. */
-function optString(raw) {
-	return typeof raw === "string" ? raw : "";
-}
-/** An agent iteration's terminal status (`iteration.ended`) — only ever
-*  succeeded/failed; an iteration is never guard-skipped. */
-function isIterationStatus(value) {
-	return value === "succeeded" || value === "failed";
-}
-/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
-*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
-*  accepted here so a skipped event is surfaced, not dropped as malformed. */
-function isActionFinishedStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "skipped";
-}
-/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
-*  (a user cancel) — a value neither the action nor iteration status checkers
-*  accept — so `run.done` uses this rather than them, which would drop a
-*  cancelled terminal event and hang the stream. */
-function isRunDoneStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "cancelled";
-}
-/**
-* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
-* run-stream event, validating the fields each variant declares rather than
-* blindly casting the wire payload. A frame that doesn't match its event's
-* shape (or an unknown event name) returns null so the consumer skips it — a
-* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
-* new server event kinds don't break older clients.
-*/
-function toRunStreamEvent(eventType, raw) {
-	if (eventType === "ping") return { type: "ping" };
-	if (!isRecord$1(raw)) return null;
-	switch (eventType) {
-		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
-			type: "snapshot",
-			run: raw
-		} : null;
-		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
-			type: "token",
-			actionIndex: raw.actionIndex,
-			delta: raw.delta,
-			at: optString(raw.at)
-		} : null;
-		case "run.done": return isRunDoneStatus(raw.status) ? {
-			type: "run.done",
-			status: raw.status,
-			error: typeof raw.error === "string" ? raw.error : null,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
-			type: "run.waiting",
-			decisionId: raw.decisionId,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
-			type: "action.started",
-			index: raw.index,
-			kind: raw.kind,
-			at: raw.at
-		} : null;
-		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "action.finished",
-			index: raw.index,
-			kind: raw.kind,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
-			...typeof raw.error === "string" ? { error: raw.error } : {}
-		} : null;
-		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
-			type: "iteration.started",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			at: raw.at,
-			...typeof raw.model === "string" ? { model: raw.model } : {}
-		} : null;
-		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "iteration.ended",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
-			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
-			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
-		} : null;
-		default: return null;
-	}
-}
-/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
-*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
-*  (AbortSignal.timeout). */
-function isAbortError(cause) {
-	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
-}
-/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
-*  Returns undefined when neither bound applies (no per-request abort needed). */
-function combineAbortSignals(caller, timeoutMs) {
-	const signals = [];
-	if (caller) signals.push(caller);
-	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
-	if (signals.length === 0) return void 0;
-	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-}
-/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
-*  abort so a cancelled wait leaves nothing pending. */
-function delay(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-			return;
-		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
-const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
-const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
-function resolveHubBaseUrl(env = readProcessEnv()) {
-	const raw = env[HUB_URL_ENV_VAR];
-	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
-		code: "HUB_CONFIG_MISSING",
-		message: `${HUB_URL_ENV_VAR} is required`,
-		details: { envVar: HUB_URL_ENV_VAR }
-	});
-	const trimmed = raw.trim();
-	try {
-		new URL(trimmed);
-	} catch {
-		throw new HubSdkError({
-			code: "HUB_CONFIG_INVALID",
-			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
-			details: { envVar: HUB_URL_ENV_VAR }
-		});
-	}
-	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
-}
-function resolveHubAuth(env = readProcessEnv()) {
-	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
-	if (present.length === 0) throw new HubSdkError({
-		code: "HUB_CONFIG_MISSING",
-		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	if (present.length > 1) throw new HubSdkError({
-		code: "HUB_CONFIG_INVALID",
-		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	return present[0];
-}
-function nonEmpty(value) {
-	if (value === void 0) return void 0;
-	const trimmed = value.trim();
-	return trimmed.length === 0 ? void 0 : trimmed;
-}
-function readProcessEnv() {
-	return globalThis.process?.env ?? {};
-}
-var HubClient = class HubClient {
+var HubTransport = class {
 	baseUrl;
 	fetch;
-	apiKey;
 	authHeaders;
-	connections;
-	channels;
-	eventSubscriptions;
-	permissions;
-	tokens;
-	tools;
-	approvals;
-	audit;
-	githubApp;
-	workflows;
+	#apiKey;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.apiKey = options.apiKey;
+		this.#apiKey = options.apiKey;
 		this.authHeaders = options.authHeaders;
 		this.fetch = options.fetch ?? fetch.bind(globalThis);
-		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
-		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
-		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
-		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
-		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
-		this.tools = new HubToolsClient((path, init) => this.request(path, init));
-		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
-		this.audit = new HubAuditClient((path, init) => this.request(path, init));
-		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
-		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
 	}
-	static fromEnv(options = {}) {
-		const env = options.env ?? readProcessEnv();
-		return new HubClient({
-			baseUrl: resolveHubBaseUrl(env),
-			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
-			authHeaders: options.authHeaders,
-			fetch: options.fetch
-		});
+	/** The API key this client authenticates with, when it has one. */
+	get apiKey() {
+		return this.#apiKey;
 	}
-	async status() {
-		return this.request("/v1/hub/status", { method: "GET" });
-	}
-	async request(path, init) {
+	async request(path, init, options = {}) {
+		const callerAuth = options.auth === "caller";
 		const response = await this.fetch(`${this.baseUrl}${path}`, {
 			...init,
-			headers: await this.buildHeaders(init.headers)
+			headers: await this.buildHeaders(init.headers, callerAuth)
 		});
 		const status = response.status;
 		const contentType = response.headers.get("content-type") ?? "";
 		const bodyText = await response.text();
-		if (!contentType.includes("application/json")) throw httpError(path, status, response.statusText, bodyText, contentType);
+		if (!contentType.includes("application/json")) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
 		let parsed;
 		try {
 			parsed = JSON.parse(bodyText);
 		} catch {
-			throw httpError(path, status, response.statusText, bodyText, contentType);
+			throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
 		}
-		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-		if (isHubSuccessEnvelope(parsed)) return parsed.data;
-		throw httpError(path, status, response.statusText, bodyText, contentType);
-	}
-	/**
-	* Open a streaming (Server-Sent Events) response and return its raw body.
-	* Shares auth-header building + `fetch` with {@link request}, but does NOT
-	* buffer or JSON-parse the body — the caller consumes the stream.
-	*
-	* A successful stream comes back as `text/event-stream`. Anything else is an
-	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-	* page); it is surfaced the same way {@link request} surfaces errors — a
-	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-	*/
-	async stream(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok || !contentType.includes("text/event-stream")) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
-				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
+		if (isHubErrorEnvelope(parsed)) {
+			if (callerAuth) throw new HubSdkError({
+				code: parsed.error.code,
+				message: `Hub request ${path} failed: HTTP ${status}`
+			}, { status });
+			throw new HubSdkError(parsed.error, { status });
 		}
-		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
-		return response.body;
-	}
-	/**
-	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-	* the artifact's own content type, not JSON. Error responses on such routes
-	* are still the standard envelope, so a failure surfaces exactly like
-	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-	* otherwise an `HUB_HTTP_<status>` transport error.
-	*/
-	async requestBytes(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
+		if (isHubSuccessEnvelope(parsed)) {
+			if (callerAuth && !response.ok) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+			if (options.validateData && !options.validateData(parsed.data)) throw new HubSdkError({
+				code: `HUB_HTTP_${status}`,
+				message: `Hub request ${path} returned invalid data`,
+				details: {
+					status,
+					path
 				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
+			}, { status });
+			return parsed.data;
 		}
-		return {
-			bytes: new Uint8Array(await response.arrayBuffer()),
-			contentType
-		};
+		throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
 	}
-	async buildHeaders(headers) {
-		const mergedHeaders = new Headers(headers);
-		if (!mergedHeaders.has("Accept")) mergedHeaders.set("Accept", "application/json");
-		if (this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
-		if (this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
+	async buildHeaders(headers, callerAuth = false) {
+		const mergedHeaders = new Headers({ Accept: "application/json" });
+		if (!callerAuth && this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
+		if (!callerAuth && this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
 		for (const [key, value] of new Headers(headers)) mergedHeaders.set(key, value);
 		return mergedHeaders;
 	}
-};
+};
+/** Decode a failed non-envelope response using the same redacted SDK errors. */
+async function throwHubResponseError(path, response, status, contentType) {
+	const bodyText = await response.text().catch(() => "");
+	if (contentType.includes("application/json")) {
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			parsed = void 0;
+		}
+		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
+	}
+	throw httpError(path, status, response.statusText, bodyText, contentType);
+}
+//#endregion
+//#region src/environment.ts
+const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
+const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
+const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
+function resolveHubBaseUrl(env = readProcessEnv()) {
+	const raw = env[HUB_URL_ENV_VAR];
+	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `${HUB_URL_ENV_VAR} is required`,
+		details: { envVar: HUB_URL_ENV_VAR }
+	});
+	const trimmed = raw.trim();
+	try {
+		new URL(trimmed);
+	} catch {
+		throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
+			details: { envVar: HUB_URL_ENV_VAR }
+		});
+	}
+	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
+}
+function resolveHubAuth(env = readProcessEnv()) {
+	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
+	if (present.length === 0) throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	if (present.length > 1) throw new HubSdkError({
+		code: "HUB_CONFIG_INVALID",
+		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	return present[0];
+}
+function nonEmpty(value) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+function readProcessEnv() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+//#region src/authorization.ts
 var HubTokensClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async mint(options) {
-		return this.request("/v1/hub/tokens", {
-			method: "POST",
-			body: JSON.stringify(options),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tokens", jsonInit("POST", options));
 	}
 	async list(options = {}) {
 		const searchParams = new URLSearchParams();
@@ -402,64 +525,56 @@ var HubPermissionsClient = class {
 		return this.request(`/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`, { method: "GET" });
 	}
 	async set(input) {
-		return this.request("/v1/hub/policies", {
-			method: "PUT",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies", jsonInit("PUT", input));
 	}
 	/** Reset an action to its default by deleting any stored override. */
 	async delete(input) {
-		return this.request("/v1/hub/policies", {
-			method: "DELETE",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies", jsonInit("DELETE", input));
 	}
 	/** Bulk-allow every write action of a connection's provider. Reads are
 	*  already allowed for sandbox agents; destructive actions stay `ask`.
 	*  Idempotent: actions with an existing policy are left untouched. */
 	async allowWrites(connectionId) {
-		return this.request("/v1/hub/policies/allow-writes", {
-			method: "POST",
-			body: JSON.stringify({ connectionId }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies/allow-writes", jsonInit("POST", { connectionId }));
 	}
 	/** Inverse of `allowWrites`: delete only the rows it created for this
 	*  connection. Manual per-action decisions are left intact. */
 	async revertWrites(connectionId) {
-		return this.request("/v1/hub/policies/revert-writes", {
-			method: "POST",
-			body: JSON.stringify({ connectionId }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/policies/revert-writes", jsonInit("POST", { connectionId }));
+	}
+};
+var HubApprovalsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/approvals", { method: "GET" });
+	}
+	async approve(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	}
+	async deny(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
 	}
 };
+//#endregion
+//#region src/tools.ts
 var HubToolsClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async search(query, options = {}) {
-		return this.request("/v1/hub/tools/search", {
-			method: "POST",
-			body: JSON.stringify({
-				query,
-				provider: options.provider,
-				limit: options.limit
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tools/search", jsonInit("POST", {
+			query,
+			provider: options.provider,
+			limit: options.limit
+		}));
 	}
 	async sources() {
 		return this.request("/v1/hub/tools/sources", { method: "GET" });
 	}
 	async describe(path) {
-		return this.request("/v1/hub/tools/describe", {
-			method: "POST",
-			body: JSON.stringify({ path }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/tools/describe", jsonInit("POST", { path }));
 	}
 	/**
 	* Run one hub tool. `raw` is the tool input: the SDK forwards it verbatim as
@@ -472,8 +587,9 @@ var HubToolsClient = class {
 			return await this.request("/v1/hub/exec", execInit);
 		} catch (error) {
 			if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) throw error;
+			const approvalId = getApprovalId(error);
+			if (approvalId && options.approve !== true) throw error;
 			if (options.approve) {
-				const approvalId = getApprovalId(error);
 				if (!approvalId) throw error;
 				const approved = await this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
 				validateApprovedExecution(approved, path, options.connectionId);
@@ -491,15 +607,11 @@ var HubToolsClient = class {
 				});
 			}
 		}
-		const minted = await this.request("/v1/hub/tokens", {
-			method: "POST",
-			body: JSON.stringify({
-				actionPath: path,
-				connectionId: options.connectionId,
-				provider: options.connectionId ? void 0 : path.split(".")[0]
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		const minted = await this.request("/v1/hub/tokens", jsonInit("POST", {
+			actionPath: path,
+			connectionId: options.connectionId,
+			provider: options.connectionId ? void 0 : path.split(".")[0]
+		}));
 		return this.request("/v1/hub/exec", {
 			...execInit,
 			headers: {
@@ -509,16 +621,12 @@ var HubToolsClient = class {
 		});
 	}
 	buildExecInit(path, raw, options) {
-		return {
-			method: "POST",
-			body: JSON.stringify({
-				path,
-				input: raw,
-				connectionId: options.connectionId,
-				idempotencyKey: options.idempotencyKey
-			}),
-			headers: { "Content-Type": "application/json" }
-		};
+		return jsonInit("POST", {
+			path,
+			input: raw,
+			connectionId: options.connectionId,
+			idempotencyKey: options.idempotencyKey
+		});
 	}
 };
 function requiresCapabilityToken(error) {
@@ -548,45 +656,50 @@ function validateApprovedExecution(approved, path, connectionId) {
 		}
 	});
 }
-var HubChannelsClient = class {
+//#endregion
+//#region src/inbound-webhooks.ts
+var HubInboundWebhooksClient = class {
 	constructor(request) {
 		this.request = request;
 	}
-	async list() {
-		return this.request("/v1/hub/channels", { method: "GET" });
-	}
-	async createEmail(input = {}) {
-		return this.request("/v1/hub/channels/email", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	async delete(channelId) {
-		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
+	async create(connectionId, options = {}) {
+		return this.request(this.path(connectionId), jsonInit("POST", options));
 	}
-};
-var HubEventSubscriptionsClient = class {
-	constructor(request) {
-		this.request = request;
+	async get(connectionId) {
+		return this.request(this.path(connectionId), { method: "GET" });
 	}
-	async list() {
-		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	/** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+	async ensurePhoneNumber(connectionId, phoneNumberId) {
+		if (!phoneNumberId || phoneNumberId.length > 128 || !/^[\x21-\x7e]+$/.test(phoneNumberId)) throw new Error("A bounded phone-number id is required");
+		return this.request(`${this.path(connectionId)}/phone-numbers/ensure`, jsonInit("POST", { phoneNumberId }));
 	}
-	async create(input) {
-		return this.request("/v1/hub/event-subscriptions", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+	/** Remove event subscriptions first. This does not silently rotate a live URL. */
+	async delete(connectionId) {
+		return this.request(this.path(connectionId), { method: "DELETE" });
 	}
-	async delete(subscriptionId) {
-		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
+	path(connectionId) {
+		if (!connectionId || connectionId.length > 256) throw new Error("A bounded connection id is required");
+		return `/v1/hub/connections/${encodeURIComponent(connectionId)}/inbound-webhook`;
 	}
 };
+//#endregion
+//#region src/connections.ts
+const GITHUB_EXACT_CONNECT_SCOPES = [
+	"read:user",
+	"repo",
+	"read:org"
+];
+function sameOAuthScopeSet(left, right) {
+	if (!Array.isArray(left)) return false;
+	const leftSet = new Set(left);
+	const rightSet = new Set(right);
+	return leftSet.size === left.length && rightSet.size === right.length && leftSet.size === rightSet.size && [...leftSet].every((scope) => rightSet.has(scope));
+}
 var HubConnectionsClient = class {
+	inboundWebhook;
 	constructor(request) {
 		this.request = request;
+		this.inboundWebhook = new HubInboundWebhooksClient(request);
 	}
 	async list() {
 		return this.request("/v1/hub/connections", { method: "GET" });
@@ -598,40 +711,38 @@ var HubConnectionsClient = class {
 		return this.request("/v1/hub/providers", { method: "GET" });
 	}
 	async start(provider, options = {}) {
-		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, {
-			method: "POST",
-			body: JSON.stringify({
-				returnUrl: options.returnUrl,
-				cli: options.cli,
-				connectionParameters: options.connectionParameters
-			}),
-			headers: { "Content-Type": "application/json" }
+		if (options.requestedScopes !== void 0 && (provider !== "github" || !sameOAuthScopeSet(options.requestedScopes, GITHUB_EXACT_CONNECT_SCOPES))) throw new HubSdkError({
+			code: "HUB_INVALID_INPUT",
+			message: "GitHub requestedScopes must be read:user, repo, and read:org"
+		});
+		const started = await this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, jsonInit("POST", {
+			returnUrl: options.returnUrl,
+			cli: options.cli,
+			connectionParameters: options.connectionParameters,
+			requestedScopes: options.requestedScopes
+		}));
+		if (options.requestedScopes !== void 0 && (started.provider !== provider || !sameOAuthScopeSet(started.scopes, options.requestedScopes))) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Hub did not preserve the requested OAuth scopes"
 		});
+		return started;
 	}
 	async startWhatsappEmbeddedSignup(options = {}) {
-		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/start", {
-			method: "POST",
-			body: JSON.stringify({ returnUrl: options.returnUrl }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/start", jsonInit("POST", { returnUrl: options.returnUrl }));
 	}
 	async completeWhatsappEmbeddedSignup(input) {
-		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/complete", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/complete", jsonInit("POST", input));
 	}
 	/** Connect a non-OAuth (api-key) connector by submitting the user's key.
 	*  The server validates the key with a live probe before persisting and
 	*  returns the created (or reconnected) connection — there is no redirect,
-	*  unlike `start`. */
-	async connectApiKey(provider, apiKey) {
-		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`, {
-			method: "POST",
-			body: JSON.stringify({ apiKey }),
-			headers: { "Content-Type": "application/json" }
-		});
+	*  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+	*  requires listing ID/PMS pairs; other providers have no metadata. */
+	async connectApiKey(provider, apiKey, metadata) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`, jsonInit("POST", {
+			apiKey,
+			...metadata === void 0 ? {} : { metadata }
+		}));
 	}
 	async revoke(connectionId) {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
@@ -640,30 +751,44 @@ var HubConnectionsClient = class {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
 	}
 };
-var HubApprovalsClient = class {
+//#endregion
+//#region src/channels.ts
+var HubChannelsClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async list() {
-		return this.request("/v1/hub/approvals", { method: "GET" });
+		return this.request("/v1/hub/channels", { method: "GET" });
 	}
-	async approve(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	async createEmail(input = {}) {
+		return this.request("/v1/hub/channels/email", jsonInit("POST", input));
 	}
-	async deny(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	async delete(channelId) {
+		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
 	}
 };
+var HubEventSubscriptionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	}
+	async create(input) {
+		return this.request("/v1/hub/event-subscriptions", jsonInit("POST", input));
+	}
+	async delete(subscriptionId) {
+		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/github-app.ts
 var HubGithubAppClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async mintInstallationToken(input) {
-		return this.request("/v1/hub/github-app/mint-installation-token", {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/hub/github-app/mint-installation-token", jsonInit("POST", input));
 	}
 	/** Every installation the caller may act through — their own and any org's
 	*  they were verified against. The management surface's read. */
@@ -698,6 +823,8 @@ var HubGithubAppClient = class {
 		return this.request(`/v1/hub/github-app/is-repo-installed?${params.toString()}`, { method: "GET" });
 	}
 };
+//#endregion
+//#region src/audit.ts
 var HubAuditClient = class {
 	constructor(request) {
 		this.request = request;
@@ -715,9 +842,202 @@ var HubAuditClient = class {
 		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
 	}
 };
-var HubWorkflowsClient = class {
+//#endregion
+//#region src/workflow-run-events.ts
+/** Read a wire field as a string, or "" when the server sent anything else.
+*  `raw` is that field straight off the parsed payload, before any check. */
+function optString(raw) {
+	return typeof raw === "string" ? raw : "";
+}
+/** An agent iteration's terminal status (`iteration.ended`) — only ever
+*  succeeded/failed; an iteration is never guard-skipped. */
+function isIterationStatus(value) {
+	return value === "succeeded" || value === "failed";
+}
+/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
+*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
+*  accepted here so a skipped event is surfaced, not dropped as malformed. */
+function isActionFinishedStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "skipped";
+}
+/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
+*  (a user cancel) — a value neither the action nor iteration status checkers
+*  accept — so `run.done` uses this rather than them, which would drop a
+*  cancelled terminal event and hang the stream. */
+function isRunDoneStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "cancelled";
+}
+/**
+* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
+* run-stream event, validating the fields each variant declares rather than
+* blindly casting the wire payload. A frame that doesn't match its event's
+* shape (or an unknown event name) returns null so the consumer skips it — a
+* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
+* new server event kinds don't break older clients.
+*/
+function toRunStreamEvent(eventType, raw) {
+	if (eventType === "ping") return { type: "ping" };
+	if (!isRecord$1(raw)) return null;
+	switch (eventType) {
+		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
+			type: "snapshot",
+			run: raw
+		} : null;
+		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
+			type: "token",
+			actionIndex: raw.actionIndex,
+			delta: raw.delta,
+			at: optString(raw.at)
+		} : null;
+		case "run.done": return isRunDoneStatus(raw.status) ? {
+			type: "run.done",
+			status: raw.status,
+			error: typeof raw.error === "string" ? raw.error : null,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
+			type: "run.waiting",
+			decisionId: raw.decisionId,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
+			type: "action.started",
+			index: raw.index,
+			kind: raw.kind,
+			at: raw.at
+		} : null;
+		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "action.finished",
+			index: raw.index,
+			kind: raw.kind,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
+			...typeof raw.error === "string" ? { error: raw.error } : {}
+		} : null;
+		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
+			type: "iteration.started",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			at: raw.at,
+			...typeof raw.model === "string" ? { model: raw.model } : {}
+		} : null;
+		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "iteration.ended",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
+			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
+			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
+		} : null;
+		default: return null;
+	}
+}
+//#endregion
+//#region src/workflows-kv.ts
+/** The workflow's durable keyspace, shared by all its runs. */
+var WorkflowKvResource = class {
+	constructor(request) {
+		this.request = request;
+	}
+	/**
+	* The workflow's whole keyspace as metadata (key, version, updatedAt — never
+	* values), key-ordered. Bounded by the server's per-workflow key cap.
+	*/
+	async listKv(id) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv`, { method: "GET" });
+	}
+	/** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
+	async getKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "GET" });
+	}
+	/**
+	* Upsert a key; returns the entry with its NEW version (increments on every
+	* write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
+	* or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
+	* value, stored and read back verbatim, so the client never gives it a shape.
+	*/
+	async putKv(id, key, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, jsonInit("PUT", { value: raw }));
+	}
+	/**
+	* Compare-and-swap: the write lands only when the stored version still
+	* equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
+	* (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
+	* caller's value, stored and read back verbatim, so the client never gives it
+	* a shape.
+	*/
+	async casKv(id, key, expectedVersion, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}/cas`, jsonInit("POST", {
+			expectedVersion,
+			value: raw
+		}));
+	}
+	/** Delete a key; idempotent — `deleted` reports whether a row was removed. */
+	async deleteKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/workflows.ts
+/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
+*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
+*  (AbortSignal.timeout). */
+function isAbortError(cause) {
+	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
+}
+/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
+*  Returns undefined when neither bound applies (no per-request abort needed). */
+function combineAbortSignals(caller, timeoutMs) {
+	const signals = [];
+	if (caller) signals.push(caller);
+	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
+	if (signals.length === 0) return void 0;
+	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
+*  abort so a cancelled wait leaves nothing pending. */
+function delay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Wait before reopening a run event stream that a restart ended. */
+const STREAM_REOPEN_DELAY_MS = 1e3;
+/** Reopens in a row that deliver nothing before watchRun gives up. */
+const MAX_IDLE_STREAM_REOPENS = 30;
+function abortableDelay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+var HubWorkflowsClient = class extends WorkflowKvResource {
 	constructor(request, stream, download) {
-		this.request = request;
+		super(request);
 		this.stream = stream;
 		this.download = download;
 	}
@@ -738,11 +1058,7 @@ var HubWorkflowsClient = class {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "GET" });
 	}
 	async create(yaml) {
-		return this.request("/v1/workflows", {
-			method: "POST",
-			body: JSON.stringify({ yaml }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request("/v1/workflows", jsonInit("POST", { yaml }));
 	}
 	/**
 	* Replace the workflow's definition from YAML (recompiled server-side,
@@ -753,14 +1069,10 @@ var HubWorkflowsClient = class {
 	* concurrent modification, `NOT_FOUND` for an unknown/foreign id.
 	*/
 	async update(id, yaml, opts = {}) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, {
-			method: "PUT",
-			body: JSON.stringify({
-				yaml,
-				...opts.note !== void 0 ? { note: opts.note } : {}
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PUT", {
+			yaml,
+			...opts.note !== void 0 ? { note: opts.note } : {}
+		}));
 	}
 	async delete(id) {
 		await this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "DELETE" });
@@ -771,11 +1083,7 @@ var HubWorkflowsClient = class {
 	* via `update`, but it can still be paused/resumed here).
 	*/
 	async setEnabled(id, enabled) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, {
-			method: "PATCH",
-			body: JSON.stringify({ enabled }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PATCH", { enabled }));
 	}
 	/**
 	* One page of run history, newest first. Pass the previous page's
@@ -797,15 +1105,14 @@ var HubWorkflowsClient = class {
 	* `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
 	* workflow that reads no trigger fields. Throws `HubSdkError`:
 	* `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
-	* names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`
-	* for an unknown/foreign id. Pass `opts.signal` to abort a slow request.
+	* names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+	* still runs once; pausing only stops its triggers. Pass `opts.signal` to
+	* abort a slow request.
 	*/
 	async run(id, inputs, opts = {}) {
 		const hasInputs = inputs !== void 0 && Object.keys(inputs).length > 0;
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/run`, {
-			method: "POST",
-			body: JSON.stringify(hasInputs ? { inputs } : {}),
-			headers: { "Content-Type": "application/json" },
+			...jsonInit("POST", hasInputs ? { inputs } : {}),
 			...opts.signal ? { signal: opts.signal } : {}
 		});
 	}
@@ -845,8 +1152,8 @@ var HubWorkflowsClient = class {
 	* follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
 	* other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
 	* terminal-failed/cancelled (queued/running/waiting, or succeeded),
-	* `WORKFLOW_DISABLED` when the workflow has since been disabled, `NOT_FOUND`
-	* for an unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+	* `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+	* failure still retries. Pass `opts.signal` to abort a slow request.
 	*/
 	async retryRun(id, runId, opts = {}) {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/retry`, {
@@ -867,6 +1174,12 @@ var HubWorkflowsClient = class {
 	* poll) arrive — the persisted record, read via {@link getRun}, stays the
 	* source of truth. Pass `signal` to cancel; iterating to `run.done` (or
 	* breaking early) releases the connection.
+	*
+	* A stream that ends before `run.done` or `run.waiting` (the Platform is
+	* restarting or handing over) is reopened after a second, as is one refused
+	* with `SERVICE_DRAINING`; the reopened stream starts with a fresh
+	* `snapshot`. After 30 reopens in a row that deliver nothing it throws
+	* `HubSdkError(WORKFLOW_STREAM_INTERRUPTED)`.
 	*/
 	async *watchRun(id, runId, opts = {}) {
 		const openStream = this.stream;
@@ -874,7 +1187,37 @@ var HubWorkflowsClient = class {
 			code: "HUB_CONFIG_INVALID",
 			message: "watchRun needs a streaming transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly"
 		});
-		const reader = (await openStream(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`, {
+		const path = `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`;
+		let idleReopens = 0;
+		for (;;) {
+			let delivered = false;
+			const connection = this.watchRunOnce(openStream, path, opts);
+			try {
+				for (;;) {
+					const next = await connection.next();
+					if (next.done) {
+						if (next.value === "ended") return;
+						break;
+					}
+					delivered = true;
+					yield next.value;
+				}
+			} catch (error) {
+				if (!(error instanceof HubSdkError) || error.code !== "SERVICE_DRAINING" || opts.signal?.aborted) throw error;
+			} finally {
+				await connection.return("interrupted");
+			}
+			idleReopens = delivered ? 0 : idleReopens + 1;
+			if (idleReopens > MAX_IDLE_STREAM_REOPENS) throw new HubSdkError({
+				code: "WORKFLOW_STREAM_INTERRUPTED",
+				message: `the run event stream ended ${MAX_IDLE_STREAM_REOPENS} times without delivering an event`
+			});
+			await abortableDelay(STREAM_REOPEN_DELAY_MS, opts.signal);
+		}
+	}
+	/** One connection's events, then how it ended. */
+	async *watchRunOnce(openStream, path, opts) {
+		const reader = (await openStream(path, {
 			method: "GET",
 			headers: { Accept: "text/event-stream" },
 			...opts.signal ? { signal: opts.signal } : {}
@@ -896,9 +1239,9 @@ var HubWorkflowsClient = class {
 					const event = toRunStreamEvent(parsed.eventType, parsed.data);
 					if (!event) continue;
 					yield event;
-					if (event.type === "run.done" || event.type === "run.waiting") return;
+					if (event.type === "run.done" || event.type === "run.waiting") return "ended";
 				}
-				if (done) return;
+				if (done) return "interrupted";
 			}
 		} finally {
 			await reader.cancel().catch(() => {});
@@ -984,11 +1327,7 @@ var HubWorkflowsClient = class {
 	* YAML no longer compiles, `CONFLICT` on a concurrent modification.
 	*/
 	async rollback(id, rev) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/rollback`, {
-			method: "POST",
-			body: JSON.stringify({ rev }),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/rollback`, jsonInit("POST", { rev }));
 	}
 	/**
 	* Deterministic health stats over the workflow's last N terminal runs
@@ -1002,60 +1341,6 @@ var HubWorkflowsClient = class {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/health${query}`, { method: "GET" });
 	}
 	/**
-	* Propose a definition change — the intelligence path. SERVICE-TOKEN
-	* callers only (user principals get `HubSdkError(SERVICE_TOKEN_REQUIRED)`,
-	* 403). The YAML is compile-validated server-side (`WORKFLOW_INVALID` on
-	* failure) and appended as a `proposed` revision; the head NEVER advances
-	* until an owner approves.
-	*/
-	async propose(id, input) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals`, {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/**
-	* Pending (proposed) and declined (rejected) revisions, newest first, with
-	* their evidence — the approval surface's input.
-	*/
-	async listProposals(id) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals`, { method: "GET" });
-	}
-	/**
-	* Accept a proposal: its YAML lands as a NEW applied head revision through
-	* the same compile + advance path as {@link rollback} (re-validated against
-	* today's connections/models), and the proposal settles to `applied`.
-	* Throws `HubSdkError`: `PROPOSAL_NOT_PENDING` (409) when the rev is not a
-	* pending proposal, `WORKFLOW_INVALID` when it no longer compiles,
-	* `CONFLICT` on a concurrent modification.
-	*/
-	async approveProposal(id, rev) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals/${encodeURIComponent(String(rev))}/approve`, { method: "POST" });
-	}
-	/**
-	* Decline a proposal: the revision settles to `rejected` (head untouched);
-	* an optional reason is merged into its evidence as `rejectionReason`.
-	* Throws `HubSdkError(PROPOSAL_NOT_PENDING)` (409) when the rev is not a
-	* pending proposal.
-	*/
-	async rejectProposal(id, rev, opts = {}) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/proposals/${encodeURIComponent(String(rev))}/reject`, {
-			method: "POST",
-			body: JSON.stringify(opts.reason !== void 0 ? { reason: opts.reason } : {}),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/**
-	* Mint a fresh webhook hook token, retiring the current one immediately.
-	* The plaintext token is returned exactly once (only the hash is stored).
-	* Requires an active webhook trigger — otherwise `HubSdkError` with
-	* `NO_WEBHOOK_TRIGGER` (409).
-	*/
-	async rotateHookToken(id) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/hook-token/rotate`, { method: "POST" });
-	}
-	/**
 	* One agent round's execution timeline, paged. `action` is the action's
 	* `${steps[N]}` position and `iteration` the round's position in that
 	* action's `iterations` — both exactly as the run detail serializes them.
@@ -1106,51 +1391,6 @@ var HubWorkflowsClient = class {
 		});
 		return downloadBytes(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}`, { method: "GET" });
 	}
-	/**
-	* The workflow's whole keyspace as metadata (key, version, updatedAt — never
-	* values), key-ordered. Bounded by the server's per-workflow key cap.
-	*/
-	async listKv(id) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv`, { method: "GET" });
-	}
-	/** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
-	async getKv(id, key) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "GET" });
-	}
-	/**
-	* Upsert a key; returns the entry with its NEW version (increments on every
-	* write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
-	* or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
-	* value, stored and read back verbatim, so the client never gives it a shape.
-	*/
-	async putKv(id, key, raw) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, {
-			method: "PUT",
-			body: JSON.stringify({ value: raw }),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/**
-	* Compare-and-swap: the write lands only when the stored version still
-	* equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
-	* (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
-	* caller's value, stored and read back verbatim, so the client never gives it
-	* a shape.
-	*/
-	async casKv(id, key, expectedVersion, raw) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}/cas`, {
-			method: "POST",
-			body: JSON.stringify({
-				expectedVersion,
-				value: raw
-			}),
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-	/** Delete a key; idempotent — `deleted` reports whether a row was removed. */
-	async deleteKv(id, key) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "DELETE" });
-	}
 	/** The curated starter gallery runnable on THIS deployment: metadata,
 	*  parameters, referenced providers, and a concrete `previewYaml` per card. */
 	async listTemplates() {
@@ -1165,11 +1405,7 @@ var HubWorkflowsClient = class {
 	* (400); an unknown template id throws `NOT_FOUND`.
 	*/
 	async instantiateTemplate(templateId, parameters) {
-		return this.request(`/v1/workflows/templates/${encodeURIComponent(templateId)}/instantiate`, {
-			method: "POST",
-			body: JSON.stringify(parameters ? { parameters } : {}),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/templates/${encodeURIComponent(templateId)}/instantiate`, jsonInit("POST", parameters ? { parameters } : {}));
 	}
 	/**
 	* The caller's open decisions across all workflows — the always-available
@@ -1196,11 +1432,7 @@ var HubWorkflowsClient = class {
 	* (409 — answered, timed out, or cancelled first).
 	*/
 	async resolveRunDecision(id, runId, input) {
-		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision/resolve`, {
-			method: "POST",
-			body: JSON.stringify(input),
-			headers: { "Content-Type": "application/json" }
-		});
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision/resolve`, jsonInit("POST", input));
 	}
 	/**
 	* Dry-run a YAML definition against the platform compiler without saving it.
@@ -1213,17 +1445,203 @@ var HubWorkflowsClient = class {
 	* the unconnected providers is the point.
 	*/
 	async validate(yaml, opts = {}) {
-		return this.request("/v1/workflows/validate", {
+		return this.request("/v1/workflows/validate", jsonInit("POST", {
+			yaml,
+			...opts.structural ? { structural: true } : {}
+		}));
+	}
+	async schema() {
+		return this.request("/v1/workflows/schema", { method: "GET" });
+	}
+};
+//#endregion
+//#region src/client.ts
+function isDispatchCurrentData(value) {
+	return isRecord$1(value) && typeof value.current === "boolean";
+}
+var HubClient = class HubClient extends HubTransport {
+	knowledge;
+	allowances;
+	apps;
+	connections;
+	channels;
+	numbers;
+	eventSubscriptions;
+	permissions;
+	tokens;
+	tools;
+	approvals;
+	audit;
+	githubApp;
+	workflows;
+	lines;
+	constructor(options) {
+		super(options);
+		this.knowledge = new HubKnowledgeClient((path, init) => this.request(path, init));
+		this.allowances = new HubAllowancesClient((path, init) => this.request(path, init));
+		this.apps = new HubAppsClient((path, init) => this.request(path, init));
+		this.numbers = new HubManagedNumbersClient((path, init) => this.request(path, init));
+		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
+		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
+		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
+		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
+		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
+		this.audit = new HubAuditClient((path, init) => this.request(path, init));
+		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
+		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
+		this.lines = new HubLinesClient((path, init) => this.request(path, init), (yaml) => this.workflows.create(yaml), (path, init, callbackBearer) => {
+			if (typeof callbackBearer !== "string" || !/^[\x21-\x7e]{16,512}$/.test(callbackBearer)) throw new HubSdkError({
+				code: "HUB_INVALID_INPUT",
+				message: "Application callback bearer is invalid"
+			});
+			const headers = new Headers(init.headers);
+			headers.set("Authorization", `Bearer ${callbackBearer}`);
+			return this.request(path, {
+				...init,
+				headers,
+				credentials: "omit",
+				redirect: "manual"
+			}, {
+				auth: "caller",
+				validateData: isDispatchCurrentData
+			});
+		});
+	}
+	static fromEnv(options = {}) {
+		const env = options.env ?? readProcessEnv();
+		return new HubClient({
+			baseUrl: resolveHubBaseUrl(env),
+			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
+			authHeaders: options.authHeaders,
+			fetch: options.fetch
+		});
+	}
+	async status() {
+		return this.request("/v1/hub/status", { method: "GET" });
+	}
+	/**
+	* Open a streaming (Server-Sent Events) response and return its raw body.
+	* Shares auth-header building + `fetch` with {@link request}, but does NOT
+	* buffer or JSON-parse the body — the caller consumes the stream.
+	*
+	* A successful stream comes back as `text/event-stream`. Anything else is an
+	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+	* page); it is surfaced the same way {@link request} surfaces errors — a
+	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+	*/
+	async stream(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok || !contentType.includes("text/event-stream")) await throwHubResponseError(path, response, status, contentType);
+		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
+		return response.body;
+	}
+	/**
+	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+	* the artifact's own content type, not JSON. Error responses on such routes
+	* are still the standard envelope, so a failure surfaces exactly like
+	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+	* otherwise an `HUB_HTTP_<status>` transport error.
+	*/
+	async requestBytes(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok) await throwHubResponseError(path, response, status, contentType);
+		return {
+			bytes: new Uint8Array(await response.arrayBuffer()),
+			contentType
+		};
+	}
+};
+//#endregion
+//#region src/broker.ts
+/** Server-only client. App secrets never become a user's general API key.
+* Every invocation mints and consumes one short-lived, exact-grant token. */
+var HubAppBrokerClient = class {
+	baseUrl;
+	fetcher;
+	constructor(options) {
+		this.options = options;
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.fetcher = options.fetch ?? fetch.bind(globalThis);
+	}
+	async token(path, body) {
+		const response = await this.fetcher(`${this.baseUrl}${path}`, {
 			method: "POST",
+			redirect: "manual",
+			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({
-				yaml,
-				...opts.structural ? { structural: true } : {}
-			}),
-			headers: { "Content-Type": "application/json" }
+				...body,
+				client_id: this.options.clientId,
+				client_secret: this.options.clientSecret
+			})
+		});
+		const result = await response.json().catch(() => null);
+		if (!response.ok || !result || typeof result !== "object" || Array.isArray(result)) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Application authorization is unavailable"
+		}, { status: response.status });
+		return result;
+	}
+	readToken(body) {
+		if (typeof body.access_token !== "string" || !body.access_token.startsWith("sk-tan-broker-") || body.token_type !== "Bearer" || typeof body.expires_in !== "number" || !Number.isSafeInteger(body.expires_in) || body.expires_in <= 0 || typeof body.scope !== "string") throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Invalid application authorization response"
 		});
+		return {
+			accessToken: body.access_token,
+			expiresIn: body.expires_in,
+			scopes: body.scope.split(" ").filter(Boolean)
+		};
 	}
-	async schema() {
-		return this.request("/v1/workflows/schema", { method: "GET" });
+	async exchange(input) {
+		const body = await this.token("/v1/apps/oauth/token", {
+			grant_type: "authorization_code",
+			code: input.code,
+			redirect_uri: input.redirectUri,
+			...input.connectionId === void 0 ? {} : { connection_id: input.connectionId },
+			ttl_seconds: 60
+		});
+		const token = this.readToken(body);
+		if (typeof body.grant_id !== "string" || !body.grant_id || typeof body.connection_id !== "string" || !body.connection_id.trim() || input.connectionId !== void 0 && body.connection_id !== input.connectionId) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Application connection did not match consent"
+		});
+		return {
+			...token,
+			grantId: body.grant_id,
+			connectionId: body.connection_id
+		};
+	}
+	async mint(grantId) {
+		if (!/^[A-Za-z0-9_-]{1,256}$/.test(grantId)) throw new Error("Invalid application grant");
+		return this.readToken(await this.token(`/v1/apps/grants/${encodeURIComponent(grantId)}/mint-broker-token`, {
+			grant_id: grantId,
+			ttl_seconds: 60
+		}));
+	}
+	async invoke(grantId, connectionId, actionPath, input) {
+		const token = await this.mint(grantId);
+		if (!token.scopes.includes(actionPath)) throw new HubSdkError({
+			code: "HUB_POLICY_DENIED",
+			message: "This action was not granted to the application"
+		});
+		return new HubClient({
+			baseUrl: this.baseUrl,
+			apiKey: token.accessToken,
+			fetch: this.fetcher
+		}).tools.invoke(actionPath, input, { connectionId });
 	}
 };
 //#endregion
@@ -1484,6 +1902,93 @@ function requestFailure(code, status, error, headers) {
 	};
 }
 //#endregion
-export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubApprovalsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+//#region src/knowledge-approval.ts
+/** Called only after the owner reviews this exact pending effect and clicks
+* Approve. Re-read first: a stale tab cannot approve a substituted operation. */
+async function approveKnowledgeSource(input) {
+	const { source, port, approvals } = input;
+	if (source.status !== "awaiting-approval" || !source.approval || !source.refreshRequestId || source.approval.preview.sourceId !== source.id || source.approval.preview.requestId !== source.refreshRequestId) throw new Error("This source has no reviewable pending action. Reload knowledge.");
+	const current = await port.get(source.id);
+	if (current.id !== source.id || current.status !== "awaiting-approval" || current.refreshRequestId !== source.refreshRequestId || JSON.stringify(current.approval) !== JSON.stringify(source.approval)) throw new Error("The requested action changed. Reload knowledge and review it again.");
+	let approvalToken;
+	try {
+		const decision = await approvals.approve(source.approval.id);
+		if (decision.approval.id !== source.approval.id || decision.approval.actionPath !== source.approval.path || decision.approval.connectionId !== source.approval.preview.connectionId || decision.approval.providerId !== source.approval.preview.provider || decision.approval.status !== "consumed" || !decision.capabilityToken?.token) throw new Error("The approval did not return a matching one-time capability. Reload knowledge.");
+		approvalToken = decision.capabilityToken.token;
+		return await port.refresh(source.id, {
+			requestId: source.refreshRequestId,
+			approvalToken
+		});
+	} finally {
+		approvalToken = void 0;
+	}
+}
+//#endregion
+//#region src/line-grants.ts
+function path(binding, suffix = "") {
+	if (!binding.workspaceId || !binding.workspaceAgentId) throw new Error("A workspace and agent are required for a line grant");
+	return `/v1/hub/line-grants/current${suffix}?${new URLSearchParams({
+		workspaceId: binding.workspaceId,
+		workspaceAgentId: binding.workspaceAgentId
+	})}`;
+}
+/** Every call uses HubTransport's authHeaders, so one-use app broker tokens can be minted per request. */
+var HubLineGrantsClient = class extends HubTransport {
+	current(binding) {
+		return this.request(path(binding), { method: "GET" });
+	}
+	async line(binding) {
+		return (await this.request(path(binding, "/line"), { method: "GET" })).line;
+	}
+	async attach(binding, input) {
+		return (await this.request(path(binding, "/attachment"), jsonInit("PUT", input))).attachment;
+	}
+	detach(binding) {
+		return this.request(path(binding, "/attachment"), { method: "DELETE" });
+	}
+	async threads(binding) {
+		return (await this.request(path(binding, "/threads"), { method: "GET" })).threads;
+	}
+	async messages(binding, threadId) {
+		if (!threadId || threadId.length > 256) throw new Error("A bounded line thread id is required");
+		return (await this.request(path(binding, `/threads/${encodeURIComponent(threadId)}/messages`), { method: "GET" })).messages;
+	}
+	memberApplication(binding) {
+		return this.request(path(binding, "/member-application"), { method: "GET" });
+	}
+	/**
+	* Route the owner's texts to this app's callback; the incumbent attachment
+	* stays. `replaceSelectionId` moves them from another app on the owner's
+	* explicit choice.
+	*/
+	async selectApplication(binding, input) {
+		return (await this.request(path(binding, "/member-application"), jsonInit("PUT", input))).selection;
+	}
+	/** Return the owner's texts to the incumbent attachment. */
+	async clearApplication(binding, input) {
+		await this.request(path(binding, "/member-application"), jsonInit("DELETE", input));
+	}
+	/** Ask only the verified owner member named by this owner_asks grant. */
+	send(binding, input) {
+		return this.request(path(binding, "/send"), jsonInit("POST", input));
+	}
+	/** Only a send created by this same grant is visible. */
+	outbox(binding, messageId) {
+		if (!/^lmsg_[A-Za-z0-9_-]+$/.test(messageId)) throw new Error("A line message id is required");
+		return this.request(path(binding, `/outbox/${encodeURIComponent(messageId)}`), { method: "GET" });
+	}
+	revoke(binding, expectedGrantId) {
+		const target = path(binding);
+		return this.request(expectedGrantId === void 0 ? target : `${target}&expectedGrantId=${encodeURIComponent(expectedGrantId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/workflow-definition-types.ts
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+function workflowConnectionRequirementKey(ref) {
+	return `${ref.kind}:${ref.provider}`;
+}
+//#endregion
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubAllowancesClient, HubAppBrokerClient, HubApprovalsClient, HubAppsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, HubLineGrantsClient, HubLinesClient, HubManagedNumbersClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature, workflowConnectionRequirementKey };
 
 //# sourceMappingURL=index.js.map