@tangle-network/hub-sdk 0.60.78-develop.20261017134105.a6b32a2 → 0.60.78-develop.20261021225232.c7da8cb

package/dist/index.js

@@ -111,32 +111,6 @@ var HubAppsClient = class {
 	}
 };
 //#endregion
-//#region src/inbound-webhooks.ts
-var HubInboundWebhooksClient = class {
-	constructor(request) {
-		this.request = request;
-	}
-	async create(connectionId, options = {}) {
-		return this.request(this.path(connectionId), jsonInit("POST", options));
-	}
-	async get(connectionId) {
-		return this.request(this.path(connectionId), { method: "GET" });
-	}
-	/** Add one owned Linq WhatsApp number without rotating the webhook secret. */
-	async ensurePhoneNumber(connectionId, phoneNumberId) {
-		if (!phoneNumberId || phoneNumberId.length > 128 || !/^[\x21-\x7e]+$/.test(phoneNumberId)) throw new Error("A bounded phone-number id is required");
-		return this.request(`${this.path(connectionId)}/phone-numbers/ensure`, jsonInit("POST", { phoneNumberId }));
-	}
-	/** Remove event subscriptions first. This does not silently rotate a live URL. */
-	async delete(connectionId) {
-		return this.request(this.path(connectionId), { method: "DELETE" });
-	}
-	path(connectionId) {
-		if (!connectionId || connectionId.length > 256) throw new Error("A bounded connection id is required");
-		return `/v1/hub/connections/${encodeURIComponent(connectionId)}/inbound-webhook`;
-	}
-};
-//#endregion
 //#region src/knowledge-management.ts
 var HubKnowledgeManagementClient = class {
 	constructor(request) {
@@ -345,7 +319,7 @@ function redactHubValue(value) {
 	return value;
 }
 //#endregion
-//#region src/client.ts
+//#region src/transport.ts
 var HubSdkError = class extends Error {
 	code;
 	details;
@@ -390,190 +364,21 @@ function isHubSuccessEnvelope(value) {
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
-function isDispatchCurrentData(value) {
-	return isRecord$1(value) && typeof value.current === "boolean";
-}
-/** Read a wire field as a string, or "" when the server sent anything else.
-*  `raw` is that field straight off the parsed payload, before any check. */
-function optString(raw) {
-	return typeof raw === "string" ? raw : "";
-}
-/** An agent iteration's terminal status (`iteration.ended`) — only ever
-*  succeeded/failed; an iteration is never guard-skipped. */
-function isIterationStatus(value) {
-	return value === "succeeded" || value === "failed";
-}
-/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
-*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
-*  accepted here so a skipped event is surfaced, not dropped as malformed. */
-function isActionFinishedStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "skipped";
-}
-/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
-*  (a user cancel) — a value neither the action nor iteration status checkers
-*  accept — so `run.done` uses this rather than them, which would drop a
-*  cancelled terminal event and hang the stream. */
-function isRunDoneStatus(value) {
-	return value === "succeeded" || value === "failed" || value === "cancelled";
-}
-/**
-* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
-* run-stream event, validating the fields each variant declares rather than
-* blindly casting the wire payload. A frame that doesn't match its event's
-* shape (or an unknown event name) returns null so the consumer skips it — a
-* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
-* new server event kinds don't break older clients.
-*/
-function toRunStreamEvent(eventType, raw) {
-	if (eventType === "ping") return { type: "ping" };
-	if (!isRecord$1(raw)) return null;
-	switch (eventType) {
-		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
-			type: "snapshot",
-			run: raw
-		} : null;
-		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
-			type: "token",
-			actionIndex: raw.actionIndex,
-			delta: raw.delta,
-			at: optString(raw.at)
-		} : null;
-		case "run.done": return isRunDoneStatus(raw.status) ? {
-			type: "run.done",
-			status: raw.status,
-			error: typeof raw.error === "string" ? raw.error : null,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
-			type: "run.waiting",
-			decisionId: raw.decisionId,
-			...typeof raw.at === "string" ? { at: raw.at } : {}
-		} : null;
-		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
-			type: "action.started",
-			index: raw.index,
-			kind: raw.kind,
-			at: raw.at
-		} : null;
-		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "action.finished",
-			index: raw.index,
-			kind: raw.kind,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
-			...typeof raw.error === "string" ? { error: raw.error } : {}
-		} : null;
-		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
-			type: "iteration.started",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			at: raw.at,
-			...typeof raw.model === "string" ? { model: raw.model } : {}
-		} : null;
-		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
-			type: "iteration.ended",
-			actionIndex: raw.actionIndex,
-			iterationIndex: raw.iterationIndex,
-			status: raw.status,
-			at: raw.at,
-			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
-			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
-			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
-			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
-		} : null;
-		default: return null;
-	}
-}
-/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
-*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
-*  (AbortSignal.timeout). */
-function isAbortError(cause) {
-	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
-}
-/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
-*  Returns undefined when neither bound applies (no per-request abort needed). */
-function combineAbortSignals(caller, timeoutMs) {
-	const signals = [];
-	if (caller) signals.push(caller);
-	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
-	if (signals.length === 0) return void 0;
-	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-}
-/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
-*  abort so a cancelled wait leaves nothing pending. */
-function delay(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-			return;
-		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
-const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
-const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
-function resolveHubBaseUrl(env = readProcessEnv()) {
-	const raw = env[HUB_URL_ENV_VAR];
-	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
-		code: "HUB_CONFIG_MISSING",
-		message: `${HUB_URL_ENV_VAR} is required`,
-		details: { envVar: HUB_URL_ENV_VAR }
-	});
-	const trimmed = raw.trim();
-	try {
-		new URL(trimmed);
-	} catch {
-		throw new HubSdkError({
-			code: "HUB_CONFIG_INVALID",
-			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
-			details: { envVar: HUB_URL_ENV_VAR }
-		});
-	}
-	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
-}
-function resolveHubAuth(env = readProcessEnv()) {
-	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
-	if (present.length === 0) throw new HubSdkError({
-		code: "HUB_CONFIG_MISSING",
-		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	if (present.length > 1) throw new HubSdkError({
-		code: "HUB_CONFIG_INVALID",
-		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
-		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
-	});
-	return present[0];
-}
-function nonEmpty(value) {
-	if (value === void 0) return void 0;
-	const trimmed = value.trim();
-	return trimmed.length === 0 ? void 0 : trimmed;
-}
-function readProcessEnv() {
-	return globalThis.process?.env ?? {};
-}
 var HubTransport = class {
 	baseUrl;
 	fetch;
-	apiKey;
 	authHeaders;
+	#apiKey;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.apiKey = options.apiKey;
+		this.#apiKey = options.apiKey;
 		this.authHeaders = options.authHeaders;
 		this.fetch = options.fetch ?? fetch.bind(globalThis);
 	}
+	/** The API key this client authenticates with, when it has one. */
+	get apiKey() {
+		return this.#apiKey;
+	}
 	async request(path, init, options = {}) {
 		const callerAuth = options.auth === "caller";
 		const response = await this.fetch(`${this.baseUrl}${path}`, {
@@ -619,135 +424,68 @@ var HubTransport = class {
 		return mergedHeaders;
 	}
 };
-var HubClient = class HubClient extends HubTransport {
-	knowledge;
-	allowances;
-	apps;
-	connections;
-	channels;
-	numbers;
-	eventSubscriptions;
-	permissions;
-	tokens;
-	tools;
-	approvals;
-	audit;
-	githubApp;
-	workflows;
-	lines;
-	constructor(options) {
-		super(options);
-		this.knowledge = new HubKnowledgeClient((path, init) => this.request(path, init));
-		this.allowances = new HubAllowancesClient((path, init) => this.request(path, init));
-		this.apps = new HubAppsClient((path, init) => this.request(path, init));
-		this.numbers = new HubManagedNumbersClient((path, init) => this.request(path, init));
-		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
-		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
-		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
-		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
-		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
-		this.tools = new HubToolsClient((path, init) => this.request(path, init));
-		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
-		this.audit = new HubAuditClient((path, init) => this.request(path, init));
-		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
-		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
-		this.lines = new HubLinesClient((path, init) => this.request(path, init), (yaml) => this.workflows.create(yaml), (path, init, callbackBearer) => {
-			if (typeof callbackBearer !== "string" || !/^[\x21-\x7e]{16,512}$/.test(callbackBearer)) throw new HubSdkError({
-				code: "HUB_INVALID_INPUT",
-				message: "Application callback bearer is invalid"
-			});
-			const headers = new Headers(init.headers);
-			headers.set("Authorization", `Bearer ${callbackBearer}`);
-			return this.request(path, {
-				...init,
-				headers,
-				credentials: "omit",
-				redirect: "manual"
-			}, {
-				auth: "caller",
-				validateData: isDispatchCurrentData
-			});
-		});
-	}
-	static fromEnv(options = {}) {
-		const env = options.env ?? readProcessEnv();
-		return new HubClient({
-			baseUrl: resolveHubBaseUrl(env),
-			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
-			authHeaders: options.authHeaders,
-			fetch: options.fetch
-		});
-	}
-	async status() {
-		return this.request("/v1/hub/status", { method: "GET" });
-	}
-	/**
-	* Open a streaming (Server-Sent Events) response and return its raw body.
-	* Shares auth-header building + `fetch` with {@link request}, but does NOT
-	* buffer or JSON-parse the body — the caller consumes the stream.
-	*
-	* A successful stream comes back as `text/event-stream`. Anything else is an
-	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-	* page); it is surfaced the same way {@link request} surfaces errors — a
-	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-	*/
-	async stream(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
-		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok || !contentType.includes("text/event-stream")) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
-				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
+/** Decode a failed non-envelope response using the same redacted SDK errors. */
+async function throwHubResponseError(path, response, status, contentType) {
+	const bodyText = await response.text().catch(() => "");
+	if (contentType.includes("application/json")) {
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			parsed = void 0;
 		}
-		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
-		return response.body;
+		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
 	}
-	/**
-	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-	* the artifact's own content type, not JSON. Error responses on such routes
-	* are still the standard envelope, so a failure surfaces exactly like
-	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-	* otherwise an `HUB_HTTP_<status>` transport error.
-	*/
-	async requestBytes(path, init) {
-		const response = await this.fetch(`${this.baseUrl}${path}`, {
-			...init,
-			headers: await this.buildHeaders(init.headers)
+	throw httpError(path, status, response.statusText, bodyText, contentType);
+}
+//#endregion
+//#region src/environment.ts
+const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
+const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
+const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
+function resolveHubBaseUrl(env = readProcessEnv()) {
+	const raw = env[HUB_URL_ENV_VAR];
+	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `${HUB_URL_ENV_VAR} is required`,
+		details: { envVar: HUB_URL_ENV_VAR }
+	});
+	const trimmed = raw.trim();
+	try {
+		new URL(trimmed);
+	} catch {
+		throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
+			details: { envVar: HUB_URL_ENV_VAR }
 		});
-		const status = response.status;
-		const contentType = response.headers.get("content-type") ?? "";
-		if (!response.ok) {
-			const bodyText = await response.text().catch(() => "");
-			if (contentType.includes("application/json")) {
-				let parsed;
-				try {
-					parsed = JSON.parse(bodyText);
-				} catch {
-					parsed = void 0;
-				}
-				if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
-			}
-			throw httpError(path, status, response.statusText, bodyText, contentType);
-		}
-		return {
-			bytes: new Uint8Array(await response.arrayBuffer()),
-			contentType
-		};
 	}
-};
+	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
+}
+function resolveHubAuth(env = readProcessEnv()) {
+	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
+	if (present.length === 0) throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	if (present.length > 1) throw new HubSdkError({
+		code: "HUB_CONFIG_INVALID",
+		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	return present[0];
+}
+function nonEmpty(value) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+function readProcessEnv() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+//#region src/authorization.ts
 var HubTokensClient = class {
 	constructor(request) {
 		this.request = request;
@@ -805,6 +543,22 @@ var HubPermissionsClient = class {
 		return this.request("/v1/hub/policies/revert-writes", jsonInit("POST", { connectionId }));
 	}
 };
+var HubApprovalsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/approvals", { method: "GET" });
+	}
+	async approve(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	}
+	async deny(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	}
+};
+//#endregion
+//#region src/tools.ts
 var HubToolsClient = class {
 	constructor(request) {
 		this.request = request;
@@ -902,6 +656,34 @@ function validateApprovedExecution(approved, path, connectionId) {
 		}
 	});
 }
+//#endregion
+//#region src/inbound-webhooks.ts
+var HubInboundWebhooksClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async create(connectionId, options = {}) {
+		return this.request(this.path(connectionId), jsonInit("POST", options));
+	}
+	async get(connectionId) {
+		return this.request(this.path(connectionId), { method: "GET" });
+	}
+	/** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+	async ensurePhoneNumber(connectionId, phoneNumberId) {
+		if (!phoneNumberId || phoneNumberId.length > 128 || !/^[\x21-\x7e]+$/.test(phoneNumberId)) throw new Error("A bounded phone-number id is required");
+		return this.request(`${this.path(connectionId)}/phone-numbers/ensure`, jsonInit("POST", { phoneNumberId }));
+	}
+	/** Remove event subscriptions first. This does not silently rotate a live URL. */
+	async delete(connectionId) {
+		return this.request(this.path(connectionId), { method: "DELETE" });
+	}
+	path(connectionId) {
+		if (!connectionId || connectionId.length > 256) throw new Error("A bounded connection id is required");
+		return `/v1/hub/connections/${encodeURIComponent(connectionId)}/inbound-webhook`;
+	}
+};
+//#endregion
+//#region src/connections.ts
 const GITHUB_EXACT_CONNECT_SCOPES = [
 	"read:user",
 	"repo",
@@ -913,34 +695,6 @@ function sameOAuthScopeSet(left, right) {
 	const rightSet = new Set(right);
 	return leftSet.size === left.length && rightSet.size === right.length && leftSet.size === rightSet.size && [...leftSet].every((scope) => rightSet.has(scope));
 }
-var HubChannelsClient = class {
-	constructor(request) {
-		this.request = request;
-	}
-	async list() {
-		return this.request("/v1/hub/channels", { method: "GET" });
-	}
-	async createEmail(input = {}) {
-		return this.request("/v1/hub/channels/email", jsonInit("POST", input));
-	}
-	async delete(channelId) {
-		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
-	}
-};
-var HubEventSubscriptionsClient = class {
-	constructor(request) {
-		this.request = request;
-	}
-	async list() {
-		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
-	}
-	async create(input) {
-		return this.request("/v1/hub/event-subscriptions", jsonInit("POST", input));
-	}
-	async delete(subscriptionId) {
-		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
-	}
-};
 var HubConnectionsClient = class {
 	inboundWebhook;
 	constructor(request) {
@@ -993,24 +747,42 @@ var HubConnectionsClient = class {
 	async revoke(connectionId) {
 		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
 	}
-	async health(connectionId) {
-		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
+	async health(connectionId) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
+	}
+};
+//#endregion
+//#region src/channels.ts
+var HubChannelsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/channels", { method: "GET" });
+	}
+	async createEmail(input = {}) {
+		return this.request("/v1/hub/channels/email", jsonInit("POST", input));
+	}
+	async delete(channelId) {
+		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
 	}
 };
-var HubApprovalsClient = class {
+var HubEventSubscriptionsClient = class {
 	constructor(request) {
 		this.request = request;
 	}
 	async list() {
-		return this.request("/v1/hub/approvals", { method: "GET" });
+		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
 	}
-	async approve(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	async create(input) {
+		return this.request("/v1/hub/event-subscriptions", jsonInit("POST", input));
 	}
-	async deny(approvalId) {
-		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	async delete(subscriptionId) {
+		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
 	}
 };
+//#endregion
+//#region src/github-app.ts
 var HubGithubAppClient = class {
 	constructor(request) {
 		this.request = request;
@@ -1051,6 +823,8 @@ var HubGithubAppClient = class {
 		return this.request(`/v1/hub/github-app/is-repo-installed?${params.toString()}`, { method: "GET" });
 	}
 };
+//#endregion
+//#region src/audit.ts
 var HubAuditClient = class {
 	constructor(request) {
 		this.request = request;
@@ -1068,6 +842,136 @@ var HubAuditClient = class {
 		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
 	}
 };
+//#endregion
+//#region src/workflow-run-events.ts
+/** Read a wire field as a string, or "" when the server sent anything else.
+*  `raw` is that field straight off the parsed payload, before any check. */
+function optString(raw) {
+	return typeof raw === "string" ? raw : "";
+}
+/** An agent iteration's terminal status (`iteration.ended`) — only ever
+*  succeeded/failed; an iteration is never guard-skipped. */
+function isIterationStatus(value) {
+	return value === "succeeded" || value === "failed";
+}
+/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
+*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
+*  accepted here so a skipped event is surfaced, not dropped as malformed. */
+function isActionFinishedStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "skipped";
+}
+/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
+*  (a user cancel) — a value neither the action nor iteration status checkers
+*  accept — so `run.done` uses this rather than them, which would drop a
+*  cancelled terminal event and hang the stream. */
+function isRunDoneStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "cancelled";
+}
+/**
+* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
+* run-stream event, validating the fields each variant declares rather than
+* blindly casting the wire payload. A frame that doesn't match its event's
+* shape (or an unknown event name) returns null so the consumer skips it — a
+* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
+* new server event kinds don't break older clients.
+*/
+function toRunStreamEvent(eventType, raw) {
+	if (eventType === "ping") return { type: "ping" };
+	if (!isRecord$1(raw)) return null;
+	switch (eventType) {
+		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
+			type: "snapshot",
+			run: raw
+		} : null;
+		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
+			type: "token",
+			actionIndex: raw.actionIndex,
+			delta: raw.delta,
+			at: optString(raw.at)
+		} : null;
+		case "run.done": return isRunDoneStatus(raw.status) ? {
+			type: "run.done",
+			status: raw.status,
+			error: typeof raw.error === "string" ? raw.error : null,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
+			type: "run.waiting",
+			decisionId: raw.decisionId,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
+			type: "action.started",
+			index: raw.index,
+			kind: raw.kind,
+			at: raw.at
+		} : null;
+		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "action.finished",
+			index: raw.index,
+			kind: raw.kind,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
+			...typeof raw.error === "string" ? { error: raw.error } : {}
+		} : null;
+		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
+			type: "iteration.started",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			at: raw.at,
+			...typeof raw.model === "string" ? { model: raw.model } : {}
+		} : null;
+		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "iteration.ended",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
+			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
+			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
+		} : null;
+		default: return null;
+	}
+}
+//#endregion
+//#region src/workflows.ts
+/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
+*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
+*  (AbortSignal.timeout). */
+function isAbortError(cause) {
+	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
+}
+/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
+*  Returns undefined when neither bound applies (no per-request abort needed). */
+function combineAbortSignals(caller, timeoutMs) {
+	const signals = [];
+	if (caller) signals.push(caller);
+	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
+	if (signals.length === 0) return void 0;
+	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
+*  abort so a cancelled wait leaves nothing pending. */
+function delay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 var HubWorkflowsClient = class {
 	constructor(request, stream, download) {
 		this.request = request;
@@ -1138,8 +1042,9 @@ var HubWorkflowsClient = class {
 	* `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
 	* workflow that reads no trigger fields. Throws `HubSdkError`:
 	* `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
-	* names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`
-	* for an unknown/foreign id. Pass `opts.signal` to abort a slow request.
+	* names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+	* still runs once; pausing only stops its triggers. Pass `opts.signal` to
+	* abort a slow request.
 	*/
 	async run(id, inputs, opts = {}) {
 		const hasInputs = inputs !== void 0 && Object.keys(inputs).length > 0;
@@ -1184,8 +1089,8 @@ var HubWorkflowsClient = class {
 	* follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
 	* other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
 	* terminal-failed/cancelled (queued/running/waiting, or succeeded),
-	* `WORKFLOW_DISABLED` when the workflow has since been disabled, `NOT_FOUND`
-	* for an unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+	* `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+	* failure still retries. Pass `opts.signal` to abort a slow request.
 	*/
 	async retryRun(id, runId, opts = {}) {
 		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/retry`, {
@@ -1534,6 +1439,116 @@ var HubWorkflowsClient = class {
 	}
 };
 //#endregion
+//#region src/client.ts
+function isDispatchCurrentData(value) {
+	return isRecord$1(value) && typeof value.current === "boolean";
+}
+var HubClient = class HubClient extends HubTransport {
+	knowledge;
+	allowances;
+	apps;
+	connections;
+	channels;
+	numbers;
+	eventSubscriptions;
+	permissions;
+	tokens;
+	tools;
+	approvals;
+	audit;
+	githubApp;
+	workflows;
+	lines;
+	constructor(options) {
+		super(options);
+		this.knowledge = new HubKnowledgeClient((path, init) => this.request(path, init));
+		this.allowances = new HubAllowancesClient((path, init) => this.request(path, init));
+		this.apps = new HubAppsClient((path, init) => this.request(path, init));
+		this.numbers = new HubManagedNumbersClient((path, init) => this.request(path, init));
+		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
+		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
+		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
+		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
+		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
+		this.audit = new HubAuditClient((path, init) => this.request(path, init));
+		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
+		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
+		this.lines = new HubLinesClient((path, init) => this.request(path, init), (yaml) => this.workflows.create(yaml), (path, init, callbackBearer) => {
+			if (typeof callbackBearer !== "string" || !/^[\x21-\x7e]{16,512}$/.test(callbackBearer)) throw new HubSdkError({
+				code: "HUB_INVALID_INPUT",
+				message: "Application callback bearer is invalid"
+			});
+			const headers = new Headers(init.headers);
+			headers.set("Authorization", `Bearer ${callbackBearer}`);
+			return this.request(path, {
+				...init,
+				headers,
+				credentials: "omit",
+				redirect: "manual"
+			}, {
+				auth: "caller",
+				validateData: isDispatchCurrentData
+			});
+		});
+	}
+	static fromEnv(options = {}) {
+		const env = options.env ?? readProcessEnv();
+		return new HubClient({
+			baseUrl: resolveHubBaseUrl(env),
+			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
+			authHeaders: options.authHeaders,
+			fetch: options.fetch
+		});
+	}
+	async status() {
+		return this.request("/v1/hub/status", { method: "GET" });
+	}
+	/**
+	* Open a streaming (Server-Sent Events) response and return its raw body.
+	* Shares auth-header building + `fetch` with {@link request}, but does NOT
+	* buffer or JSON-parse the body — the caller consumes the stream.
+	*
+	* A successful stream comes back as `text/event-stream`. Anything else is an
+	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+	* page); it is surfaced the same way {@link request} surfaces errors — a
+	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+	*/
+	async stream(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok || !contentType.includes("text/event-stream")) await throwHubResponseError(path, response, status, contentType);
+		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
+		return response.body;
+	}
+	/**
+	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+	* the artifact's own content type, not JSON. Error responses on such routes
+	* are still the standard envelope, so a failure surfaces exactly like
+	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+	* otherwise an `HUB_HTTP_<status>` transport error.
+	*/
+	async requestBytes(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok) await throwHubResponseError(path, response, status, contentType);
+		return {
+			bytes: new Uint8Array(await response.arrayBuffer()),
+			contentType
+		};
+	}
+};
+//#endregion
 //#region src/broker.ts
 /** Server-only client. App secrets never become a user's general API key.
 * Every invocation mints and consumes one short-lived, exact-grant token. */
@@ -1952,6 +1967,12 @@ var HubLineGrantsClient = class extends HubTransport {
 	}
 };
 //#endregion
-export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubAllowancesClient, HubAppBrokerClient, HubApprovalsClient, HubAppsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, HubLineGrantsClient, HubLinesClient, HubManagedNumbersClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+//#region src/workflow-definition-types.ts
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+function workflowConnectionRequirementKey(ref) {
+	return `${ref.kind}:${ref.provider}`;
+}
+//#endregion
+export { HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubAllowancesClient, HubAppBrokerClient, HubApprovalsClient, HubAppsClient, HubAuditClient, HubChannelsClient, HubClient, HubConnectionsClient, HubEventDeliveryError, HubEventSubscriptionsClient, HubGithubAppClient, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, HubLineGrantsClient, HubLinesClient, HubManagedNumbersClient, HubPermissionsClient, HubSdkError, HubTokensClient, HubToolsClient, HubWorkflowsClient, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature, workflowConnectionRequirementKey };
 
 //# sourceMappingURL=index.js.map