@tangle-network/hub-sdk 1.0.3 → 1.0.5

package/dist/client-CsdLLECZ.js

@@ -0,0 +1,1574 @@
+import { SSEChunkParser } from "@tangle-network/agent-core/sse";
+//#region src/json-init.ts
+/** The init of a request whose body is JSON. Every client builds its bodies
+* here, so the content type cannot drift from the encoding. */
+function jsonInit(method, body) {
+	return {
+		method,
+		body: JSON.stringify(body),
+		headers: { "Content-Type": "application/json" }
+	};
+}
+//#endregion
+//#region src/allowances.ts
+var HubAllowancesClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async plan(meter) {
+		return (await this.request(this.path(meter), { method: "GET" })).plan;
+	}
+	async setPlan(meter, plan) {
+		return (await this.request(this.path(meter), this.body("PUT", plan))).plan;
+	}
+	/** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+	async admit(meter, input) {
+		return (await this.request(`${this.path(meter)}/turns`, this.body("POST", input))).allowance;
+	}
+	/** What the member's next turn would get, without counting anything. */
+	async status(meter, subject) {
+		const query = new URLSearchParams();
+		if (subject.role) query.set("role", subject.role);
+		if (subject.payer) query.set("payer", subject.payer);
+		if (subject.payerRole) query.set("payerRole", subject.payerRole);
+		const suffix = query.size ? `?${query}` : "";
+		return (await this.request(`${this.memberPath(meter, subject.member)}${suffix}`, { method: "GET" })).allowance;
+	}
+	/** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+	async grant(meter, member, input) {
+		return (await this.request(`${this.memberPath(meter, member)}/grant`, this.body("PUT", {
+			tier: "paid",
+			...input
+		}))).grant;
+	}
+	/** Synchronize a paid grant by durable product revision. Null expiry writes
+	* a retained revocation. A delayed older update is refused, never reactivated.
+	* There is no fallback to the unversioned grant endpoint on older servers. */
+	async syncGrant(meter, member, input) {
+		const { grant } = await this.request(`${this.memberPath(meter, member)}/grant/sync`, this.body("PUT", input));
+		if (grant.member !== member || grant.source !== input.source || grant.revision !== input.revision || grant.reference !== input.reference || grant.expiresAt !== (input.expiresAt === null ? null : new Date(input.expiresAt).toISOString())) throw new Error("The Hub returned a mismatched grant synchronization receipt");
+		return grant;
+	}
+	async revoke(meter, member) {
+		await this.request(`${this.memberPath(meter, member)}/grant`, { method: "DELETE" });
+	}
+	/** Turns per member and per line on one UTC day (default today). */
+	async usage(meter, day) {
+		const suffix = day ? `?day=${encodeURIComponent(day)}` : "";
+		return (await this.request(`${this.path(meter)}/usage${suffix}`, { method: "GET" })).usage;
+	}
+	path(meter) {
+		return `/v1/hub/allowances/${encodeURIComponent(meter)}`;
+	}
+	memberPath(meter, member) {
+		return `${this.path(meter)}/members/${encodeURIComponent(member)}`;
+	}
+	body(method, body) {
+		return jsonInit(method, body);
+	}
+};
+//#endregion
+//#region src/apps.ts
+function encodedId(id) {
+	if (typeof id !== "string" || !id || id.length > 256 || id === "." || id === "..") throw new Error("A bounded app or grant id is required");
+	return encodeURIComponent(id);
+}
+var HubAppsClient = class {
+	grants;
+	constructor(request) {
+		this.request = request;
+		this.grants = {
+			list: () => this.request("/v1/me/app-grants", { method: "GET" }),
+			revoke: async (grantId) => this.request(`/v1/me/app-grants/${encodedId(grantId)}/revoke`, { method: "POST" })
+		};
+	}
+	list() {
+		return this.request("/v1/apps", { method: "GET" });
+	}
+	/** The secret is returned only by creation; keep it in your server vault. */
+	create(input) {
+		return this.request("/v1/apps", jsonInit("POST", input));
+	}
+	/** Immutable association of two existing records with the same owner. */
+	async linkOAuthClient(appId, clientId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/oidc-client`, jsonInit("POST", { clientId }));
+	}
+	async revoke(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/revoke`, { method: "POST" });
+	}
+	/** Current latched compliance state and the BAA acceptance behind it. */
+	async getCompliance(appId) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, { method: "GET" });
+	}
+	/**
+	* Latch HIPAA compliance for this app. The request MUST carry the exact
+	* `agreementVersion` the deployment currently offers — the acceptance is
+	* recorded before the claim exists, and the claim can never be cleared:
+	* `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+	*/
+	async setCompliance(appId, input) {
+		return this.request(`/v1/apps/${encodedId(appId)}/compliance`, jsonInit("PUT", input));
+	}
+};
+//#endregion
+//#region src/knowledge-management.ts
+var HubKnowledgeManagementClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	materialize(input) {
+		return this.request("/v1/knowledge/attachments/materialize", jsonInit("POST", input));
+	}
+	authorization() {
+		return this.request("/v1/knowledge/authorization", { method: "GET" });
+	}
+	disconnectAuthorization() {
+		return this.request("/v1/knowledge/authorization", { method: "DELETE" });
+	}
+	capabilities() {
+		return this.request("/v1/knowledge/capabilities", { method: "GET" });
+	}
+	list() {
+		return this.request("/v1/knowledge/sources", { method: "GET" });
+	}
+	get(sourceId) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}`, { method: "GET" });
+	}
+	create(input) {
+		return this.request("/v1/knowledge/sources", jsonInit("POST", input));
+	}
+	refresh(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/refresh`, jsonInit("POST", input));
+	}
+	attach(sourceId, input) {
+		return this.request(`/v1/knowledge/sources/${encodeURIComponent(sourceId)}/attachments`, jsonInit("POST", input));
+	}
+	attachments(sandboxId) {
+		return this.request(`/v1/knowledge/attachments${sandboxId ? `?sandboxId=${encodeURIComponent(sandboxId)}` : ""}`, { method: "GET" });
+	}
+	detach(attachmentId) {
+		return this.request(`/v1/knowledge/attachments/${encodeURIComponent(attachmentId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/knowledge.ts
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+* scope on the server; neither a caller nor an agent can supply another scope. */
+var HubKnowledgeClient = class {
+	management;
+	constructor(request) {
+		this.request = request;
+		this.management = new HubKnowledgeManagementClient(request);
+	}
+	bindings() {
+		return this.request("/v1/knowledge/runtime/bindings", { method: "GET" });
+	}
+	query(input, options) {
+		return this.request("/v1/knowledge/runtime/query", {
+			...jsonInit("POST", {
+				query: input.query,
+				...input.expectedReferences !== void 0 ? { expectedReferences: input.expectedReferences } : {},
+				...input.limit !== void 0 ? { limit: input.limit } : {}
+			}),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/lines.ts
+/** The `on.schedule` mapping a Line schedule helper writes. */
+function scheduleYaml(cron, timezone, until) {
+	return `  schedule: { ${[
+		`cron: ${JSON.stringify(cron)}`,
+		`timezone: ${JSON.stringify(timezone)}`,
+		...until ? [`until: ${JSON.stringify(until)}`] : []
+	].join(", ")} }`;
+}
+/** Line calls share HubClient authentication and envelope handling. */
+var HubLinesClient = class {
+	members;
+	memberApplications;
+	checkins;
+	constructor(request, createWorkflow, requestApplicationDispatchCurrent) {
+		this.request = request;
+		this.createWorkflow = createWorkflow;
+		this.requestApplicationDispatchCurrent = requestApplicationDispatchCurrent;
+		this.members = { list: async (lineId) => (await this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/members`, { method: "GET" })).members };
+		const applicationPath = (lineId, memberId) => `/v1/hub/lines/${encodeURIComponent(lineId)}/members/${encodeURIComponent(memberId)}/application`;
+		this.memberApplications = {
+			get: async (lineId, memberId) => await this.request(applicationPath(lineId, memberId), { method: "GET" }),
+			select: async (lineId, memberId, input) => (await this.request(applicationPath(lineId, memberId), jsonInit("PUT", input))).selection,
+			clear: async (lineId, memberId, input) => {
+				await this.request(applicationPath(lineId, memberId), jsonInit("DELETE", input));
+			}
+		};
+		this.checkins = { schedule: (cron, options) => {
+			const name = options.name ?? `line-checkin-${crypto.randomUUID().slice(0, 8)}`;
+			const yaml = [
+				`name: ${JSON.stringify(name)}`,
+				"on:",
+				scheduleYaml(cron, options.timezone, options.until),
+				"do:",
+				"  - agent.run:",
+				"      line:",
+				`        id: ${JSON.stringify(options.lineId)}`,
+				`        member: ${JSON.stringify(options.member)}`,
+				`      prompt: ${JSON.stringify(options.prompt)}`
+			].join("\n");
+			return this.createWorkflow(yaml);
+		} };
+	}
+	async scheduleSend(cron, options) {
+		const name = options.name ?? `line-send-${crypto.randomUUID().slice(0, 8)}`;
+		const yaml = [
+			`name: ${JSON.stringify(name)}`,
+			"on:",
+			scheduleYaml(cron, options.timezone, options.until),
+			"do:",
+			"  - line.send:",
+			`      lineId: ${JSON.stringify(options.lineId)}`,
+			`      memberId: ${JSON.stringify(options.memberId)}`,
+			`      text: ${JSON.stringify(options.text)}`,
+			...options.notBefore ? [`      notBefore: ${JSON.stringify(options.notBefore)}`] : []
+		].join("\n");
+		return this.createWorkflow(yaml);
+	}
+	async context() {
+		return this.request("/v1/hub/lines/context", { method: "GET" });
+	}
+	async send(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/send`, jsonInit("POST", input));
+	}
+	/** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+	async sentMessage(lineId, messageId) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/outbox/${encodeURIComponent(messageId)}`, { method: "GET" });
+	}
+	async remind(lineId, input) {
+		return this.request(`/v1/hub/lines/${encodeURIComponent(lineId)}/remind`, jsonInit("POST", input));
+	}
+	async applicationDispatchCurrent(lineId, messageId, input, callbackBearer) {
+		if (!this.requestApplicationDispatchCurrent) throw new Error("Use HubClient to check application dispatch authority");
+		return (await this.requestApplicationDispatchCurrent(`/v1/hub/lines/${encodeURIComponent(lineId)}/messages/${encodeURIComponent(messageId)}/application-dispatch/current`, jsonInit("POST", input), callbackBearer)).current;
+	}
+};
+//#endregion
+//#region src/managed-numbers.ts
+/** Administrative number operations through Hub's authenticated transport.
+* A mutation is one attempt; an uncertain create reuses its quote and reference. */
+var HubManagedNumbersClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	readiness() {
+		return this.request("/v1/hub/numbers/readiness", { method: "GET" });
+	}
+	/** One page of orders. Scope by `clientReference` to ask about one binding,
+	* and follow `nextCursor` for the rest; a page is never ownership evidence. */
+	list(query = {}) {
+		const params = new URLSearchParams();
+		if (query.clientReference !== void 0) params.set("clientReference", query.clientReference);
+		if (query.cursor !== void 0) params.set("cursor", query.cursor);
+		if (query.limit !== void 0) params.set("limit", String(query.limit));
+		const search = params.toString();
+		return this.request(`/v1/hub/numbers${search ? `?${search}` : ""}`, { method: "GET" });
+	}
+	get(id) {
+		return this.request(this.path(id), { method: "GET" });
+	}
+	quote(input) {
+		return this.request("/v1/hub/numbers/quote", this.post(input));
+	}
+	/** `clientReference` and `transport`, when given, must match the signed
+	* quote or Hub refuses the purchase with a conflict. */
+	create(input) {
+		return this.request("/v1/hub/numbers", this.post(input));
+	}
+	/** Fences references so no order can take them again. Call it as the last
+	* step before retiring the resource they name: a purchase that races the
+	* retirement is then refused (`409 number_reference_fenced`) instead of
+	* binding a line to a resource that is gone. Refused with
+	* `409 number_reference_held` while a live order holds one of them; cancel
+	* it first. A cancelled order no longer holds its reference, so the fence
+	* succeeds as soon as `cancel` returns, whether or not its release is still
+	* pending. Repeating a fence is harmless. */
+	fence(input) {
+		return this.request("/v1/hub/numbers/fences", this.post(input));
+	}
+	advance(id) {
+		return this.request(`${this.path(id)}/advance`, this.post({}));
+	}
+	cancel(id) {
+		return this.request(`${this.path(id)}/cancel`, this.post({}));
+	}
+	path(id) {
+		if (!/^num_[a-f0-9]{36}$/.test(id)) throw new Error("Invalid managed number order id");
+		return `/v1/hub/numbers/${encodeURIComponent(id)}`;
+	}
+	post(body) {
+		return jsonInit("POST", body);
+	}
+};
+//#endregion
+//#region src/redaction.ts
+const SECRET_KEY_PATTERN = /(api[_-]?key|authorization|capability[_-]?token|token|secret)/i;
+const SECRET_VALUE_PATTERN = /\b(?:sk-tan[-_]|hubcap_|hct_|lrc_|gh[pousr]_)[A-Za-z0-9_.=-]+\b/g;
+function redactHubValue(value) {
+	if (typeof value === "string") return value.replace(SECRET_VALUE_PATTERN, "[REDACTED]");
+	if (Array.isArray(value)) return value.map((item) => redactHubValue(item));
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, SECRET_KEY_PATTERN.test(key) ? "[REDACTED]" : redactHubValue(entryValue)]));
+	return value;
+}
+//#endregion
+//#region src/transport.ts
+var HubSdkError = class extends Error {
+	code;
+	details;
+	status;
+	constructor(error, options = {}) {
+		super(String(redactHubValue(error.message)));
+		this.name = "HubSdkError";
+		this.code = error.code;
+		this.details = redactHubValue(error.details);
+		this.status = options.status;
+	}
+};
+function bodySnippet(body, max = 200) {
+	const trimmed = body.trim();
+	return trimmed.length > max ? `${trimmed.slice(0, max)}…` : trimmed;
+}
+function httpError(path, status, statusText, body, contentType, omitResponseDetails = false) {
+	const suffix = !omitResponseDetails && statusText ? ` ${statusText}` : "";
+	return new HubSdkError({
+		code: `HUB_HTTP_${status}`,
+		message: `Hub request ${path} failed: HTTP ${status}${suffix}`,
+		details: {
+			status,
+			path,
+			...omitResponseDetails ? {} : {
+				contentType: contentType || null,
+				bodySnippet: bodySnippet(body)
+			}
+		}
+	}, { status });
+}
+function isHubErrorEnvelope(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	if (candidate.success !== false) return false;
+	const error = candidate.error;
+	return typeof error === "object" && error !== null && typeof error.code === "string";
+}
+function isHubSuccessEnvelope(value) {
+	return typeof value === "object" && value !== null && value.success === true;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+var HubTransport = class {
+	baseUrl;
+	fetch;
+	authHeaders;
+	#apiKey;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.#apiKey = options.apiKey;
+		this.authHeaders = options.authHeaders;
+		this.fetch = options.fetch ?? fetch.bind(globalThis);
+	}
+	/** The API key this client authenticates with, when it has one. */
+	get apiKey() {
+		return this.#apiKey;
+	}
+	async request(path, init, options = {}) {
+		const callerAuth = options.auth === "caller";
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers, callerAuth)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		const bodyText = await response.text();
+		if (!contentType.includes("application/json")) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+		}
+		if (isHubErrorEnvelope(parsed)) {
+			if (callerAuth) throw new HubSdkError({
+				code: parsed.error.code,
+				message: `Hub request ${path} failed: HTTP ${status}`
+			}, { status });
+			throw new HubSdkError(parsed.error, { status });
+		}
+		if (isHubSuccessEnvelope(parsed)) {
+			if (callerAuth && !response.ok) throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+			if (options.validateData && !options.validateData(parsed.data)) throw new HubSdkError({
+				code: `HUB_HTTP_${status}`,
+				message: `Hub request ${path} returned invalid data`,
+				details: {
+					status,
+					path
+				}
+			}, { status });
+			return parsed.data;
+		}
+		throw httpError(path, status, response.statusText, bodyText, contentType, callerAuth);
+	}
+	async buildHeaders(headers, callerAuth = false) {
+		const mergedHeaders = new Headers({ Accept: "application/json" });
+		if (!callerAuth && this.apiKey) mergedHeaders.set("Authorization", `Bearer ${this.apiKey}`);
+		if (!callerAuth && this.authHeaders) for (const [key, value] of new Headers(await this.authHeaders())) mergedHeaders.set(key, value);
+		for (const [key, value] of new Headers(headers)) mergedHeaders.set(key, value);
+		return mergedHeaders;
+	}
+};
+/** Decode a failed non-envelope response using the same redacted SDK errors. */
+async function throwHubResponseError(path, response, status, contentType) {
+	const bodyText = await response.text().catch(() => "");
+	if (contentType.includes("application/json")) {
+		let parsed;
+		try {
+			parsed = JSON.parse(bodyText);
+		} catch {
+			parsed = void 0;
+		}
+		if (isHubErrorEnvelope(parsed)) throw new HubSdkError(parsed.error, { status });
+	}
+	throw httpError(path, status, response.statusText, bodyText, contentType);
+}
+/** Whether an error is the hub's "this credential is not accepted" answer. */
+function isHubUnauthenticated(error) {
+	return error instanceof HubSdkError && (error.code === "HUB_UNAUTHENTICATED" || error.status === 401);
+}
+//#endregion
+//#region src/environment.ts
+const HUB_URL_ENV_VAR = "TANGLE_HUB_URL";
+const HUB_API_KEY_ENV_VAR = "TANGLE_API_KEY";
+const HUB_CAPABILITY_TOKEN_ENV_VAR = "TANGLE_HUB_CAPABILITY_TOKEN";
+function resolveHubBaseUrl(env = readProcessEnv()) {
+	const raw = env[HUB_URL_ENV_VAR];
+	if (raw === void 0 || raw.trim() === "") throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `${HUB_URL_ENV_VAR} is required`,
+		details: { envVar: HUB_URL_ENV_VAR }
+	});
+	const trimmed = raw.trim();
+	try {
+		new URL(trimmed);
+	} catch {
+		throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `${HUB_URL_ENV_VAR} is not a valid URL`,
+			details: { envVar: HUB_URL_ENV_VAR }
+		});
+	}
+	return trimmed.replace(/\/+$/, "").replace(/\/v1\/hub$/, "");
+}
+function resolveHubAuth(env = readProcessEnv()) {
+	const present = [nonEmpty(env[HUB_API_KEY_ENV_VAR]), nonEmpty(env[HUB_CAPABILITY_TOKEN_ENV_VAR])].filter((value) => value !== void 0);
+	if (present.length === 0) throw new HubSdkError({
+		code: "HUB_CONFIG_MISSING",
+		message: `One of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR} is required`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	if (present.length > 1) throw new HubSdkError({
+		code: "HUB_CONFIG_INVALID",
+		message: `Set exactly one of ${HUB_API_KEY_ENV_VAR} or ${HUB_CAPABILITY_TOKEN_ENV_VAR}, not both`,
+		details: { envVars: [HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR] }
+	});
+	return present[0];
+}
+function nonEmpty(value) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? void 0 : trimmed;
+}
+function readProcessEnv() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+//#region src/authorization.ts
+var HubTokensClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async mint(options) {
+		return this.request("/v1/hub/tokens", jsonInit("POST", options));
+	}
+	async list(options = {}) {
+		const searchParams = new URLSearchParams();
+		if (options.includeExpired) searchParams.set("includeExpired", "true");
+		const query = searchParams.toString();
+		return { tokens: (await this.request(`/v1/hub/tokens${query ? `?${query}` : ""}`, { method: "GET" })).tokens.map((token) => ({
+			id: token.id,
+			providerId: token.providerId,
+			connectionId: token.connectionId,
+			connectionDisplay: token.connectionDisplay,
+			actionPath: token.actionPath,
+			expiresAt: token.expiresAt,
+			status: token.status,
+			principalKind: token.principalKind,
+			createdAt: token.createdAt
+		})) };
+	}
+	async revoke(tokenId) {
+		const response = await this.request(`/v1/hub/tokens/${encodeURIComponent(tokenId)}`, { method: "DELETE" });
+		return {
+			tokenId: response.tokenId,
+			status: response.status
+		};
+	}
+};
+var HubPermissionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list(connectionId) {
+		return this.request(`/v1/hub/policies?connectionId=${encodeURIComponent(connectionId)}`, { method: "GET" });
+	}
+	async set(input) {
+		return this.request("/v1/hub/policies", jsonInit("PUT", input));
+	}
+	/** Reset an action to its default by deleting any stored override. */
+	async delete(input) {
+		return this.request("/v1/hub/policies", jsonInit("DELETE", input));
+	}
+	/** Bulk-allow every write action of a connection's provider. Reads are
+	*  already allowed for sandbox agents; destructive actions stay `ask`.
+	*  Idempotent: actions with an existing policy are left untouched. */
+	async allowWrites(connectionId) {
+		return this.request("/v1/hub/policies/allow-writes", jsonInit("POST", { connectionId }));
+	}
+	/** Inverse of `allowWrites`: delete only the rows it created for this
+	*  connection. Manual per-action decisions are left intact. */
+	async revertWrites(connectionId) {
+		return this.request("/v1/hub/policies/revert-writes", jsonInit("POST", { connectionId }));
+	}
+};
+var HubApprovalsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/approvals", { method: "GET" });
+	}
+	async approve(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+	}
+	async deny(approvalId) {
+		return this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/deny`, { method: "POST" });
+	}
+};
+//#endregion
+//#region src/tools.ts
+var HubToolsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async search(query, options = {}) {
+		return this.request("/v1/hub/tools/search", jsonInit("POST", {
+			query,
+			provider: options.provider,
+			limit: options.limit
+		}));
+	}
+	async sources() {
+		return this.request("/v1/hub/tools/sources", { method: "GET" });
+	}
+	async describe(path) {
+		return this.request("/v1/hub/tools/describe", jsonInit("POST", { path }));
+	}
+	/**
+	* Run one hub tool. `raw` is the tool input: the SDK forwards it verbatim as
+	* the request body's `input`, and the server validates it against the tool's
+	* own schema, so the client never gives it a shape.
+	*/
+	async invoke(path, raw, options = {}) {
+		const execInit = this.buildExecInit(path, raw, options);
+		try {
+			return await this.request("/v1/hub/exec", execInit);
+		} catch (error) {
+			if (!(error instanceof HubSdkError) || !requiresCapabilityToken(error)) throw error;
+			const approvalId = getApprovalId(error);
+			if (approvalId && options.approve !== true) throw error;
+			if (options.approve) {
+				if (!approvalId) throw error;
+				const approved = await this.request(`/v1/hub/approvals/${encodeURIComponent(approvalId)}/approve`, { method: "POST" });
+				validateApprovedExecution(approved, path, options.connectionId);
+				if (!approved.capabilityToken?.token) throw new HubSdkError({
+					code: "HUB_CONFIG_MISSING",
+					message: "Hub approval did not return a capability token",
+					details: { approvalId }
+				});
+				return this.request("/v1/hub/exec", {
+					...execInit,
+					headers: {
+						"Content-Type": "application/json",
+						Authorization: `Bearer ${approved.capabilityToken.token}`
+					}
+				});
+			}
+		}
+		const minted = await this.request("/v1/hub/tokens", jsonInit("POST", {
+			actionPath: path,
+			connectionId: options.connectionId,
+			provider: options.connectionId ? void 0 : path.split(".")[0]
+		}));
+		return this.request("/v1/hub/exec", {
+			...execInit,
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${minted.token}`
+			}
+		});
+	}
+	buildExecInit(path, raw, options) {
+		return jsonInit("POST", {
+			path,
+			input: raw,
+			connectionId: options.connectionId,
+			idempotencyKey: options.idempotencyKey
+		});
+	}
+};
+function requiresCapabilityToken(error) {
+	return error.code === "HUB_APPROVAL_REQUIRED";
+}
+function getApprovalId(error) {
+	const id = error.details?.approval?.id;
+	return typeof id === "string" ? id : void 0;
+}
+function validateApprovedExecution(approved, path, connectionId) {
+	if (approved.approval.actionPath !== path) throw new HubSdkError({
+		code: "HUB_POLICY_DENIED",
+		message: "Hub approval action does not match requested execution",
+		details: {
+			approvalId: approved.approval.id,
+			expectedActionPath: path,
+			approvalActionPath: approved.approval.actionPath
+		}
+	});
+	if (connectionId !== void 0 && approved.approval.connectionId !== connectionId) throw new HubSdkError({
+		code: "HUB_POLICY_DENIED",
+		message: "Hub approval connection does not match requested execution",
+		details: {
+			approvalId: approved.approval.id,
+			expectedConnectionId: connectionId,
+			approvalConnectionId: approved.approval.connectionId
+		}
+	});
+}
+//#endregion
+//#region src/inbound-webhooks.ts
+var HubInboundWebhooksClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async create(connectionId, options = {}) {
+		return this.request(this.path(connectionId), jsonInit("POST", options));
+	}
+	async get(connectionId) {
+		return this.request(this.path(connectionId), { method: "GET" });
+	}
+	/** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+	async ensurePhoneNumber(connectionId, phoneNumberId) {
+		if (!phoneNumberId || phoneNumberId.length > 128 || !/^[\x21-\x7e]+$/.test(phoneNumberId)) throw new Error("A bounded phone-number id is required");
+		return this.request(`${this.path(connectionId)}/phone-numbers/ensure`, jsonInit("POST", { phoneNumberId }));
+	}
+	/** Remove event subscriptions first. This does not silently rotate a live URL. */
+	async delete(connectionId) {
+		return this.request(this.path(connectionId), { method: "DELETE" });
+	}
+	path(connectionId) {
+		if (!connectionId || connectionId.length > 256) throw new Error("A bounded connection id is required");
+		return `/v1/hub/connections/${encodeURIComponent(connectionId)}/inbound-webhook`;
+	}
+};
+//#endregion
+//#region src/connections.ts
+const GITHUB_EXACT_CONNECT_SCOPES = [
+	"read:user",
+	"repo",
+	"read:org"
+];
+function sameOAuthScopeSet(left, right) {
+	if (!Array.isArray(left)) return false;
+	const leftSet = new Set(left);
+	const rightSet = new Set(right);
+	return leftSet.size === left.length && rightSet.size === right.length && leftSet.size === rightSet.size && [...leftSet].every((scope) => rightSet.has(scope));
+}
+var HubConnectionsClient = class {
+	inboundWebhook;
+	constructor(request) {
+		this.request = request;
+		this.inboundWebhook = new HubInboundWebhooksClient(request);
+	}
+	async list() {
+		return this.request("/v1/hub/connections", { method: "GET" });
+	}
+	/** Connector catalog: every provider the hub can expose, each flagged with
+	*  `configured` (whether its OAuth app credentials are wired). Callers render
+	*  this alongside `list()` to offer Connect for not-yet-connected providers. */
+	async providers() {
+		return this.request("/v1/hub/providers", { method: "GET" });
+	}
+	async start(provider, options = {}) {
+		if (options.requestedScopes !== void 0 && (provider !== "github" || !sameOAuthScopeSet(options.requestedScopes, GITHUB_EXACT_CONNECT_SCOPES))) throw new HubSdkError({
+			code: "HUB_INVALID_INPUT",
+			message: "GitHub requestedScopes must be read:user, repo, and read:org"
+		});
+		const started = await this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/start`, jsonInit("POST", {
+			returnUrl: options.returnUrl,
+			cli: options.cli,
+			connectionParameters: options.connectionParameters,
+			requestedScopes: options.requestedScopes
+		}));
+		if (options.requestedScopes !== void 0 && (started.provider !== provider || !sameOAuthScopeSet(started.scopes, options.requestedScopes))) throw new HubSdkError({
+			code: "HUB_CONFIG_MISSING",
+			message: "Hub did not preserve the requested OAuth scopes"
+		});
+		return started;
+	}
+	async startWhatsappEmbeddedSignup(options = {}) {
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/start", jsonInit("POST", { returnUrl: options.returnUrl }));
+	}
+	async completeWhatsappEmbeddedSignup(input) {
+		return this.request("/v1/hub/connections/whatsapp-business/embedded-signup/complete", jsonInit("POST", input));
+	}
+	/** Connect a non-OAuth (api-key) connector by submitting the user's key.
+	*  The server validates the key with a live probe before persisting and
+	*  returns the created (or reconnected) connection — there is no redirect,
+	*  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+	*  requires listing ID/PMS pairs; other providers have no metadata. */
+	async connectApiKey(provider, apiKey, metadata) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(provider)}/connect-key`, jsonInit("POST", {
+			apiKey,
+			...metadata === void 0 ? {} : { metadata }
+		}));
+	}
+	async revoke(connectionId) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
+	}
+	async health(connectionId) {
+		return this.request(`/v1/hub/connections/${encodeURIComponent(connectionId)}/health`, { method: "POST" });
+	}
+};
+//#endregion
+//#region src/channels.ts
+var HubChannelsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/channels", { method: "GET" });
+	}
+	async createEmail(input = {}) {
+		return this.request("/v1/hub/channels/email", jsonInit("POST", input));
+	}
+	async delete(channelId) {
+		return this.request(`/v1/hub/channels/${encodeURIComponent(channelId)}`, { method: "DELETE" });
+	}
+};
+var HubEventSubscriptionsClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list() {
+		return this.request("/v1/hub/event-subscriptions", { method: "GET" });
+	}
+	async create(input) {
+		return this.request("/v1/hub/event-subscriptions", jsonInit("POST", input));
+	}
+	async delete(subscriptionId) {
+		return this.request(`/v1/hub/event-subscriptions/${encodeURIComponent(subscriptionId)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/github-app.ts
+var HubGithubAppClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async mintInstallationToken(input) {
+		return this.request("/v1/hub/github-app/mint-installation-token", jsonInit("POST", input));
+	}
+	/** Every installation the caller may act through — their own and any org's
+	*  they were verified against. The management surface's read. */
+	async listInstallations() {
+		return this.request("/v1/hub/github-app/installations", { method: "GET" });
+	}
+	/**
+	* Find installations `listInstallations` cannot show: the hub only registers
+	* what the setup redirect witnessed, so an org install approved out of band —
+	* or created by another member — is invisible until this asks GitHub for it.
+	* Links whatever the caller can prove access to; never uninstalls anything.
+	*/
+	async syncInstallations() {
+		return this.request("/v1/hub/github-app/installations/sync", { method: "POST" });
+	}
+	/** Give up THIS caller's access. Not an uninstall — the installation is
+	*  account-level and other members may still be using it. */
+	async disconnectInstallation(installationId) {
+		return this.request(`/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/access`, { method: "DELETE" });
+	}
+	async getInstallation(installationId) {
+		return this.request(`/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}`, { method: "GET" });
+	}
+	async listRepos(installationId) {
+		return this.request(`/v1/hub/github-app/installations/${encodeURIComponent(String(installationId))}/repos`, { method: "GET" });
+	}
+	async isRepoInstalled(input) {
+		const params = new URLSearchParams({
+			owner: input.owner,
+			repo: input.repo
+		});
+		return this.request(`/v1/hub/github-app/is-repo-installed?${params.toString()}`, { method: "GET" });
+	}
+};
+//#endregion
+//#region src/audit.ts
+var HubAuditClient = class {
+	constructor(request) {
+		this.request = request;
+	}
+	async list(options = {}) {
+		const searchParams = new URLSearchParams();
+		if (options.provider !== void 0) searchParams.set("provider", options.provider);
+		if (options.action !== void 0) searchParams.set("action", options.action);
+		if (options.status !== void 0) searchParams.set("status", options.status);
+		if (options.since !== void 0) searchParams.set("since", options.since);
+		if (options.until !== void 0) searchParams.set("until", options.until);
+		if (options.cursor !== void 0) searchParams.set("cursor", options.cursor);
+		if (options.limit !== void 0) searchParams.set("limit", String(options.limit));
+		const query = searchParams.toString();
+		return this.request(`/v1/hub/audit${query ? `?${query}` : ""}`, { method: "GET" });
+	}
+};
+//#endregion
+//#region src/workflow-run-events.ts
+/** Read a wire field as a string, or "" when the server sent anything else.
+*  `raw` is that field straight off the parsed payload, before any check. */
+function optString(raw) {
+	return typeof raw === "string" ? raw : "";
+}
+/** An agent iteration's terminal status (`iteration.ended`) — only ever
+*  succeeded/failed; an iteration is never guard-skipped. */
+function isIterationStatus(value) {
+	return value === "succeeded" || value === "failed";
+}
+/** An action's terminal status on `action.finished`. Beyond succeeded/failed a
+*  guarded action can end `skipped` (its `if` resolved false, so it never ran) —
+*  accepted here so a skipped event is surfaced, not dropped as malformed. */
+function isActionFinishedStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "skipped";
+}
+/** Terminal status of a whole run's `run.done` event. A run can end `cancelled`
+*  (a user cancel) — a value neither the action nor iteration status checkers
+*  accept — so `run.done` uses this rather than them, which would drop a
+*  cancelled terminal event and hang the stream. */
+function isRunDoneStatus(value) {
+	return value === "succeeded" || value === "failed" || value === "cancelled";
+}
+/**
+* Map one raw SSE event (its `event:` name + parsed JSON `data:`) to a typed
+* run-stream event, validating the fields each variant declares rather than
+* blindly casting the wire payload. A frame that doesn't match its event's
+* shape (or an unknown event name) returns null so the consumer skips it — a
+* malformed `token` can never reach a consumer as `{ delta: undefined }`, and
+* new server event kinds don't break older clients.
+*/
+function toRunStreamEvent(eventType, raw) {
+	if (eventType === "ping") return { type: "ping" };
+	if (!isRecord(raw)) return null;
+	switch (eventType) {
+		case "snapshot": return typeof raw.id === "string" && typeof raw.workflowId === "string" && typeof raw.status === "string" && Array.isArray(raw.actionResults) ? {
+			type: "snapshot",
+			run: raw
+		} : null;
+		case "token": return typeof raw.delta === "string" && typeof raw.actionIndex === "number" ? {
+			type: "token",
+			actionIndex: raw.actionIndex,
+			delta: raw.delta,
+			at: optString(raw.at)
+		} : null;
+		case "run.done": return isRunDoneStatus(raw.status) ? {
+			type: "run.done",
+			status: raw.status,
+			error: typeof raw.error === "string" ? raw.error : null,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "run.waiting": return typeof raw.decisionId === "string" && raw.decisionId.length > 0 ? {
+			type: "run.waiting",
+			decisionId: raw.decisionId,
+			...typeof raw.at === "string" ? { at: raw.at } : {}
+		} : null;
+		case "action.started": return typeof raw.index === "number" && typeof raw.kind === "string" && typeof raw.at === "string" ? {
+			type: "action.started",
+			index: raw.index,
+			kind: raw.kind,
+			at: raw.at
+		} : null;
+		case "action.finished": return typeof raw.index === "number" && typeof raw.kind === "string" && isActionFinishedStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "action.finished",
+			index: raw.index,
+			kind: raw.kind,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {},
+			...typeof raw.error === "string" ? { error: raw.error } : {}
+		} : null;
+		case "iteration.started": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && typeof raw.at === "string" ? {
+			type: "iteration.started",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			at: raw.at,
+			...typeof raw.model === "string" ? { model: raw.model } : {}
+		} : null;
+		case "iteration.ended": return typeof raw.actionIndex === "number" && typeof raw.iterationIndex === "number" && isIterationStatus(raw.status) && typeof raw.at === "string" ? {
+			type: "iteration.ended",
+			actionIndex: raw.actionIndex,
+			iterationIndex: raw.iterationIndex,
+			status: raw.status,
+			at: raw.at,
+			...typeof raw.outputPreview === "string" ? { outputPreview: raw.outputPreview } : {},
+			...typeof raw.inputTokens === "number" ? { inputTokens: raw.inputTokens } : {},
+			...typeof raw.outputTokens === "number" ? { outputTokens: raw.outputTokens } : {},
+			...typeof raw.costUsd === "number" ? { costUsd: raw.costUsd } : {}
+		} : null;
+		default: return null;
+	}
+}
+//#endregion
+//#region src/workflows-kv.ts
+/** The workflow's durable keyspace, shared by all its runs. */
+var WorkflowKvResource = class {
+	constructor(request) {
+		this.request = request;
+	}
+	/**
+	* The workflow's whole keyspace as metadata (key, version, updatedAt — never
+	* values), key-ordered. Bounded by the server's per-workflow key cap.
+	*/
+	async listKv(id) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv`, { method: "GET" });
+	}
+	/** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
+	async getKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "GET" });
+	}
+	/**
+	* Upsert a key; returns the entry with its NEW version (increments on every
+	* write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
+	* or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
+	* value, stored and read back verbatim, so the client never gives it a shape.
+	*/
+	async putKv(id, key, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, jsonInit("PUT", { value: raw }));
+	}
+	/**
+	* Compare-and-swap: the write lands only when the stored version still
+	* equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
+	* (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
+	* caller's value, stored and read back verbatim, so the client never gives it
+	* a shape.
+	*/
+	async casKv(id, key, expectedVersion, raw) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}/cas`, jsonInit("POST", {
+			expectedVersion,
+			value: raw
+		}));
+	}
+	/** Delete a key; idempotent — `deleted` reports whether a row was removed. */
+	async deleteKv(id, key) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/kv/${encodeURIComponent(key)}`, { method: "DELETE" });
+	}
+};
+//#endregion
+//#region src/workflows.ts
+/** True for an aborted/timed-out fetch (or any abort). fetch rejects with the
+*  signal's reason — a DOMException named `AbortError` (caller) or `TimeoutError`
+*  (AbortSignal.timeout). */
+function isAbortError(cause) {
+	return cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError");
+}
+/** A signal that aborts when the caller's signal aborts OR `timeoutMs` elapses.
+*  Returns undefined when neither bound applies (no per-request abort needed). */
+function combineAbortSignals(caller, timeoutMs) {
+	const signals = [];
+	if (caller) signals.push(caller);
+	if (timeoutMs !== null) signals.push(AbortSignal.timeout(timeoutMs));
+	if (signals.length === 0) return void 0;
+	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Resolve after `ms`, or reject if `signal` aborts first. Clears its timer on
+*  abort so a cancelled wait leaves nothing pending. */
+function delay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("The operation was aborted"));
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Wait before reopening a run event stream that a restart ended. */
+const STREAM_REOPEN_DELAY_MS = 1e3;
+/** Reopens in a row that deliver nothing before watchRun gives up. */
+const MAX_IDLE_STREAM_REOPENS = 30;
+function abortableDelay(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) return reject(signal.reason);
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+var HubWorkflowsClient = class extends WorkflowKvResource {
+	constructor(request, stream, download) {
+		super(request);
+		this.stream = stream;
+		this.download = download;
+	}
+	async list() {
+		return this.request("/v1/workflows", { method: "GET" });
+	}
+	/**
+	* Owner-wide fleet overview: one row per workflow with its run tallies over
+	* a trailing window (default 7d), sorted failing-first. Answers "how are ALL
+	* my workflows doing" in one call — the per-workflow insights endpoint is
+	* the drill-down, not a way to build this row set client-side.
+	*/
+	async fleetInsights(opts = {}) {
+		const query = opts.window ? `?window=${encodeURIComponent(opts.window)}` : "";
+		return this.request(`/v1/workflows/insights/fleet${query}`, { method: "GET" });
+	}
+	async get(id) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "GET" });
+	}
+	async create(yaml) {
+		return this.request("/v1/workflows", jsonInit("POST", { yaml }));
+	}
+	/**
+	* Replace the workflow's definition from YAML (recompiled server-side,
+	* triggers reconciled). Every landed update appends a revision;
+	* `opts.note` rides onto that revision row (e.g. "why this change"), visible
+	* in {@link listRevisions}. Throws `HubSdkError`: `WORKFLOW_INVALID` when the
+	* YAML doesn't compile or its connections aren't met, `CONFLICT` on a
+	* concurrent modification, `NOT_FOUND` for an unknown/foreign id.
+	*/
+	async update(id, yaml, opts = {}) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PUT", {
+			yaml,
+			...opts.note !== void 0 ? { note: opts.note } : {}
+		}));
+	}
+	async delete(id) {
+		await this.request(`/v1/workflows/${encodeURIComponent(id)}`, { method: "DELETE" });
+	}
+	/**
+	* Enable or disable a workflow without editing its YAML. Works even when the
+	* workflow's connection was revoked (a disabled workflow can't be recompiled
+	* via `update`, but it can still be paused/resumed here).
+	*/
+	async setEnabled(id, enabled) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}`, jsonInit("PATCH", { enabled }));
+	}
+	/**
+	* One page of run history, newest first. Pass the previous page's
+	* `nextCursor` to fetch the next; a null `nextCursor` means the last page.
+	*/
+	async listRuns(id, opts = {}) {
+		const params = new URLSearchParams();
+		if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+		if (opts.cursor !== void 0) params.set("cursor", opts.cursor);
+		const query = params.toString();
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs${query ? `?${query}` : ""}`, { method: "GET" });
+	}
+	/**
+	* Enqueue an immediate ("Run now") run and return its `runId`. The run goes
+	* through the identical execution path a trigger delivery uses.
+	*
+	* `inputs` supplies the trigger fields the workflow reads (its
+	* {@link HubWorkflow.manualRunInputs}), as a flat `{ path: value }` map — e.g.
+	* `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
+	* workflow that reads no trigger fields. Throws `HubSdkError`:
+	* `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
+	* names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+	* still runs once; pausing only stops its triggers. Pass `opts.signal` to
+	* abort a slow request.
+	*/
+	async run(id, inputs, opts = {}) {
+		const hasInputs = inputs !== void 0 && Object.keys(inputs).length > 0;
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/run`, {
+			...jsonInit("POST", hasInputs ? { inputs } : {}),
+			...opts.signal ? { signal: opts.signal } : {}
+		});
+	}
+	/**
+	* A single run's full detail: per-action `output` + `agentRun` execution
+	* detail (size-capped server-side) and the trigger context — the deep "why
+	* did this run do what it did" view. `NOT_FOUND` when the run is unknown or
+	* does not belong to both the caller and this workflow.
+	*/
+	async getRun(id, runId, opts = {}) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}`, {
+			method: "GET",
+			...opts.signal ? { signal: opts.signal } : {}
+		});
+	}
+	/**
+	* Stop a queued or in-flight run. A `queued` run is cancelled synchronously
+	* and comes back `{ status: "cancelled" }` (already terminal); a `running` run
+	* is signalled to abort and comes back `{ status: "cancelling", signalled }` —
+	* it settles `cancelled` a moment later as its current action tears down, which
+	* a {@link watchRun}/{@link getRun} observes. Throws `HubSdkError`:
+	* `RUN_NOT_CANCELLABLE` when the run already finished, `NOT_FOUND` for an
+	* unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+	*/
+	async cancel(id, runId, opts = {}) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/cancel`, {
+			method: "POST",
+			...opts.signal ? { signal: opts.signal } : {}
+		});
+	}
+	/**
+	* Re-run a terminal failed/cancelled run: enqueues a FRESH run of the same
+	* workflow with the SAME trigger context the original ran against, linked
+	* back to it via `retriedFromRunId`. The original row is never mutated —
+	* execution is at-most-once, so a retry is always a new run, never a
+	* requeue. The response carries the NEW run id (and the run it retried);
+	* follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
+	* other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
+	* terminal-failed/cancelled (queued/running/waiting, or succeeded),
+	* `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+	* failure still retries. Pass `opts.signal` to abort a slow request.
+	*/
+	async retryRun(id, runId, opts = {}) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/retry`, {
+			method: "POST",
+			...opts.signal ? { signal: opts.signal } : {}
+		});
+	}
+	/**
+	* Stream a run's live progress as an async iterable of typed events. The
+	* first event is always a `snapshot` of the current persisted state; then
+	* `action.*` / `iteration.*` / `token` ticks arrive as the run executes;
+	* `ping` is a keepalive; a terminal `run.done` ends the iteration. If the run
+	* is already finished when the stream opens, it yields the snapshot then
+	* `run.done` and completes.
+	*
+	* Live ticks require the worker executing the run to share the API process;
+	* across instances only `snapshot` + `run.done` (from the server's terminal
+	* poll) arrive — the persisted record, read via {@link getRun}, stays the
+	* source of truth. Pass `signal` to cancel; iterating to `run.done` (or
+	* breaking early) releases the connection.
+	*
+	* A stream that ends before `run.done` or `run.waiting` (the Platform is
+	* restarting or handing over) is reopened after a second, as is one refused
+	* with `SERVICE_DRAINING`; the reopened stream starts with a fresh
+	* `snapshot`. After 30 reopens in a row that deliver nothing it throws
+	* `HubSdkError(WORKFLOW_STREAM_INTERRUPTED)`.
+	*/
+	async *watchRun(id, runId, opts = {}) {
+		const openStream = this.stream;
+		if (!openStream) throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: "watchRun needs a streaming transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly"
+		});
+		const path = `/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/events`;
+		let idleReopens = 0;
+		for (;;) {
+			let delivered = false;
+			const connection = this.watchRunOnce(openStream, path, opts);
+			try {
+				for (;;) {
+					const next = await connection.next();
+					if (next.done) {
+						if (next.value === "ended") return;
+						break;
+					}
+					delivered = true;
+					yield next.value;
+				}
+			} catch (error) {
+				if (!(error instanceof HubSdkError) || error.code !== "SERVICE_DRAINING" || opts.signal?.aborted) throw error;
+			} finally {
+				await connection.return("interrupted");
+			}
+			idleReopens = delivered ? 0 : idleReopens + 1;
+			if (idleReopens > MAX_IDLE_STREAM_REOPENS) throw new HubSdkError({
+				code: "WORKFLOW_STREAM_INTERRUPTED",
+				message: `the run event stream ended ${MAX_IDLE_STREAM_REOPENS} times without delivering an event`
+			});
+			await abortableDelay(STREAM_REOPEN_DELAY_MS, opts.signal);
+		}
+	}
+	/** One connection's events, then how it ended. */
+	async *watchRunOnce(openStream, path, opts) {
+		const reader = (await openStream(path, {
+			method: "GET",
+			headers: { Accept: "text/event-stream" },
+			...opts.signal ? { signal: opts.signal } : {}
+		})).getReader();
+		const decoder = new TextDecoder();
+		const parser = new SSEChunkParser({ transform: (raw) => {
+			try {
+				return JSON.parse(raw);
+			} catch {
+				return null;
+			}
+		} });
+		try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				const text = done ? decoder.decode() : decoder.decode(value, { stream: true });
+				const parsedEvents = done ? [...parser.push(text), ...parser.flush()] : parser.push(text);
+				for (const parsed of parsedEvents) {
+					const event = toRunStreamEvent(parsed.eventType, parsed.data);
+					if (!event) continue;
+					yield event;
+					if (event.type === "run.done" || event.type === "run.waiting") return "ended";
+				}
+				if (done) return "interrupted";
+			}
+		} finally {
+			await reader.cancel().catch(() => {});
+		}
+	}
+	/**
+	* Poll {@link getRun} until the run reaches a terminal state (`succeeded` or
+	* `failed`) and return its detail. The scripting primitive behind "run and
+	* print the result": pairs with {@link run} for a one-call trigger-and-wait.
+	*
+	* Returns as soon as the run leaves the active set (`queued` / `running`) —
+	* i.e. on `succeeded`, `failed`, or any future non-active status — so a new
+	* terminal state can never hang the wait. Polls every `pollIntervalMs`
+	* (default 2000). With `timeoutMs` set, throws
+	* `HubSdkError(WORKFLOW_RUN_TIMEOUT)` — carrying the last observed status on
+	* `details.status` — only once the deadline has actually passed; the last
+	* wait is clamped to the remaining time so a `timeoutMs` shorter than the
+	* poll interval still waits the full requested window rather than giving up a
+	* poll early. Pass `signal` to cancel the wait between polls.
+	*/
+	async waitForRun(id, runId, opts = {}) {
+		const pollIntervalMs = opts.pollIntervalMs ?? 2e3;
+		if (!Number.isFinite(pollIntervalMs) || pollIntervalMs <= 0) throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `waitForRun pollIntervalMs must be a positive number (got ${opts.pollIntervalMs})`
+		});
+		if (opts.timeoutMs !== void 0 && (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs <= 0)) throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: `waitForRun timeoutMs must be a positive number (got ${opts.timeoutMs})`
+		});
+		const deadline = opts.timeoutMs !== void 0 ? Date.now() + opts.timeoutMs : null;
+		const timeoutError = (status) => new HubSdkError({
+			code: "WORKFLOW_RUN_TIMEOUT",
+			message: `Workflow run ${runId} did not reach a terminal state within ${opts.timeoutMs}ms${status ? ` (last status: ${status})` : ""}`,
+			details: {
+				runId,
+				status,
+				timeoutMs: opts.timeoutMs
+			}
+		});
+		let lastStatus;
+		for (;;) {
+			if (opts.signal?.aborted) throw opts.signal.reason ?? /* @__PURE__ */ new Error("The operation was aborted");
+			const remainingMs = deadline !== null ? deadline - Date.now() : null;
+			if (remainingMs !== null && remainingMs <= 0) throw timeoutError(lastStatus);
+			const pollSignal = combineAbortSignals(opts.signal, remainingMs);
+			let run;
+			try {
+				run = await this.getRun(id, runId, pollSignal ? { signal: pollSignal } : {});
+			} catch (err) {
+				if (opts.signal?.aborted) throw err;
+				if (deadline !== null && isAbortError(err)) throw timeoutError(lastStatus);
+				throw err;
+			}
+			lastStatus = run.status;
+			if (run.status !== "queued" && run.status !== "running") return run;
+			const delayRemainingMs = deadline !== null ? deadline - Date.now() : null;
+			if (delayRemainingMs !== null && delayRemainingMs <= 0) throw timeoutError(lastStatus);
+			await delay(delayRemainingMs !== null ? Math.min(pollIntervalMs, delayRemainingMs) : pollIntervalMs, opts.signal);
+		}
+	}
+	/**
+	* The workflow's definition history, newest rev first — metadata only (rev,
+	* attribution, note); fetch the YAML per-rev with {@link getRevision}. Empty
+	* for a pre-versioning workflow until its next update.
+	*/
+	async listRevisions(id) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/revisions`, { method: "GET" });
+	}
+	/**
+	* One revision WITH its YAML (and the actions compiled alongside it), for
+	* diff/inspect views. Throws `HubSdkError(REVISION_NOT_FOUND)` for an
+	* unknown rev, `NOT_FOUND` for an unknown/foreign workflow.
+	*/
+	async getRevision(id, rev) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/revisions/${encodeURIComponent(String(rev))}`, { method: "GET" });
+	}
+	/**
+	* Restore a prior rev's YAML as a NEW head revision (history is append-only)
+	* through the same compile path as {@link update}, so the restored definition
+	* is re-validated against today's connections/models. Throws `HubSdkError`:
+	* `REVISION_NOT_FOUND` for an unknown rev, `WORKFLOW_INVALID` when the old
+	* YAML no longer compiles, `CONFLICT` on a concurrent modification.
+	*/
+	async rollback(id, rev) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/rollback`, jsonInit("POST", { rev }));
+	}
+	/**
+	* Deterministic health stats over the workflow's last N terminal runs
+	* (default 20, max 100): per-node visits/failures/cost/duration, failure
+	* clusters by normalized error signature, and distillation CANDIDATES
+	* (agent.run nodes with near-static outputs — labeled with their
+	* measurements, never as verdicts). No model in this path.
+	*/
+	async health(id, opts = {}) {
+		const query = opts.runs !== void 0 ? `?runs=${opts.runs}` : "";
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/health${query}`, { method: "GET" });
+	}
+	/**
+	* One agent round's execution timeline, paged. `action` is the action's
+	* `${steps[N]}` position and `iteration` the round's position in that
+	* action's `iterations` — both exactly as the run detail serializes them.
+	* Pass the previous page's `nextCursor` as `after` for the next page; a null
+	* `nextCursor` means the round is fully read.
+	*/
+	async listRunSteps(id, runId, input) {
+		const params = new URLSearchParams({
+			action: String(input.action),
+			iteration: String(input.iteration)
+		});
+		if (input.after !== void 0) params.set("after", String(input.after));
+		if (input.limit !== void 0) params.set("limit", String(input.limit));
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/steps?${params.toString()}`, { method: "GET" });
+	}
+	/**
+	* Store one artifact for a run (raw bytes) and return the opaque ref — the
+	* value a script.run node returns as its step output. `contentType` defaults
+	* to `application/octet-stream`; `nodeId` attributes the write to a graph
+	* node (owner credential only — a run-scoped token binds its own node).
+	* Throws `HubSdkError(ARTIFACT_TOO_LARGE)` past the server cap.
+	*/
+	async uploadArtifact(id, runId, input) {
+		const headers = {
+			"Content-Type": input.contentType ?? "application/octet-stream",
+			"x-wf-artifact-name": input.name
+		};
+		if (input.nodeId !== void 0) headers["x-wf-artifact-node"] = input.nodeId;
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/artifacts`, {
+			method: "POST",
+			body: input.bytes,
+			headers
+		});
+	}
+	/** Metadata for every artifact of the run (never the bytes), oldest first. */
+	async listArtifacts(id, runId) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/artifacts`, { method: "GET" });
+	}
+	/**
+	* The artifact's raw bytes with their stored content type — the route every
+	* `downloadUrl` attached to an `$artifact` ref in a run detail points at.
+	*/
+	async downloadArtifact(id, runId, artifactId) {
+		const downloadBytes = this.download;
+		if (!downloadBytes) throw new HubSdkError({
+			code: "HUB_CONFIG_INVALID",
+			message: "downloadArtifact needs a byte transport; use HubClient (which wires it up) rather than constructing HubWorkflowsClient directly"
+		});
+		return downloadBytes(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}`, { method: "GET" });
+	}
+	/** The curated starter gallery runnable on THIS deployment: metadata,
+	*  parameters, referenced providers, and a concrete `previewYaml` per card. */
+	async listTemplates() {
+		return this.request("/v1/workflows/templates", { method: "GET" });
+	}
+	/**
+	* One-click create from a gallery template: substitutes `parameters` into
+	* the template server-side, then runs the SAME create path as
+	* {@link create}. A `{ created: false }` result is NOT an error — an
+	* actionable continuation listing the connections to satisfy before
+	* retrying. Invalid parameters or a compile failure throw `HubSdkError`
+	* (400); an unknown template id throws `NOT_FOUND`.
+	*/
+	async instantiateTemplate(templateId, parameters) {
+		return this.request(`/v1/workflows/templates/${encodeURIComponent(templateId)}/instantiate`, jsonInit("POST", parameters ? { parameters } : {}));
+	}
+	/**
+	* The caller's open decisions across all workflows — the always-available
+	* "pending approvals" surface. Each entry carries its workflow's name (null
+	* when the workflow was deleted while the run was parked).
+	*/
+	async listPendingDecisions() {
+		return this.request("/v1/workflows/decisions/pending", { method: "GET" });
+	}
+	/**
+	* The pending decision a run is parked on. Throws `HubSdkError(NOT_FOUND)`
+	* when the run is unknown/foreign or holds no pending decision.
+	*/
+	async getRunDecision(id, runId) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision`, { method: "GET" });
+	}
+	/**
+	* Answer the decision a run is parked on and resume it from the next action.
+	* `decisionId` is REQUIRED: a run can resolve one decision and re-park on the
+	* next, so an answer addressed only by run could silently land on a question
+	* the caller never saw — a mismatch throws `HubSdkError(DECISION_SUPERSEDED)`.
+	* Other typed failures: `INVALID_CHOICE` (400), `DECISION_ALREADY_RESOLVED` /
+	* `DECISION_EXPIRED` (409), `DECISION_NOT_FOUND` (404), `RUN_NOT_WAITING`
+	* (409 — answered, timed out, or cancelled first).
+	*/
+	async resolveRunDecision(id, runId, input) {
+		return this.request(`/v1/workflows/${encodeURIComponent(id)}/runs/${encodeURIComponent(runId)}/decision/resolve`, jsonInit("POST", input));
+	}
+	/**
+	* Dry-run a YAML definition against the platform compiler without saving it.
+	*
+	* `opts.structural` selects the CI mode: the platform skips its owner-scoped
+	* connection/skill/profile resolution, so the verdict depends only on the
+	* definition and the deployment's capabilities — identical no matter which
+	* providers the calling account has connected. Use it in pipelines that
+	* assert "this YAML is well-formed"; leave it off in an editor, where naming
+	* the unconnected providers is the point.
+	*/
+	async validate(yaml, opts = {}) {
+		return this.request("/v1/workflows/validate", jsonInit("POST", {
+			yaml,
+			...opts.structural ? { structural: true } : {}
+		}));
+	}
+	async schema() {
+		return this.request("/v1/workflows/schema", { method: "GET" });
+	}
+};
+//#endregion
+//#region src/client.ts
+function isDispatchCurrentData(value) {
+	return isRecord(value) && typeof value.current === "boolean";
+}
+var HubClient = class HubClient extends HubTransport {
+	knowledge;
+	allowances;
+	apps;
+	connections;
+	channels;
+	numbers;
+	eventSubscriptions;
+	permissions;
+	tokens;
+	tools;
+	approvals;
+	audit;
+	githubApp;
+	workflows;
+	lines;
+	constructor(options) {
+		super(options);
+		this.knowledge = new HubKnowledgeClient((path, init) => this.request(path, init));
+		this.allowances = new HubAllowancesClient((path, init) => this.request(path, init));
+		this.apps = new HubAppsClient((path, init) => this.request(path, init));
+		this.numbers = new HubManagedNumbersClient((path, init) => this.request(path, init));
+		this.connections = new HubConnectionsClient((path, init) => this.request(path, init));
+		this.channels = new HubChannelsClient((path, init) => this.request(path, init));
+		this.eventSubscriptions = new HubEventSubscriptionsClient((path, init) => this.request(path, init));
+		this.permissions = new HubPermissionsClient((path, init) => this.request(path, init));
+		this.tokens = new HubTokensClient((path, init) => this.request(path, init));
+		this.tools = new HubToolsClient((path, init) => this.request(path, init));
+		this.approvals = new HubApprovalsClient((path, init) => this.request(path, init));
+		this.audit = new HubAuditClient((path, init) => this.request(path, init));
+		this.githubApp = new HubGithubAppClient((path, init) => this.request(path, init));
+		this.workflows = new HubWorkflowsClient((path, init) => this.request(path, init), (path, init) => this.stream(path, init), (path, init) => this.requestBytes(path, init));
+		this.lines = new HubLinesClient((path, init) => this.request(path, init), (yaml) => this.workflows.create(yaml), (path, init, callbackBearer) => {
+			if (typeof callbackBearer !== "string" || !/^[\x21-\x7e]{16,512}$/.test(callbackBearer)) throw new HubSdkError({
+				code: "HUB_INVALID_INPUT",
+				message: "Application callback bearer is invalid"
+			});
+			const headers = new Headers(init.headers);
+			headers.set("Authorization", `Bearer ${callbackBearer}`);
+			return this.request(path, {
+				...init,
+				headers,
+				credentials: "omit",
+				redirect: "manual"
+			}, {
+				auth: "caller",
+				validateData: isDispatchCurrentData
+			});
+		});
+	}
+	static fromEnv(options = {}) {
+		const env = options.env ?? readProcessEnv();
+		return new HubClient({
+			baseUrl: resolveHubBaseUrl(env),
+			apiKey: options.apiKey ?? (options.authHeaders ? void 0 : resolveHubAuth(env)),
+			authHeaders: options.authHeaders,
+			fetch: options.fetch
+		});
+	}
+	async status() {
+		return this.request("/v1/hub/status", { method: "GET" });
+	}
+	/**
+	* Open a streaming (Server-Sent Events) response and return its raw body.
+	* Shares auth-header building + `fetch` with {@link request}, but does NOT
+	* buffer or JSON-parse the body — the caller consumes the stream.
+	*
+	* A successful stream comes back as `text/event-stream`. Anything else is an
+	* error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+	* page); it is surfaced the same way {@link request} surfaces errors — a
+	* typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+	* `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+	*/
+	async stream(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok || !contentType.includes("text/event-stream")) await throwHubResponseError(path, response, status, contentType);
+		if (!response.body) throw httpError(path, status, response.statusText, "event-stream response had no body", contentType);
+		return response.body;
+	}
+	/**
+	* Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+	* the artifact's own content type, not JSON. Error responses on such routes
+	* are still the standard envelope, so a failure surfaces exactly like
+	* {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+	* otherwise an `HUB_HTTP_<status>` transport error.
+	*/
+	async requestBytes(path, init) {
+		const response = await this.fetch(`${this.baseUrl}${path}`, {
+			...init,
+			headers: await this.buildHeaders(init.headers)
+		});
+		const status = response.status;
+		const contentType = response.headers.get("content-type") ?? "";
+		if (!response.ok) await throwHubResponseError(path, response, status, contentType);
+		return {
+			bytes: new Uint8Array(await response.arrayBuffer()),
+			contentType
+		};
+	}
+};
+//#endregion
+export { HubLinesClient as C, HubAllowancesClient as D, HubAppsClient as E, jsonInit as O, HubManagedNumbersClient as S, HubKnowledgeManagementClient as T, resolveHubBaseUrl as _, HubChannelsClient as a, isHubUnauthenticated as b, HubInboundWebhooksClient as c, HubPermissionsClient as d, HubTokensClient as f, resolveHubAuth as g, HUB_URL_ENV_VAR as h, HubGithubAppClient as i, HubToolsClient as l, HUB_CAPABILITY_TOKEN_ENV_VAR as m, HubWorkflowsClient as n, HubEventSubscriptionsClient as o, HUB_API_KEY_ENV_VAR as p, HubAuditClient as r, HubConnectionsClient as s, HubClient as t, HubApprovalsClient as u, HubSdkError as v, HubKnowledgeClient as w, redactHubValue as x, HubTransport as y };
+
+//# sourceMappingURL=client-CsdLLECZ.js.map