@tangle-network/hub-sdk 0.30.0-develop.20260820004536.f384cca → 0.30.0

package/dist/index.d.ts

@@ -1,3 +1,245 @@
+//#region src/allowances.d.ts
+/**
+ * Allowances: a developer's per-member daily allowance on a meter, and the
+ * paywall decision past it. The platform counts every admitted turn and reads
+ * each payer's dollars from the ledger; the app keeps only its checkout and
+ * records a paying member with {@link HubAllowancesClient.grant}.
+ *
+ * Only the meter's owner may call these, signed in or with a root API key of
+ * their own. A delegated or resource-bound key, such as the key a hosted end
+ * user's sandbox runs on, is refused.
+ */
+type HubAllowanceTier = "free" | "paid" | "owner";
+type HubAllowanceRole = "owner" | "member";
+interface HubAllowancePlanInput {
+  free: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+  };
+  /** Null turns billing off: past the free allowance nothing lifts the limit. */
+  paid: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+    priceUsdMonthly: number;
+  } | null;
+  owner?: {
+    turnsPerDay: number;
+  };
+  /** Key resource type whose ledger spend counts against a payer's dollars. */
+  spendResourceType: string | null;
+}
+interface HubAllowancePlan extends HubAllowancePlanInput {
+  meter: string;
+  owner: {
+    turnsPerDay: number;
+  };
+  /** False while the meter runs on the default plan. */
+  configured: boolean;
+  updatedAt: string | null;
+}
+interface HubAllowanceSubject {
+  member: string;
+  role?: HubAllowanceRole;
+  /** The member whose keys pay for the turn, when that is someone else. */
+  payer?: string;
+  payerRole?: HubAllowanceRole;
+}
+interface HubAllowanceDecision {
+  /** `paywall`: paying lifts the limit. `allowance_reached`: nothing does today. */
+  decision: "admit" | "paywall" | "allowance_reached";
+  tier: HubAllowanceTier;
+  paywall: boolean;
+  turns: {
+    used: number;
+    limit: number;
+  };
+  usd: {
+    spent: number;
+    limit: number;
+    remaining: number;
+  } | null;
+  day: string;
+  resetsAt: string;
+  /**
+   * A paying payer's spend in the current paid period against what funds it:
+   * the plan price less Tangle's 10% fee, plus the free daily allowance for
+   * the period. A paid turn is refused once `remaining` is gone.
+   */
+  period?: {
+    spent: number;
+    funded: number;
+    remaining: number;
+    startsAt: string;
+    endsAt: string;
+  };
+  replay?: boolean;
+}
+interface HubAllowanceUsage {
+  day: string;
+  turns: number;
+  members: Array<{
+    member: string;
+    turns: number;
+    tier: HubAllowanceTier;
+    usdSpent: number | null;
+  }>;
+  lines: Array<{
+    line: string;
+    turns: number;
+  }>;
+}
+interface HubAllowanceSyncInput {
+  source: string;
+  revision: number;
+  expiresAt: string | null;
+  reference: string | null;
+}
+interface HubAllowanceSyncReceipt extends HubAllowanceSyncInput {
+  member: string;
+}
+interface HubAllowanceGrant {
+  member: string;
+  tier: "paid";
+  expiresAt: string;
+  reference: string | null;
+}
+declare class HubAllowancesClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  plan(meter: string): Promise<HubAllowancePlan>;
+  setPlan(meter: string, plan: HubAllowancePlanInput): Promise<HubAllowancePlan>;
+  /** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+  admit(meter: string, input: HubAllowanceSubject & {
+    turnId: string;
+    line?: string;
+    channel?: string;
+  }): Promise<HubAllowanceDecision>;
+  /** What the member's next turn would get, without counting anything. */
+  status(meter: string, subject: HubAllowanceSubject): Promise<HubAllowanceDecision>;
+  /** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+  grant(meter: string, member: string, input: {
+    expiresAt: string;
+    reference?: string | null;
+  }): Promise<HubAllowanceGrant>;
+  /** Synchronize a paid grant by durable product revision. Null expiry writes
+   * a retained revocation. A delayed older update is refused, never reactivated.
+   * There is no fallback to the unversioned grant endpoint on older servers. */
+  syncGrant(meter: string, member: string, input: HubAllowanceSyncInput): Promise<HubAllowanceSyncReceipt>;
+  revoke(meter: string, member: string): Promise<void>;
+  /** Turns per member and per line on one UTC day (default today). */
+  usage(meter: string, day?: string): Promise<HubAllowanceUsage>;
+  private path;
+  private memberPath;
+  private body;
+}
+//#endregion
+//#region src/apps.d.ts
+/** The compliance claim an owner latches through a BAA acceptance. Positive
+ * claims only: `{ hipaa: true }` or absent — `hipaa: false` is unspellable. */
+interface HubAppComplianceClaim {
+  hipaa: true;
+}
+/** Owner-facing compliance state: the latched claim and the acceptance behind it. */
+interface HubAppComplianceState {
+  compliance: HubAppComplianceClaim | null;
+  agreement: {
+    version: string;
+    url: string;
+  } | null;
+  acceptance: {
+    agreementVersion: string;
+    agreementUrl: string;
+    acceptedByUserId: string;
+    acceptedAt: string;
+  } | null;
+}
+/** App identity and customer permissions over the existing Platform transport.
+ * These operations do not authorize spending or expose upstream credentials. */
+interface HubApp {
+  id: string;
+  clientId: string;
+  oauthClientId: string | null;
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl: string | null;
+  accessPayer?: "user" | "app-owner";
+  /** Latched HIPAA declaration; absent or null means "no claim". */
+  compliance?: HubAppComplianceClaim | null;
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubAppCreateInput {
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl?: string;
+  /** The registered app owner funds eligibility; customer permissions remain separate. */
+  accessPayer?: "user" | "app-owner";
+  /** Associate an existing owned login client in the same transaction as creation. */
+  oauthClientId?: string;
+}
+interface HubAppGrant {
+  id: string;
+  appId: string;
+  userId: string;
+  connectionId: string;
+  scopes: string[];
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+  revokedAt: string | null;
+  /** Display metadata is additive; older deployments may omit it. */
+  appName?: string | null;
+  oauthClientId?: string | null;
+  providerId?: string | null;
+  accountDisplay?: string | null;
+  connectionDisplayName?: string | null;
+}
+interface HubAppGrantRevoked {
+  grantId: string;
+  status: "revoked";
+  revokedAt: string | null;
+  tokensRevoked: number;
+}
+declare class HubAppsClient {
+  private readonly request;
+  readonly grants: {
+    list: () => Promise<HubAppGrant[]>;
+    revoke: (grantId: string) => Promise<HubAppGrantRevoked>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  list(): Promise<HubApp[]>;
+  /** The secret is returned only by creation; keep it in your server vault. */
+  create(input: HubAppCreateInput): Promise<{
+    app: HubApp;
+    clientSecret: string;
+  }>;
+  /** Immutable association of two existing records with the same owner. */
+  linkOAuthClient(appId: string, clientId: string): Promise<{
+    appId: string;
+    oauthClientId: string;
+  }>;
+  revoke(appId: string): Promise<{
+    appId: string;
+    grantsRevoked: number;
+    tokensRevoked: number;
+  }>;
+  /** Current latched compliance state and the BAA acceptance behind it. */
+  getCompliance(appId: string): Promise<HubAppComplianceState>;
+  /**
+   * Latch HIPAA compliance for this app. The request MUST carry the exact
+   * `agreementVersion` the deployment currently offers — the acceptance is
+   * recorded before the claim exists, and the claim can never be cleared:
+   * `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+   */
+  setCompliance(appId: string, input: {
+    hipaa: boolean;
+    agreementVersion?: string;
+  }): Promise<HubAppComplianceState>;
+}
+//#endregion
 //#region src/types.d.ts
 type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
 interface HubSuccessEnvelope<TData> {
@@ -14,7 +256,7 @@ interface HubErrorBody {
   message: string;
   details?: unknown;
 }
-type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
 interface HubStatusResponse {
   contract: unknown;
   principal: HubPrincipal;
@@ -36,6 +278,7 @@ interface HubConnection {
   providerId: string;
   displayName: string;
   accountDisplay: string | null;
+  providerAccountId: string | null;
   scopes: string[];
   status: "active" | "revoked" | "unhealthy" | "reconnect_required";
   health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
@@ -222,6 +465,7 @@ interface HubOAuthStartRequest {
   returnUrl?: string;
   cli?: boolean;
   connectionParameters?: Record<string, string>;
+  requestedScopes?: readonly string[];
 }
 interface HubOAuthCallbackSuccessQuery {
   provider: string;
@@ -252,6 +496,9 @@ interface HubWhatsappEmbeddedSignupStartResponse {
   appId: string;
   configId: string;
   sdkVersion: string;
+  /** Embedded Signup flow the login configuration selects. "v4" takes empty
+   *  extras; "v2" needs featureType and sessionInfoVersion. Absent means "v2". */
+  signupVersion?: "v2" | "v4";
   state: string;
   expiresAt: string;
   scopes: string[];
@@ -282,7 +529,18 @@ interface HubOAuthCallbackResponse {
 interface HubApiKeyConnectRequest {
   provider: string;
   apiKey: string;
+  /** Connector-owned setup values. Hub validates them before testing the key. */
+  metadata?: HubApiKeyConnectionMetadata;
 }
+type HubApiKeyConnectionMetadata = {
+  propertyId: string;
+  currency?: string;
+} | {
+  listings: Array<{
+    id: string;
+    pms: string;
+  }>;
+};
 /** Result of an api-key connect: the created (or reconnected) connection.
  *  Synchronous — there is no redirect leg, unlike the OAuth flow. */
 interface HubApiKeyConnectResponse {
@@ -527,7 +785,7 @@ interface HubGithubAppInstallation {
   accountType: string | null;
   /** "all" ⇒ every repo under the account; "selected" ⇒ only repoFullNames. */
   repositorySelection: "all" | "selected";
-  /** Lowercased "owner/repo" — empty when repositorySelection = "all". */
+  /** Metadata omits names; use githubApp.listRepos(id) for a live caller-safe list. */
   repoFullNames: string[];
   suspended: boolean;
 }
@@ -580,8 +838,10 @@ interface HubGithubAppSyncResponse {
 }
 interface HubGithubAppListReposResponse {
   installationId: number;
-  /** Lowercased "owner/repo" — covers the full registry view of the install. */
+  /** Complete live intersection of App coverage and the caller's GitHub access. */
   repoFullNames: string[];
+  /** True only when both upstream listings completed; failures return an error. */
+  complete: true;
 }
 interface HubGithubAppIsRepoInstalledRequest {
   owner: string;
@@ -612,10 +872,14 @@ interface HubWorkflowTrigger {
   timezone: string | null;
   nextFireAt: string | null;
   lastFiredAt: string | null;
+  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
+  until: string | null;
 }
 interface HubWorkflowValidationError {
   path: string;
   message: string;
+  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
+  code?: string;
 }
 type HubWorkflowRunStatus = "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled";
 /** One agent iteration of an `agent.run`, as the single-run detail carries it
@@ -1222,6 +1486,624 @@ interface HubWorkflowRunStepsPage {
   nextCursor: number | null;
 }
 //#endregion
+//#region src/broker.d.ts
+interface HubAppBrokerOptions {
+  baseUrl: string;
+  clientId: string;
+  clientSecret: string;
+  fetch?: typeof fetch;
+}
+interface HubAppBrokerToken {
+  accessToken: string;
+  expiresIn: number;
+  scopes: string[];
+}
+interface HubAppBrokerExchange extends HubAppBrokerToken {
+  grantId: string;
+  connectionId: string;
+}
+/** Server-only client. App secrets never become a user's general API key.
+ * Every invocation mints and consumes one short-lived, exact-grant token. */
+declare class HubAppBrokerClient {
+  private readonly options;
+  private readonly baseUrl;
+  private readonly fetcher;
+  constructor(options: HubAppBrokerOptions);
+  private token;
+  private readToken;
+  exchange(input: {
+    code: string;
+    redirectUri: string;
+    connectionId: string;
+  }): Promise<HubAppBrokerExchange>;
+  mint(grantId: string): Promise<HubAppBrokerToken>;
+  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
+}
+//#endregion
+//#region src/inbound-webhooks.d.ts
+/** Provider setup uses the existing authenticated Hub transport and vault. */
+interface HubInboundWebhookCreateOptions {
+  /** Inkbox identity that owns all selected channels. */
+  identityId?: string;
+  mailboxId?: string;
+  phoneNumberId?: string;
+  imessage?: boolean;
+  /** Linq: explicit owned lines; omitted does not mean every account line. */
+  phoneNumbers?: string[];
+  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
+  phoneNumberIds?: string[];
+  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
+  signingSecret?: string;
+}
+interface HubInboundWebhookCreateResponse {
+  url: string;
+  /** True only when the provider subscription was created by the server. */
+  provisioned?: boolean;
+  /** Self-configured legacy providers can return a newly minted secret once. */
+  secret?: string;
+  inboundAddress?: string;
+  requiresProviderSetup?: boolean;
+}
+interface HubInboundWebhookStatus {
+  configured: boolean;
+  url?: string;
+  /** Configuration is not evidence of a real delivered message. */
+  deliveryVerified: false;
+  requiresProviderSetup?: boolean;
+}
+/** Live provider readback for one explicitly selected Linq WhatsApp number. */
+interface HubInboundPhoneNumberScope {
+  configured: true;
+  provisioned: true;
+  subscribed: true;
+  phoneNumberIds: string[];
+}
+declare class HubInboundWebhooksClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
+  get(connectionId: string): Promise<HubInboundWebhookStatus>;
+  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
+  /** Remove event subscriptions first. This does not silently rotate a live URL. */
+  delete(connectionId: string): Promise<{
+    removed: boolean;
+  }>;
+  private path;
+}
+//#endregion
+//#region src/knowledge-management.d.ts
+interface KnowledgeReference {
+  sourceId: string;
+  generation: string;
+}
+/** Connection references only. Provider credentials never enter this contract. */
+interface KnowledgeEmbeddingSpace {
+  connectionId: string;
+  model: string;
+  dimensions: number;
+}
+type KnowledgeSourceInput = {
+  kind: "file";
+  name: string;
+  base64: string;
+  mediaType: string;
+} | {
+  kind: "git";
+  connectionId: string;
+  owner: string;
+  repo: string;
+  ref: string;
+  pathPrefix?: string;
+} | {
+  kind: "url";
+  url: string;
+} | {
+  kind: "s3";
+  connectionId: string;
+  bucket: string;
+  prefix: string;
+} | {
+  kind: "vector";
+  connectionId: string;
+  provider: "pinecone" | "qdrant" | "weaviate";
+  indexName: string;
+  namespace?: string;
+  embedding: KnowledgeEmbeddingSpace;
+  textField: string;
+  sourceUriField: string;
+};
+interface KnowledgeCapability {
+  supported: boolean;
+  reason?: string;
+}
+interface KnowledgeCapabilities {
+  delegation?: KnowledgeCapability & {
+    resource?: string;
+    scopes?: string[];
+  };
+  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
+  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
+  managedVector: KnowledgeCapability;
+  file: {
+    mediaTypes: string[];
+    maxBytes: number;
+    maxObjects: number;
+  };
+}
+interface KnowledgeSourceSummary {
+  /** Required query authorization, not proof that an owner policy currently permits it. */
+  retrieval?: {
+    kind: "lexical";
+  } | {
+    kind: "vector";
+    embeddingPolicy: {
+      connectionId: string;
+      actionPath: "openai.embeddings.create";
+      scope: "owner-connection-action";
+    };
+  };
+  id: string;
+  name: string;
+  kind: KnowledgeSourceInput["kind"];
+  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
+  approval?: {
+    id: string;
+    path: string;
+    preview: {
+      provider: string;
+      connectionId: string;
+      collection: string;
+      sourceId: string;
+      requestId: string;
+      embedding: KnowledgeEmbeddingSpace;
+      chunkCount: number;
+      sourceCount: number;
+      dataSharing: string;
+    };
+  };
+  refreshRequestId?: string;
+  generation: string | null;
+  lastError: {
+    code: string;
+    message: string;
+  } | null;
+  updatedAt: string;
+}
+type KnowledgeAttachmentAuthorization = {
+  status: "active";
+} | {
+  status: "unavailable";
+  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+};
+interface KnowledgeAttachment {
+  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
+  authorization?: KnowledgeAttachmentAuthorization;
+  id: string;
+  sourceId: string;
+  sandboxId: string;
+  generation: string;
+  status: "active" | "detached";
+}
+interface KnowledgeSourceCreate {
+  requestId: string;
+  name: string;
+  source: KnowledgeSourceInput;
+  target?: {
+    kind: "lexical";
+  } | {
+    kind: "managed-vector";
+    provider: "qdrant";
+    connectionId: string;
+    embedding: KnowledgeEmbeddingSpace;
+  };
+}
+/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
+interface KnowledgeAuthorization {
+  userId: string;
+  clientId: string;
+  resource: string;
+  scopes: Array<"knowledge:read" | "knowledge:write">;
+}
+declare class HubKnowledgeManagementClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  materialize(input: {
+    sandboxId: string;
+    references: KnowledgeReference[];
+  }): Promise<KnowledgeAttachment[]>;
+  authorization(): Promise<KnowledgeAuthorization>;
+  disconnectAuthorization(): Promise<{
+    revoked: true;
+  }>;
+  capabilities(): Promise<KnowledgeCapabilities>;
+  list(): Promise<KnowledgeSourceSummary[]>;
+  get(sourceId: string): Promise<KnowledgeSourceSummary>;
+  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
+  refresh(sourceId: string, input: {
+    requestId: string;
+    approvalToken?: string;
+  }): Promise<KnowledgeSourceSummary>;
+  attach(sourceId: string, input: {
+    sandboxId: string;
+    generation: string;
+    expectedGeneration?: string;
+  }): Promise<KnowledgeAttachment>;
+  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
+  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+}
+//#endregion
+//#region src/knowledge.d.ts
+interface HubKnowledgeRetrievalResult {
+  attachmentId: string;
+  generation: string;
+  provenance: "ingested" | "record-supplied";
+  hits: Array<{
+    id: string;
+    title: string;
+    snippet: string;
+    score?: number;
+    citations?: Array<{
+      sourceId: string;
+      sourceUri: string;
+      revision?: string;
+    }>;
+  }>;
+  elapsedMs?: number;
+}
+interface HubKnowledgeQueryResult {
+  results: HubKnowledgeRetrievalResult[];
+  /** Individual unavailable sources do not hide evidence from healthy sources. */
+  failures: Array<{
+    attachmentId: string;
+    code: string;
+    message: string;
+  }>;
+  partial: boolean;
+}
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+ * scope on the server; neither a caller nor an agent can supply another scope. */
+declare class HubKnowledgeClient {
+  private readonly request;
+  readonly management: HubKnowledgeManagementClient;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  bindings(): Promise<{
+    references: KnowledgeReference[];
+  }>;
+  query(input: {
+    query: string;
+    limit?: number;
+    expectedReferences?: KnowledgeReference[];
+  }, options?: {
+    signal?: AbortSignal;
+  }): Promise<HubKnowledgeQueryResult>;
+}
+//#endregion
+//#region src/lines.d.ts
+interface HubLineMember {
+  id: string;
+  label: string | null;
+  role: string;
+  self?: boolean;
+  consent?: "enabled" | "required";
+}
+interface HubLineContext {
+  self: {
+    id: string;
+    label: string | null;
+    role: string;
+  };
+  line: {
+    id: string;
+    label: string | null;
+    transport: string;
+  };
+  members: HubLineMember[];
+  capabilities: Record<string, {
+    allowed: boolean;
+    reason?: string;
+  }>;
+  pendingReminders: Array<{
+    messageId: string;
+    wakeAt?: string;
+    prompt: string | null;
+  }>;
+  quotas: {
+    selfMessagesToday: number;
+    selfMessagesPerDay: number;
+    selfMessagesPending: number;
+    selfMessagesPendingLimit: number;
+  };
+}
+interface HubLineSendInput {
+  toMember: string;
+  text: string;
+  notBefore?: string;
+  onBehalfOf?: string;
+  idempotencyKey?: string;
+}
+/** An asset URL safe to share with the recipient and provider. Hub never fetches it.
+ * Meta WhatsApp API-key lines send it with `text` as the caption. Other transports refuse it.
+ * Use public HTTPS without a query, fragment or credentials. */
+interface HubLineImage {
+  url: string;
+}
+interface HubLineOwnerSendInput {
+  memberId: string;
+  text: string;
+  image?: HubLineImage;
+  notBefore?: string;
+  idempotencyKey: string;
+  /** Ask a coded question; the member's reply that starts with `code` returns here. */
+  reply?: HubLineReplyCodeInput;
+}
+interface HubLineReplyCodeInput {
+  /** A letter, then up to seven letters or digits, with at least one digit (`F7`). Hub compares it case-insensitively. */
+  code: string;
+  /** 60 to 604800; the window opens when the send first becomes eligible. */
+  ttlSeconds: number;
+  /**
+   * 1 to 20 distinct texted choices, each 1-32 of `a-z 0-9 _ -` after lower-casing.
+   * An answer must then be `<code> <option>[ <note>]`; any other coded text keeps the question open.
+   */
+  options?: string[];
+}
+/** The coded question's state on an owner send receipt. */
+interface HubLineReplyCode {
+  /** Upper case. */
+  code: string;
+  expiresAt: string;
+  /** The first coded answer; `text` is null after content retention ends. */
+  answer: {
+    messageId: string;
+    text: string | null;
+    receivedAt: string; /** The named option, lower case; null when the send listed no options. */
+    option: string | null; /** Words after the option; null when there were none or retention ended. */
+    note: string | null;
+  } | null;
+}
+interface HubLineReminderInput {
+  text: string;
+  notBefore: string;
+  idempotencyKey: string;
+}
+interface HubLineApplicationDispatchCurrentInput {
+  attachmentId: string;
+  memberId: string;
+  memberRevision: string;
+  senderAddress: string;
+  textSha256: string;
+  binding: string;
+  dispatchFence: string;
+  dispatchDeadline: string;
+}
+interface HubLineMemberApplication {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  status: "active" | "revoked";
+  application: {
+    url: string;
+    binding: string;
+  };
+  /** Hub's name for the app at this callback; present on reads. */
+  app?: {
+    name: string;
+  };
+  createdAt: string;
+  revokedAt: string | null;
+}
+interface HubLineMemberApplicationInput {
+  expectedSelectionId: string | null;
+  expectedMemberRevision: string;
+  subjectId: string;
+  application: {
+    url: string;
+    binding: string;
+    secret: string;
+  };
+}
+interface HubLineSendReceipt {
+  message: {
+    id: string;
+    status: string;
+    text: string | null;
+    image?: HubLineImage;
+  };
+  eligibleAt: string | null;
+  expiresAt: string;
+  /** Null when the send asked no coded question; absent from Hub before reply codes. */
+  reply?: HubLineReplyCode | null;
+}
+interface HubLineReminderReceipt {
+  state: "queued" | "skipped";
+  lineId: string;
+  messageId?: string;
+  sessionId?: string;
+  completion?: string;
+  reason?: string;
+}
+interface HubLineScheduledSendOptions {
+  lineId: string;
+  memberId: string;
+  text: string;
+  timezone: string;
+  name?: string;
+  notBefore?: string;
+  /**
+   * RFC 3339 instant the schedule stops at. Required when the calling key
+   * expires, and no later than that expiry: a schedule never outlives the
+   * key that wrote it.
+   */
+  until?: string;
+}
+interface HubLineCheckinOptions {
+  lineId: string;
+  member: string;
+  timezone: string;
+  prompt: string;
+  name?: string;
+  /** RFC 3339 instant the schedule stops at; see {@link HubLineScheduledSendOptions.until}. */
+  until?: string;
+}
+/** Line calls share HubClient authentication and envelope handling. */
+declare class HubLinesClient {
+  private readonly request;
+  private readonly createWorkflow;
+  private readonly requestApplicationDispatchCurrent?;
+  readonly members: {
+    list: (lineId: string) => Promise<HubLineMember[]>;
+  };
+  readonly memberApplications: {
+    get: (lineId: string, memberId: string) => Promise<{
+      memberRevision: string;
+      selection: HubLineMemberApplication | null;
+    }>;
+    select: (lineId: string, memberId: string, input: HubLineMemberApplicationInput) => Promise<HubLineMemberApplication>;
+    clear: (lineId: string, memberId: string, input: {
+      expectedSelectionId: string;
+      expectedMemberRevision: string;
+    }) => Promise<void>;
+  };
+  readonly checkins: {
+    schedule: (cron: string, options: HubLineCheckinOptions) => Promise<HubWorkflow>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>, createWorkflow: (yaml: string) => Promise<HubWorkflow>, requestApplicationDispatchCurrent?: ((path: string, init: RequestInit, callbackBearer: string) => Promise<{
+    current: boolean;
+  }>) | undefined);
+  scheduleSend(cron: string, options: HubLineScheduledSendOptions): Promise<HubWorkflow>;
+  context(): Promise<HubLineContext>;
+  send(lineId: string, input: HubLineSendInput | HubLineOwnerSendInput): Promise<HubLineSendReceipt>;
+  /** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+  sentMessage(lineId: string, messageId: string): Promise<HubLineSendReceipt>;
+  remind(lineId: string, input: HubLineReminderInput): Promise<HubLineReminderReceipt>;
+  applicationDispatchCurrent(lineId: string, messageId: string, input: HubLineApplicationDispatchCurrentInput, callbackBearer: string): Promise<boolean>;
+}
+//#endregion
+//#region src/managed-numbers.d.ts
+interface HubNumberReadiness {
+  configured: boolean;
+  provider: "inkbox";
+  transports: Array<"sms" | "imessage">;
+  billing: "prepaid_activation";
+  automaticRentalBilling: false;
+  deliveryVerified: false;
+}
+interface HubNumberQuote {
+  transport: "sms" | "imessage";
+  activationCents: number;
+  currency: "usd";
+  termsVersion: string;
+  terms: string;
+  expiresAt: number;
+  /** The binding the quote was issued for. Absent from older servers. */
+  clientReference?: string;
+  /** Opaque. Pass it back to `create`; never decode it. */
+  token: string;
+}
+/** One page of the owner's orders, newest first. */
+interface HubNumberOrderPage {
+  orders: HubNumberOrder[];
+  /** Present while more orders exist. Older servers omit it and return one
+   * bounded page, so an absent cursor never proves an order does not exist. */
+  nextCursor?: string | null;
+}
+interface HubNumberListQuery {
+  /** Only orders requested for this binding, including closed ones. */
+  clientReference?: string;
+  cursor?: string;
+  /** 1 to 100; the server default is 100. */
+  limit?: number;
+}
+/** An operator's terminal decision on an order stuck in `needs_review`.
+ * Read-only for a creator: the resolution is made through the platform's
+ * admin surface, never through this client. */
+interface HubNumberResolution {
+  action: "release" | "settle" | "abandon";
+  operator: string;
+  reason: string;
+  at: number;
+  /** Present while the operator's action is still running. The decision is
+   * not final and the order can still return to review. */
+  pending?: true;
+  /** Present when a `settle` handed a live, unfinished order back to
+   * provisioning, so the order is working again rather than closed. */
+  requeued?: true;
+}
+interface HubNumberOrder {
+  id: string;
+  clientReference: string;
+  transport: "sms" | "imessage";
+  status: "pending" | "provider_pending" | "needs_review" | "ready_for_setup" | "cancelled";
+  phase: "identity" | "number" | "credential" | "connection" | "complete";
+  address: string | null;
+  connectionId: string | null;
+  identityId: string | null;
+  providerNumberId: string | null;
+  billingStatus: "unreserved" | "reserved" | "settled" | "released";
+  cancellation: "none" | "requested" | "needs_review" | "released" | "abandoned";
+  errorCode: string | null;
+  nextAttemptAt: number | null;
+  resolution: HubNumberResolution | null;
+  deliveryVerified: false;
+  activationCents: number;
+  currency: "usd";
+  terms: string;
+}
+/** Administrative number operations through Hub's authenticated transport.
+ * A mutation is one attempt; an uncertain create reuses its quote and reference. */
+declare class HubManagedNumbersClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  readiness(): Promise<HubNumberReadiness>;
+  /** One page of orders. Scope by `clientReference` to ask about one binding,
+   * and follow `nextCursor` for the rest; a page is never ownership evidence. */
+  list(query?: HubNumberListQuery): Promise<HubNumberOrderPage>;
+  get(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  quote(input: {
+    transport: "sms" | "imessage";
+    clientReference: string;
+  }): Promise<{
+    quote: HubNumberQuote;
+  }>;
+  /** `clientReference` and `transport`, when given, must match the signed
+   * quote or Hub refuses the purchase with a conflict. */
+  create(input: {
+    quoteToken: string;
+    consent: true;
+    state?: string;
+    clientReference?: string;
+    transport?: "sms" | "imessage";
+  }): Promise<{
+    order: HubNumberOrder;
+  }>;
+  /** Fences references so no order can take them again. Call it as the last
+   * step before retiring the resource they name: a purchase that races the
+   * retirement is then refused (`409 number_reference_fenced`) instead of
+   * binding a line to a resource that is gone. Refused with
+   * `409 number_reference_held` while a live order holds one of them; cancel
+   * it first. A cancelled order no longer holds its reference, so the fence
+   * succeeds as soon as `cancel` returns, whether or not its release is still
+   * pending. Repeating a fence is harmless. */
+  fence(input: {
+    clientReferences: string[];
+  }): Promise<{
+    clientReferences: string[];
+  }>;
+  advance(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  cancel(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  private path;
+  private post;
+}
+//#endregion
 //#region src/client.d.ts
 type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
 interface HubClientOptions {
@@ -1250,13 +2132,25 @@ interface HubClientFromEnvOptions {
 }
 declare function resolveHubBaseUrl(env?: HubEnv): string;
 declare function resolveHubAuth(env?: HubEnv): string;
-declare class HubClient {
+declare class HubTransport {
   readonly baseUrl: string;
   readonly fetch: typeof fetch;
   readonly apiKey?: string;
   readonly authHeaders?: HubAuthHeaders;
+  constructor(options: HubClientOptions);
+  protected request<TData>(path: string, init: RequestInit, options?: {
+    auth?: "client" | "caller";
+    validateData?: (data: unknown) => data is TData;
+  }): Promise<TData>;
+  protected buildHeaders(headers: HeadersInit | undefined, callerAuth?: boolean): Promise<Headers>;
+}
+declare class HubClient extends HubTransport {
+  readonly knowledge: HubKnowledgeClient;
+  readonly allowances: HubAllowancesClient;
+  readonly apps: HubAppsClient;
   readonly connections: HubConnectionsClient;
   readonly channels: HubChannelsClient;
+  readonly numbers: HubManagedNumbersClient;
   readonly eventSubscriptions: HubEventSubscriptionsClient;
   readonly permissions: HubPermissionsClient;
   readonly tokens: HubTokensClient;
@@ -1265,10 +2159,10 @@ declare class HubClient {
   readonly audit: HubAuditClient;
   readonly githubApp: HubGithubAppClient;
   readonly workflows: HubWorkflowsClient;
+  readonly lines: HubLinesClient;
   constructor(options: HubClientOptions);
   static fromEnv(options?: HubClientFromEnvOptions): HubClient;
   status(): Promise<HubStatusResponse>;
-  private request;
   /**
    * Open a streaming (Server-Sent Events) response and return its raw body.
    * Shares auth-header building + `fetch` with {@link request}, but does NOT
@@ -1289,7 +2183,6 @@ declare class HubClient {
    * otherwise an `HUB_HTTP_<status>` transport error.
    */
   private requestBytes;
-  private buildHeaders;
 }
 interface HubTokenListOptions {
   includeExpired?: boolean;
@@ -1360,6 +2253,8 @@ interface HubConnectionStartOptions {
   returnUrl?: string;
   cli?: boolean;
   connectionParameters?: Record<string, string>;
+  /** GitHub accepts the exact read:user, repo, read:org set. */
+  requestedScopes?: readonly string[];
 }
 declare class HubChannelsClient {
   private readonly request;
@@ -1377,6 +2272,7 @@ declare class HubEventSubscriptionsClient {
 }
 declare class HubConnectionsClient {
   private readonly request;
+  readonly inboundWebhook: HubInboundWebhooksClient;
   constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
   list(): Promise<HubConnectionsResponse>;
   /** Connector catalog: every provider the hub can expose, each flagged with
@@ -1389,8 +2285,9 @@ declare class HubConnectionsClient {
   /** Connect a non-OAuth (api-key) connector by submitting the user's key.
    *  The server validates the key with a live probe before persisting and
    *  returns the created (or reconnected) connection — there is no redirect,
-   *  unlike `start`. */
-  connectApiKey(provider: string, apiKey: string): Promise<HubApiKeyConnectResponse>;
+   *  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+   *  requires listing ID/PMS pairs; other providers have no metadata. */
+  connectApiKey(provider: string, apiKey: string, metadata?: HubApiKeyConnectRequest["metadata"]): Promise<HubApiKeyConnectResponse>;
   revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
   health(connectionId: string): Promise<HubConnectionHealthResponse>;
 }
@@ -1809,8 +2706,166 @@ declare function authenticateHubEventRequest(input: AuthenticateHubEventRequestI
 declare function verifyHubEventSignature(input: VerifyHubEventSignatureInput): Promise<HubEventSignatureResult>;
 declare function parseHubEventDelivery(input: string | unknown): HubEventDelivery;
 //#endregion
+//#region src/knowledge-approval.d.ts
+/** Called only after the owner reviews this exact pending effect and clicks
+ * Approve. Re-read first: a stale tab cannot approve a substituted operation. */
+declare function approveKnowledgeSource(input: {
+  port: Pick<HubKnowledgeManagementClient, "get" | "refresh">;
+  approvals: Pick<HubApprovalsClient, "approve">;
+  source: KnowledgeSourceSummary;
+}): Promise<KnowledgeSourceSummary>;
+//#endregion
+//#region src/line-grants.d.ts
+interface HubLineGrantBinding {
+  workspaceId: string;
+  workspaceAgentId: string;
+}
+interface HubLineGrant {
+  id: string;
+  lineId: string;
+  connectionId: string;
+  workspaceId: string;
+  workspaceAgentId: string;
+  agentProfileVersion: string;
+  backendSha256: string;
+  attachmentId: string | null;
+  intakeMode: "guests" | "owner_only";
+  /** "application" grants select the app's callback for the owner member instead of attaching. */
+  execution: "backend" | "application";
+  applicationOrigin: string | null;
+  priorAttachmentId: string | null;
+  priorAttachmentActive: boolean;
+  monthlyBudgetUsd: number;
+  monthlySpentUsd: number;
+}
+interface HubLineGrantLine {
+  id: string;
+  connectionId: string;
+  transport: "sms" | "imessage";
+  status: string;
+  address: string | null;
+  attachment: {
+    id: string;
+    sandboxId: string;
+    status: string;
+  } | null;
+}
+interface HubLineGrantAttachInput {
+  workspaceAgentId: string;
+  agentProfileVersion: string;
+  renewalCode?: string;
+  respond: {
+    kind: "agent";
+    backend: Record<string, unknown>;
+  };
+}
+interface HubLineGrantAttachment {
+  id: string;
+  sandboxId: string;
+  status: string;
+  members?: Array<{
+    id: string;
+    role: string;
+  }>;
+}
+interface HubLineGrantThread {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+}
+interface HubLineGrantMessage {
+  id: string;
+  threadId: string;
+  direction: string;
+  text: string | null;
+}
+/** The consented owner member on the owner's current attachment. */
+interface HubLineGrantMemberApplication {
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  /** Pass back unchanged as `expectedMemberRevision`. */
+  memberRevision: string;
+  /** False until the owner has texted the line and Hub recorded consent. */
+  eligible: boolean;
+  /** Hub-derived; every callback for this grant carries it. */
+  binding: string;
+  selection: {
+    id: string; /** True when this grant's callback is the selected application. */
+    own: boolean;
+    /**
+     * Hub's name for the app that answers the owner's texts, shown to the
+     * owner in every app they consented on this line: a registered app's
+     * name, or "Another app" when Hub has none. Absent before Platform named
+     * selection holders.
+     */
+    app?: {
+      name: string;
+    }; /** When the current app started answering. */
+    selectedAt?: string; /** This app's own callback; never returned for another app. */
+    url?: string;
+    createdAt?: string;
+  } | null;
+}
+interface HubLineGrantSelectApplicationInput {
+  /** The current selection exactly as read. */
+  expectedSelectionId: string | null;
+  /**
+   * Set only when the owner chose to move their texts here from the app shown
+   * in `selection.app`: that selection's id, also passed as
+   * `expectedSelectionId`. Without it Hub never replaces another app.
+   */
+  replaceSelectionId?: string;
+  expectedMemberRevision: string;
+  /** HTTPS callback on the owner-approved application origin. */
+  url: string;
+  /** Bearer Hub sends to the callback; 32-512 printable ASCII characters. */
+  secret: string;
+}
+interface HubLineGrantApplicationSelection {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  status: string;
+  application: {
+    url: string;
+    binding: string;
+  };
+  createdAt: string;
+  revokedAt: string | null;
+}
+/** Every call uses HubTransport's authHeaders, so one-use app broker tokens can be minted per request. */
+declare class HubLineGrantsClient extends HubTransport {
+  current(binding: HubLineGrantBinding): Promise<HubLineGrant>;
+  line(binding: HubLineGrantBinding): Promise<HubLineGrantLine>;
+  attach(binding: HubLineGrantBinding, input: HubLineGrantAttachInput): Promise<HubLineGrantAttachment>;
+  detach(binding: HubLineGrantBinding): Promise<{
+    detached: boolean;
+  }>;
+  threads(binding: HubLineGrantBinding): Promise<HubLineGrantThread[]>;
+  messages(binding: HubLineGrantBinding, threadId: string): Promise<HubLineGrantMessage[]>;
+  memberApplication(binding: HubLineGrantBinding): Promise<HubLineGrantMemberApplication>;
+  /**
+   * Route the owner's texts to this app's callback; the incumbent attachment
+   * stays. `replaceSelectionId` moves them from another app on the owner's
+   * explicit choice.
+   */
+  selectApplication(binding: HubLineGrantBinding, input: HubLineGrantSelectApplicationInput): Promise<HubLineGrantApplicationSelection>;
+  /** Return the owner's texts to the incumbent attachment. */
+  clearApplication(binding: HubLineGrantBinding, input: {
+    expectedSelectionId: string;
+    expectedMemberRevision: string;
+  }): Promise<void>;
+  revoke(binding: HubLineGrantBinding): Promise<{
+    revoked: boolean;
+  }>;
+}
+//#endregion
 //#region src/redaction.d.ts
 declare function redactHubValue(value: unknown): unknown;
 //#endregion
-export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppDisconnectResponse, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListInstallationsResponse, type HubGithubAppListReposResponse, type HubGithubAppManagedInstallation, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubGithubAppSyncResponse, type HubGithubAppSyncedInstallation, type HubManualRunInput, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthConnectionParameter, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowAgentStep, type HubWorkflowArtifact, type HubWorkflowArtifactDownload, type HubWorkflowArtifactRef, type HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, type HubWorkflowConnectionRequirement, type HubWorkflowDecision, type HubWorkflowDecisionOnTimeout, type HubWorkflowDecisionResolveResult, type HubWorkflowDecisionResolvedVia, type HubWorkflowDecisionStatus, type HubWorkflowDistillationCandidate, type HubWorkflowEdgeVerdicts, type HubWorkflowEventFilter, type HubWorkflowFailureCluster, type HubWorkflowFleetEntry, type HubWorkflowFleetInsights, type HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, type HubWorkflowHealth, type HubWorkflowHookEndpoint, type HubWorkflowHookToken, type HubWorkflowKvDeleteResponse, type HubWorkflowKvEntry, type HubWorkflowKvEntryMeta, type HubWorkflowKvListResponse, type HubWorkflowNodeHealth, type HubWorkflowOnErrorOutcome, type HubWorkflowPendingDecision, type HubWorkflowPendingDecisionsResponse, type HubWorkflowProposal, type HubWorkflowProposalInput, type HubWorkflowRevision, type HubWorkflowRevisionMeta, type HubWorkflowRevisionSource, type HubWorkflowRevisionStatus, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunRetried, type HubWorkflowRunStatus, type HubWorkflowRunStepsPage, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTemplate, type HubWorkflowTemplateCategory, type HubWorkflowTemplateInstantiateResult, type HubWorkflowTemplateParameter, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, type VerifyHubEventSignatureInput, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubAllowanceDecision, type HubAllowanceGrant, type HubAllowancePlan, type HubAllowancePlanInput, type HubAllowanceRole, type HubAllowanceSubject, type HubAllowanceSyncInput, type HubAllowanceSyncReceipt, type HubAllowanceTier, type HubAllowanceUsage, HubAllowancesClient, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApiKeyConnectionMetadata, type HubApp, HubAppBrokerClient, type HubAppBrokerExchange, type HubAppBrokerOptions, type HubAppBrokerToken, type HubAppComplianceClaim, type HubAppComplianceState, type HubAppCreateInput, type HubAppGrant, type HubAppGrantRevoked, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAppsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppDisconnectResponse, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListInstallationsResponse, type HubGithubAppListReposResponse, type HubGithubAppManagedInstallation, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubGithubAppSyncResponse, type HubGithubAppSyncedInstallation, type HubInboundPhoneNumberScope, type HubInboundWebhookCreateOptions, type HubInboundWebhookCreateResponse, type HubInboundWebhookStatus, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, type HubKnowledgeQueryResult, type HubKnowledgeRetrievalResult, type HubLineApplicationDispatchCurrentInput, type HubLineCheckinOptions, type HubLineContext, type HubLineGrant, type HubLineGrantApplicationSelection, type HubLineGrantAttachInput, type HubLineGrantAttachment, type HubLineGrantBinding, type HubLineGrantLine, type HubLineGrantMemberApplication, type HubLineGrantMessage, type HubLineGrantSelectApplicationInput, type HubLineGrantThread, HubLineGrantsClient, type HubLineImage, type HubLineMember, type HubLineMemberApplication, type HubLineMemberApplicationInput, type HubLineOwnerSendInput, type HubLineReminderInput, type HubLineReminderReceipt, type HubLineReplyCode, type HubLineReplyCodeInput, type HubLineScheduledSendOptions, type HubLineSendInput, type HubLineSendReceipt, HubLinesClient, HubManagedNumbersClient, type HubManualRunInput, type HubNumberListQuery, type HubNumberOrder, type HubNumberOrderPage, type HubNumberQuote, type HubNumberReadiness, type HubNumberResolution, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthConnectionParameter, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowAgentStep, type HubWorkflowArtifact, type HubWorkflowArtifactDownload, type HubWorkflowArtifactRef, type HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, type HubWorkflowConnectionRequirement, type HubWorkflowDecision, type HubWorkflowDecisionOnTimeout, type HubWorkflowDecisionResolveResult, type HubWorkflowDecisionResolvedVia, type HubWorkflowDecisionStatus, type HubWorkflowDistillationCandidate, type HubWorkflowEdgeVerdicts, type HubWorkflowEventFilter, type HubWorkflowFailureCluster, type HubWorkflowFleetEntry, type HubWorkflowFleetInsights, type HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, type HubWorkflowHealth, type HubWorkflowHookEndpoint, type HubWorkflowHookToken, type HubWorkflowKvDeleteResponse, type HubWorkflowKvEntry, type HubWorkflowKvEntryMeta, type HubWorkflowKvListResponse, type HubWorkflowNodeHealth, type HubWorkflowOnErrorOutcome, type HubWorkflowPendingDecision, type HubWorkflowPendingDecisionsResponse, type HubWorkflowProposal, type HubWorkflowProposalInput, type HubWorkflowRevision, type HubWorkflowRevisionMeta, type HubWorkflowRevisionSource, type HubWorkflowRevisionStatus, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunRetried, type HubWorkflowRunStatus, type HubWorkflowRunStepsPage, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTemplate, type HubWorkflowTemplateCategory, type HubWorkflowTemplateInstantiateResult, type HubWorkflowTemplateParameter, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, KnowledgeAttachment, KnowledgeAttachmentAuthorization, KnowledgeAuthorization, KnowledgeCapabilities, KnowledgeCapability, KnowledgeEmbeddingSpace, KnowledgeReference, KnowledgeSourceCreate, KnowledgeSourceInput, KnowledgeSourceSummary, type VerifyHubEventSignatureInput, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
 //# sourceMappingURL=index.d.ts.map