@tangle-network/hub-sdk 0.30.7 → 0.30.8

package/dist/index.d.ts

@@ -240,141 +240,561 @@ declare class HubAppsClient {
   }): Promise<HubAppComplianceState>;
 }
 //#endregion
-//#region src/types.d.ts
-type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
-interface HubSuccessEnvelope<TData> {
-  success: true;
-  data: TData;
+//#region src/tool-types.d.ts
+interface HubToolSource {
+  sourceId: string;
+  providerId: string;
+  displayName: string;
+  toolCount: number;
+  connectionStatus: "connected" | "missing" | "unknown";
+  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
+  configured: boolean;
 }
-interface HubErrorEnvelope {
-  success: false;
-  error: HubErrorBody;
+/** Per-tool catalog risk class. The first three mirror the platform's
+ *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
+ *  classify (substrate connectors). */
+type HubToolRisk = "read" | "write" | "destructive" | "unknown";
+interface HubTool {
+  path: string;
+  providerId?: string;
+  title?: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  connectionRequired?: boolean;
+  connectionStatus?: "connected" | "missing" | "unknown";
+  requiredConnectionProviderId?: string;
+  policyState?: "allow" | "ask" | "deny" | "unknown";
+  risk?: HubToolRisk;
 }
-type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
-interface HubErrorBody {
-  code: HubErrorCode;
-  message: string;
-  details?: unknown;
+interface HubToolSourcesResponse {
+  sources: HubToolSource[];
 }
-type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
-interface HubStatusResponse {
-  contract: unknown;
-  principal: HubPrincipal;
-  connections: HubStatusConnections;
+interface HubToolsSearchRequest {
+  query: string;
+  provider?: string;
 }
-interface HubPrincipal {
-  kind: HubPrincipalKind;
-  userId: string;
-  apiKeyId?: string;
-  sandboxId?: string;
-  requestId?: string;
+interface HubToolsSearchResponse {
+  tools: HubTool[];
 }
-interface HubStatusConnections {
-  connectedProviderCount: number;
-  unhealthyProviderCount: number;
+interface HubToolsDescribeRequest {
+  path: string;
 }
-interface HubConnection {
-  id: string;
-  providerId: string;
-  displayName: string;
-  accountDisplay: string | null;
-  providerAccountId: string | null;
-  scopes: string[];
-  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
-  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
-  createdAt: string;
-  updatedAt: string;
-  lastUsedAt: string | null;
+interface HubToolsDescribeResponse {
+  tool: HubTool;
 }
-interface HubConnectionsResponse {
-  connections: HubConnection[];
+interface HubExecRequest {
+  path: string;
+  input?: unknown;
+  connectionId?: string;
+  /** Caller-minted key for this exec. The platform ledger replays the first
+   *  call's result for a retry that carries the same key, and rejects a key
+   *  reused for a different request. On the capability-token arm the key only
+   *  reaches the connector for provider-native dedupe: that arm is at-most-once
+   *  per token and replays no stored result. */
+  idempotencyKey?: string;
 }
-interface HubEmailChannel {
-  id: string;
-  kind: "email";
-  providerId: "email";
-  connectionId: string;
-  clientReference: string | null;
-  label: string | null;
-  address: string;
-  status: "active";
-  createdAt: string;
-  updatedAt: string;
+interface HubExecResponse<TResult = unknown> {
+  result: TResult;
+  /** True when the result was replayed from a previous call with the same
+   *  idempotency key, so the action did not run again. */
+  replayed?: boolean;
 }
-type HubChannel = HubEmailChannel;
-interface HubChannelsResponse {
-  channels: HubChannel[];
+//#endregion
+//#region src/broker.d.ts
+interface HubAppBrokerOptions {
+  baseUrl: string;
+  clientId: string;
+  clientSecret: string;
+  fetch?: typeof fetch;
 }
-interface HubEmailChannelCreateRequest {
-  /**
-   * Product-owned idempotency key. Retrying the same request returns the
-   * original mailbox instead of provisioning another address.
-   */
-  clientReference?: string;
-  label?: string;
+interface HubAppBrokerToken {
+  accessToken: string;
+  expiresIn: number;
+  scopes: string[];
 }
-interface HubChannelCreateResponse {
-  channel: HubChannel;
-  /** True only when this request created the channel. */
-  created: boolean;
+interface HubAppBrokerExchange extends HubAppBrokerToken {
+  grantId: string;
+  connectionId: string;
 }
-interface HubChannelDeleteResponse {
-  removed: true;
+/** Server-only client. App secrets never become a user's general API key.
+ * Every invocation mints and consumes one short-lived, exact-grant token. */
+declare class HubAppBrokerClient {
+  private readonly options;
+  private readonly baseUrl;
+  private readonly fetcher;
+  constructor(options: HubAppBrokerOptions);
+  private token;
+  private readToken;
+  exchange(input: {
+    code: string;
+    redirectUri: string;
+    connectionId?: string;
+  }): Promise<HubAppBrokerExchange>;
+  mint(grantId: string): Promise<HubAppBrokerToken>;
+  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
 }
-type HubEventConditionScalar = string | number | boolean | null;
-type HubEventCondition = {
-  path: string;
-  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
-  value?: HubEventConditionScalar | HubEventConditionScalar[];
+//#endregion
+//#region src/knowledge-management.d.ts
+interface KnowledgeReference {
+  sourceId: string;
+  generation: string;
+}
+/** Connection references only. Provider credentials never enter this contract. */
+interface KnowledgeEmbeddingSpace {
+  connectionId: string;
+  model: string;
+  dimensions: number;
+}
+type KnowledgeSourceInput = {
+  kind: "file";
+  name: string;
+  base64: string;
+  mediaType: string;
 } | {
-  all: HubEventCondition[];
+  kind: "git";
+  connectionId: string;
+  owner: string;
+  repo: string;
+  ref: string;
+  pathPrefix?: string;
 } | {
-  any: HubEventCondition[];
+  kind: "url";
+  url: string;
 } | {
-  not: HubEventCondition;
-};
-interface HubEventSubscriptionFilter {
-  action?: string;
-  repo?: string;
-  when?: HubEventCondition;
-}
-type HubEventSubscriptionSource = {
-  type: "channel";
-  channelId: string;
+  kind: "s3";
+  connectionId: string;
+  bucket: string;
+  prefix: string;
 } | {
-  type: "connection";
+  kind: "vector";
   connectionId: string;
+  provider: "pinecone" | "qdrant" | "weaviate";
+  indexName: string;
+  namespace?: string;
+  embedding: KnowledgeEmbeddingSpace;
+  textField: string;
+  sourceUriField: string;
 };
-interface HubEventSubscriptionCallback {
-  url: string;
-  secret: string;
+interface KnowledgeCapability {
+  supported: boolean;
+  reason?: string;
 }
-interface HubEventSubscriptionCreateRequest {
-  /**
-   * Product-owned idempotency key. Reusing it with the same source and filter
-   * returns the existing subscription; reusing it for different input fails.
-   */
-  clientReference: string;
-  label?: string;
-  source: HubEventSubscriptionSource;
-  event: string;
-  filter?: HubEventSubscriptionFilter;
-  callback: HubEventSubscriptionCallback;
+interface KnowledgeCapabilities {
+  delegation?: KnowledgeCapability & {
+    resource?: string;
+    scopes?: string[];
+  };
+  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
+  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
+  managedVector: KnowledgeCapability;
+  file: {
+    mediaTypes: string[];
+    maxBytes: number;
+    maxObjects: number;
+  };
 }
-interface HubEventSubscription {
+interface KnowledgeSourceSummary {
+  /** Required query authorization, not proof that an owner policy currently permits it. */
+  retrieval?: {
+    kind: "lexical";
+  } | {
+    kind: "vector";
+    embeddingPolicy: {
+      connectionId: string;
+      actionPath: "openai.embeddings.create";
+      scope: "owner-connection-action";
+    };
+  };
   id: string;
-  clientReference: string;
-  label: string | null;
-  source: HubEventSubscriptionSource;
-  providerId: string;
-  connectionId: string;
-  event: string;
-  filter: HubEventSubscriptionFilter;
-  workflowId: string;
-  status: "active" | "error";
-  lastError: string | null;
-  createdAt: string;
-  updatedAt: string;
+  name: string;
+  kind: KnowledgeSourceInput["kind"];
+  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
+  approval?: {
+    id: string;
+    path: string;
+    preview: {
+      provider: string;
+      connectionId: string;
+      collection: string;
+      sourceId: string;
+      requestId: string;
+      embedding: KnowledgeEmbeddingSpace;
+      chunkCount: number;
+      sourceCount: number;
+      dataSharing: string;
+    };
+  };
+  refreshRequestId?: string;
+  generation: string | null;
+  lastError: {
+    code: string;
+    message: string;
+  } | null;
+  updatedAt: string;
+}
+type KnowledgeAttachmentAuthorization = {
+  status: "active";
+} | {
+  status: "unavailable";
+  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+};
+interface KnowledgeAttachment {
+  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
+  authorization?: KnowledgeAttachmentAuthorization;
+  id: string;
+  sourceId: string;
+  sandboxId: string;
+  generation: string;
+  status: "active" | "detached";
+}
+interface KnowledgeSourceCreate {
+  requestId: string;
+  name: string;
+  source: KnowledgeSourceInput;
+  target?: {
+    kind: "lexical";
+  } | {
+    kind: "managed-vector";
+    provider: "qdrant";
+    connectionId: string;
+    embedding: KnowledgeEmbeddingSpace;
+  };
+}
+/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
+interface KnowledgeAuthorization {
+  userId: string;
+  clientId: string;
+  resource: string;
+  scopes: Array<"knowledge:read" | "knowledge:write">;
+}
+declare class HubKnowledgeManagementClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  materialize(input: {
+    sandboxId: string;
+    references: KnowledgeReference[];
+  }): Promise<KnowledgeAttachment[]>;
+  authorization(): Promise<KnowledgeAuthorization>;
+  disconnectAuthorization(): Promise<{
+    revoked: true;
+  }>;
+  capabilities(): Promise<KnowledgeCapabilities>;
+  list(): Promise<KnowledgeSourceSummary[]>;
+  get(sourceId: string): Promise<KnowledgeSourceSummary>;
+  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
+  refresh(sourceId: string, input: {
+    requestId: string;
+    approvalToken?: string;
+  }): Promise<KnowledgeSourceSummary>;
+  attach(sourceId: string, input: {
+    sandboxId: string;
+    generation: string;
+    expectedGeneration?: string;
+  }): Promise<KnowledgeAttachment>;
+  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
+  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+}
+//#endregion
+//#region src/knowledge.d.ts
+interface HubKnowledgeRetrievalResult {
+  attachmentId: string;
+  generation: string;
+  provenance: "ingested" | "record-supplied";
+  hits: Array<{
+    id: string;
+    title: string;
+    snippet: string;
+    score?: number;
+    citations?: Array<{
+      sourceId: string;
+      sourceUri: string;
+      revision?: string;
+    }>;
+  }>;
+  elapsedMs?: number;
+}
+interface HubKnowledgeQueryResult {
+  results: HubKnowledgeRetrievalResult[];
+  /** Individual unavailable sources do not hide evidence from healthy sources. */
+  failures: Array<{
+    attachmentId: string;
+    code: string;
+    message: string;
+  }>;
+  partial: boolean;
+}
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+ * scope on the server; neither a caller nor an agent can supply another scope. */
+declare class HubKnowledgeClient {
+  private readonly request;
+  readonly management: HubKnowledgeManagementClient;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  bindings(): Promise<{
+    references: KnowledgeReference[];
+  }>;
+  query(input: {
+    query: string;
+    limit?: number;
+    expectedReferences?: KnowledgeReference[];
+  }, options?: {
+    signal?: AbortSignal;
+  }): Promise<HubKnowledgeQueryResult>;
+}
+//#endregion
+//#region src/audit-types.d.ts
+interface HubAuditEvent {
+  id: string;
+  action: string;
+  targetUserId: string | null;
+  targetKeyId: string | null;
+  metadata: unknown;
+  createdAt: string;
+}
+interface HubAuditListRequest {
+  provider?: string;
+  action?: string;
+  status?: string;
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+}
+interface HubAuditResponse {
+  events: HubAuditEvent[];
+  nextCursor: string | null;
+}
+//#endregion
+//#region src/transport-types.d.ts
+type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
+interface HubSuccessEnvelope<TData> {
+  success: true;
+  data: TData;
+}
+interface HubErrorEnvelope {
+  success: false;
+  error: HubErrorBody;
+}
+type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
+interface HubErrorBody {
+  code: HubErrorCode;
+  message: string;
+  details?: unknown;
+}
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
+interface HubStatusResponse {
+  contract: unknown;
+  principal: HubPrincipal;
+  connections: HubStatusConnections;
+}
+interface HubPrincipal {
+  kind: HubPrincipalKind;
+  userId: string;
+  apiKeyId?: string;
+  sandboxId?: string;
+  requestId?: string;
+}
+interface HubStatusConnections {
+  connectedProviderCount: number;
+  unhealthyProviderCount: number;
+}
+interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
+  error: HubErrorEnvelope["error"] & {
+    code: "HUB_NOT_IMPLEMENTED";
+  };
+}
+//#endregion
+//#region src/authorization-types.d.ts
+interface HubTokenMintRequest {
+  connectionId?: string;
+  provider?: string;
+  actionPath: string;
+  ttlSeconds?: number;
+}
+interface HubTokenMintResponse {
+  token: string;
+  tokenId: string;
+  expiresAt: string;
+}
+interface HubCapabilityToken {
+  id: string;
+  providerId: string;
+  connectionId: string;
+  connectionDisplay: string | null;
+  actionPath: string;
+  expiresAt: string;
+  status: "active" | "consumed" | "expired" | "revoked";
+  principalKind: HubPrincipalKind;
+  createdAt: string;
+}
+interface HubTokensListResponse {
+  tokens: HubCapabilityToken[];
+}
+interface HubTokenRevokeResponse {
+  tokenId: string;
+  status: HubCapabilityToken["status"];
+}
+type HubPolicyDecision = "allow" | "ask" | "deny";
+interface HubPolicyUpdateRequest {
+  connectionId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+}
+interface HubPolicyListRequest {
+  connectionId: string;
+}
+interface HubPolicyDeleteRequest {
+  connectionId: string;
+  actionPath: string;
+}
+interface HubPolicyDeleteResponse {
+  connectionId: string;
+  actionPath: string;
+  /** Whether a stored override existed and was removed (false = already default). */
+  deleted: boolean;
+}
+interface HubPolicy {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubPolicyResponse {
+  policy: HubPolicy;
+}
+interface HubPolicyListResponse {
+  policies: HubPolicy[];
+}
+interface HubAllowWritesResponse {
+  connectionId: string;
+  providerId: string;
+  /** Write actions the connection's provider exposes. */
+  writeActions: number;
+  /** Rows newly created (excludes actions that already had a policy). */
+  granted: number;
+  actionPaths: string[];
+}
+interface HubRevertWritesResponse {
+  connectionId: string;
+  /** `allow_writes` rows deleted. */
+  reverted: number;
+}
+type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
+interface HubApproval {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  inputHash: string;
+  requesterPrincipal: Record<string, unknown>;
+  status: HubApprovalStatus;
+  requestedAt: string;
+  expiresAt: string;
+  resolvedAt: string | null;
+}
+interface HubApprovalCapabilityToken {
+  tokenId: string;
+  token: string;
+  expiresAt: string;
+}
+interface HubApprovalDecisionResponse {
+  approval: HubApproval;
+  capabilityToken?: HubApprovalCapabilityToken;
+}
+interface HubApprovalListResponse {
+  approvals: HubApproval[];
+}
+//#endregion
+//#region src/channel-types.d.ts
+interface HubEmailChannel {
+  id: string;
+  kind: "email";
+  providerId: "email";
+  connectionId: string;
+  clientReference: string | null;
+  label: string | null;
+  address: string;
+  status: "active";
+  createdAt: string;
+  updatedAt: string;
+}
+type HubChannel = HubEmailChannel;
+interface HubChannelsResponse {
+  channels: HubChannel[];
+}
+interface HubEmailChannelCreateRequest {
+  /**
+   * Product-owned idempotency key. Retrying the same request returns the
+   * original mailbox instead of provisioning another address.
+   */
+  clientReference?: string;
+  label?: string;
+}
+interface HubChannelCreateResponse {
+  channel: HubChannel;
+  /** True only when this request created the channel. */
+  created: boolean;
+}
+interface HubChannelDeleteResponse {
+  removed: true;
+}
+type HubEventConditionScalar = string | number | boolean | null;
+type HubEventCondition = {
+  path: string;
+  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+  value?: HubEventConditionScalar | HubEventConditionScalar[];
+} | {
+  all: HubEventCondition[];
+} | {
+  any: HubEventCondition[];
+} | {
+  not: HubEventCondition;
+};
+interface HubEventSubscriptionFilter {
+  action?: string;
+  repo?: string;
+  when?: HubEventCondition;
+}
+type HubEventSubscriptionSource = {
+  type: "channel";
+  channelId: string;
+} | {
+  type: "connection";
+  connectionId: string;
+};
+interface HubEventSubscriptionCallback {
+  url: string;
+  secret: string;
+}
+interface HubEventSubscriptionCreateRequest {
+  /**
+   * Product-owned idempotency key. Reusing it with the same source and filter
+   * returns the existing subscription; reusing it for different input fails.
+   */
+  clientReference: string;
+  label?: string;
+  source: HubEventSubscriptionSource;
+  event: string;
+  filter?: HubEventSubscriptionFilter;
+  callback: HubEventSubscriptionCallback;
+}
+interface HubEventSubscription {
+  id: string;
+  clientReference: string;
+  label: string | null;
+  source: HubEventSubscriptionSource;
+  providerId: string;
+  connectionId: string;
+  event: string;
+  filter: HubEventSubscriptionFilter;
+  workflowId: string;
+  status: "active" | "error";
+  lastError: string | null;
+  createdAt: string;
+  updatedAt: string;
 }
 interface HubEventSubscriptionsResponse {
   subscriptions: HubEventSubscription[];
@@ -409,6 +829,24 @@ interface HubEventDelivery {
   providerEvent: HubProviderEvent;
   firedAt: string;
 }
+//#endregion
+//#region src/connection-types.d.ts
+interface HubConnection {
+  id: string;
+  providerId: string;
+  displayName: string;
+  accountDisplay: string | null;
+  providerAccountId: string | null;
+  scopes: string[];
+  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
+  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+}
+interface HubConnectionsResponse {
+  connections: HubConnection[];
+}
 /** A connector's auth model. */
 type HubProviderAuthKind = "oauth2" | "api_key" | "none" | "custom";
 /** One non-secret value needed before an OAuth redirect can be built. Tenant-
@@ -570,193 +1008,8 @@ interface HubConnectionHealthResponse {
   connection: HubConnection;
   health: HubConnectionHealthInfo;
 }
-interface HubToolSource {
-  sourceId: string;
-  providerId: string;
-  displayName: string;
-  toolCount: number;
-  connectionStatus: "connected" | "missing" | "unknown";
-  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
-  configured: boolean;
-}
-/** Per-tool catalog risk class. The first three mirror the platform's
- *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
- *  classify (substrate connectors). */
-type HubToolRisk = "read" | "write" | "destructive" | "unknown";
-interface HubTool {
-  path: string;
-  providerId?: string;
-  title?: string;
-  description?: string;
-  inputSchema?: unknown;
-  outputSchema?: unknown;
-  connectionRequired?: boolean;
-  connectionStatus?: "connected" | "missing" | "unknown";
-  requiredConnectionProviderId?: string;
-  policyState?: "allow" | "ask" | "deny" | "unknown";
-  risk?: HubToolRisk;
-}
-interface HubToolSourcesResponse {
-  sources: HubToolSource[];
-}
-interface HubToolsSearchRequest {
-  query: string;
-  provider?: string;
-}
-interface HubToolsSearchResponse {
-  tools: HubTool[];
-}
-interface HubToolsDescribeRequest {
-  path: string;
-}
-interface HubToolsDescribeResponse {
-  tool: HubTool;
-}
-interface HubExecRequest {
-  path: string;
-  input?: unknown;
-  connectionId?: string;
-  /** Caller-minted key for this exec. The platform ledger replays the first
-   *  call's result for a retry that carries the same key, and rejects a key
-   *  reused for a different request. On the capability-token arm the key only
-   *  reaches the connector for provider-native dedupe: that arm is at-most-once
-   *  per token and replays no stored result. */
-  idempotencyKey?: string;
-}
-interface HubExecResponse<TResult = unknown> {
-  result: TResult;
-  /** True when the result was replayed from a previous call with the same
-   *  idempotency key, so the action did not run again. */
-  replayed?: boolean;
-}
-interface HubTokenMintRequest {
-  connectionId?: string;
-  provider?: string;
-  actionPath: string;
-  ttlSeconds?: number;
-}
-interface HubTokenMintResponse {
-  token: string;
-  tokenId: string;
-  expiresAt: string;
-}
-interface HubCapabilityToken {
-  id: string;
-  providerId: string;
-  connectionId: string;
-  connectionDisplay: string | null;
-  actionPath: string;
-  expiresAt: string;
-  status: "active" | "consumed" | "expired" | "revoked";
-  principalKind: HubPrincipalKind;
-  createdAt: string;
-}
-interface HubTokensListResponse {
-  tokens: HubCapabilityToken[];
-}
-interface HubTokenRevokeResponse {
-  tokenId: string;
-  status: HubCapabilityToken["status"];
-}
-type HubPolicyDecision = "allow" | "ask" | "deny";
-interface HubPolicyUpdateRequest {
-  connectionId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-}
-interface HubPolicyListRequest {
-  connectionId: string;
-}
-interface HubPolicyDeleteRequest {
-  connectionId: string;
-  actionPath: string;
-}
-interface HubPolicyDeleteResponse {
-  connectionId: string;
-  actionPath: string;
-  /** Whether a stored override existed and was removed (false = already default). */
-  deleted: boolean;
-}
-interface HubPolicy {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-  createdAt: string;
-  updatedAt: string;
-}
-interface HubPolicyResponse {
-  policy: HubPolicy;
-}
-interface HubPolicyListResponse {
-  policies: HubPolicy[];
-}
-interface HubAllowWritesResponse {
-  connectionId: string;
-  providerId: string;
-  /** Write actions the connection's provider exposes. */
-  writeActions: number;
-  /** Rows newly created (excludes actions that already had a policy). */
-  granted: number;
-  actionPaths: string[];
-}
-interface HubRevertWritesResponse {
-  connectionId: string;
-  /** `allow_writes` rows deleted. */
-  reverted: number;
-}
-type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
-interface HubApproval {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  inputHash: string;
-  requesterPrincipal: Record<string, unknown>;
-  status: HubApprovalStatus;
-  requestedAt: string;
-  expiresAt: string;
-  resolvedAt: string | null;
-}
-interface HubApprovalCapabilityToken {
-  tokenId: string;
-  token: string;
-  expiresAt: string;
-}
-interface HubApprovalDecisionResponse {
-  approval: HubApproval;
-  capabilityToken?: HubApprovalCapabilityToken;
-}
-interface HubApprovalListResponse {
-  approvals: HubApproval[];
-}
-interface HubAuditEvent {
-  id: string;
-  action: string;
-  targetUserId: string | null;
-  targetKeyId: string | null;
-  metadata: unknown;
-  createdAt: string;
-}
-interface HubAuditListRequest {
-  provider?: string;
-  action?: string;
-  status?: string;
-  since?: string;
-  until?: string;
-  cursor?: string;
-  limit?: number;
-}
-interface HubAuditResponse {
-  events: HubAuditEvent[];
-  nextCursor: string | null;
-}
-interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
-  error: HubErrorEnvelope["error"] & {
-    code: "HUB_NOT_IMPLEMENTED";
-  };
-}
+//#endregion
+//#region src/github-app-types.d.ts
 interface HubGithubAppMintInstallationTokenRequest {
   /** HTTPS or SSH GitHub URL — alternative to installationId. */
   repoUrl?: string;
@@ -847,40 +1100,50 @@ interface HubGithubAppIsRepoInstalledRequest {
   owner: string;
   repo: string;
 }
-interface HubGithubAppIsRepoInstalledResponse {
-  installed: boolean;
-  installationId: number | null;
-}
-interface HubWorkflowAction {
-  kind: string;
-  config: Record<string, unknown>;
-}
-/** Inbound-event matcher for a `provider_event` trigger. */
-interface HubWorkflowEventFilter {
-  event: string;
-  action?: string;
-  repo?: string;
-}
-interface HubWorkflowTrigger {
-  id: string;
-  kind: "provider_event" | "schedule" | "webhook";
-  enabled: boolean;
-  provider: string | null;
-  connectionId: string | null;
-  eventFilter: HubWorkflowEventFilter | null;
-  cron: string | null;
-  timezone: string | null;
-  nextFireAt: string | null;
-  lastFiredAt: string | null;
-  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
-  until: string | null;
+interface HubGithubAppIsRepoInstalledResponse {
+  installed: boolean;
+  installationId: number | null;
 }
-interface HubWorkflowValidationError {
+//#endregion
+//#region src/workflow-graph-types.d.ts
+/** How a node's incoming edges release it (default `"all"` — omitted on the
+ *  wire for it, so specs compiled before join rules existed round-trip). */
+type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
+type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+type HubWorkflowConditionScalar = string | number | boolean | null;
+/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
+ *  runner against the steps context on the source node's completion. */
+type HubWorkflowCondition = {
   path: string;
-  message: string;
-  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
-  code?: string;
+  op: HubWorkflowConditionOp;
+  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
+} | {
+  all: HubWorkflowCondition[];
+} | {
+  any: HubWorkflowCondition[];
+} | {
+  not: HubWorkflowCondition;
+};
+interface HubWorkflowGraphNode {
+  id: string;
+  index: number;
+  join?: HubWorkflowGraphJoinRule;
+}
+interface HubWorkflowGraphEdge {
+  from: string;
+  to: string;
+  /** Guard the runner evaluates on the source's completion; unguarded edges
+   *  carry no `when`. */
+  when?: HubWorkflowCondition;
+}
+/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
+interface HubWorkflowGraphSpec {
+  nodes: HubWorkflowGraphNode[];
+  edges: HubWorkflowGraphEdge[];
+  maxNodeVisits: number;
 }
+//#endregion
+//#region src/workflow-run-types.d.ts
 type HubWorkflowRunStatus = "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled";
 /** One agent iteration of an `agent.run`, as the single-run detail carries it
  *  (JSON-clean ISO timestamps) — including the round's own output `text`. */
@@ -1129,91 +1392,6 @@ interface HubWorkflowFleetInsights {
   windowStart: string;
   workflows: HubWorkflowFleetEntry[];
 }
-interface HubWorkflow {
-  id: string;
-  name: string;
-  description: string | null;
-  enabled: boolean;
-  /** Compiled engine actions (connection refs resolved to ids). */
-  actions: HubWorkflowAction[];
-  /** The durable YAML this workflow compiled from. */
-  definitionYaml: string | null;
-  validationErrors: HubWorkflowValidationError[];
-  /** Current head revision; null on pre-versioning rows until their next
-   *  update (they have no revision history to point at yet). */
-  headRev?: number | null;
-  /** Present on get/create/update detail responses; omitted on list. */
-  triggers?: HubWorkflowTrigger[];
-  /** Present on the detail response: the trigger fields a manual run must supply,
-   *  derived from the definition's `${trigger.*}` references (empty when none). */
-  manualRunInputs?: HubManualRunInput[];
-  /** Present on the get-detail response: the compiled graph topology (null
-   *  when the definition has no graph topology, or is chain-equivalent —
-   *  the legacy linear semantics). Omitted on the list projection. */
-  graph?: HubWorkflowGraphSpec | null;
-  /** Create response only, when the definition has a webhook trigger: the
-   *  hook delivery URL, plus the plaintext bearer token exactly once at mint
-   *  (absent when an active token already exists — rotate to re-reveal). */
-  hook?: HubWorkflowHookEndpoint;
-  /** Present on the list response (latest run, or null if never run); omitted on detail. */
-  lastRun?: HubWorkflowRunSummary | null;
-  createdAt: string;
-  updatedAt: string;
-}
-/** A trigger field a manual "Run now" must supply (derived from the
- *  definition's `${trigger.*}` references). `required` is false only when every
- *  read is wrapped in a `default(...)`. */
-interface HubManualRunInput {
-  path: string;
-  required: boolean;
-}
-type HubWorkflowValidateResponse = {
-  valid: true;
-  name: string;
-  actionCount: number;
-  triggerCount: number;
-} | {
-  valid: false;
-  errors: HubWorkflowValidationError[];
-};
-/** JSON Schema for the YAML workflow definition. */
-type HubWorkflowSchemaResponse = Record<string, unknown>;
-/** How a node's incoming edges release it (default `"all"` — omitted on the
- *  wire for it, so specs compiled before join rules existed round-trip). */
-type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
-type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
-type HubWorkflowConditionScalar = string | number | boolean | null;
-/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
- *  runner against the steps context on the source node's completion. */
-type HubWorkflowCondition = {
-  path: string;
-  op: HubWorkflowConditionOp;
-  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
-} | {
-  all: HubWorkflowCondition[];
-} | {
-  any: HubWorkflowCondition[];
-} | {
-  not: HubWorkflowCondition;
-};
-interface HubWorkflowGraphNode {
-  id: string;
-  index: number;
-  join?: HubWorkflowGraphJoinRule;
-}
-interface HubWorkflowGraphEdge {
-  from: string;
-  to: string;
-  /** Guard the runner evaluates on the source's completion; unguarded edges
-   *  carry no `when`. */
-  when?: HubWorkflowCondition;
-}
-/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
-interface HubWorkflowGraphSpec {
-  nodes: HubWorkflowGraphNode[];
-  edges: HubWorkflowGraphEdge[];
-  maxNodeVisits: number;
-}
 /** One journal completion on the wire: the node that completed and the guard
  *  verdict evaluated for each of its guarded outgoing edges, keyed by edgeKey
  *  (`"from->to"`). Only GUARDED edges ever appear. */
@@ -1234,187 +1412,43 @@ interface HubWorkflowOnErrorOutcome {
     costUsd?: number;
   };
 }
-type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
-/** Lifecycle state of a revision. The head rev only ever points at an
- *  `applied` revision; `proposed` is a service-token-authored suggestion
- *  awaiting an owner decision; `rejected` is a declined proposal (kept for
- *  audit). */
-type HubWorkflowRevisionStatus = "applied" | "proposed" | "rejected";
-/** Revision list projection — attribution + note + status, WITHOUT the YAML body. */
-interface HubWorkflowRevisionMeta {
-  rev: number;
-  createdAt: string;
-  createdBy: string;
-  source: HubWorkflowRevisionSource;
-  note: string | null;
-  status: HubWorkflowRevisionStatus;
-}
-/** One revision WITH its YAML (and the actions compiled alongside it). */
-interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
-  yaml: string;
-  actions: HubWorkflowAction[];
-}
-/** A proposal (proposed or rejected revision) WITH its evidence — what the
- *  proposer derived the suggestion from (e.g. health stats), plus
- *  `rejectionReason` once declined. */
-interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
-  evidence: unknown;
-}
-/** Input to {@link HubWorkflowsClient.propose}. Service-token callers only. */
-interface HubWorkflowProposalInput {
-  yaml: string;
-  note?: string;
-  /** Proposer-supplied justification (any JSON value) — carried verbatim onto
-   *  the revision and shown on the approval surface. */
-  evidence?: unknown;
-}
 /** One node's aggregate across the analyzed runs. */
 interface HubWorkflowNodeHealth {
   /** The author's graph node id, or `step-N` for a linear run's nodes (and for
    *  a node whose run cannot be mapped back to a definition). */
   nodeId: string;
   visits: number;
-  failures: number;
-  /** Null when no visit carried a cost row (never a fabricated 0). */
-  totalCostUsd: number | null;
-  /** Null when no visit recorded duration spans. */
-  avgDurationMs: number | null;
-}
-/** Failures grouped by a normalized error signature (ids/numbers/whitespace
- *  stripped), most frequent first (top 5). */
-interface HubWorkflowFailureCluster {
-  signature: string;
-  count: number;
-  sampleRunIds: string[];
-}
-/** An agent.run node whose outputs are near-static across runs — a
- *  CANDIDATE for distillation, reported with its measurements, never a
- *  verdict. */
-interface HubWorkflowDistillationCandidate {
-  nodeId: string;
-  matchRatio: number;
-  samples: number;
-  avgCostUsd: number | null;
-}
-interface HubWorkflowHealth {
-  /** The requested window (the `runs` parameter). */
-  runsWindow: number;
-  /** Terminal runs that actually went into the stats. */
-  runsAnalyzed: number;
-  nodes: HubWorkflowNodeHealth[];
-  failureClusters: HubWorkflowFailureCluster[];
-  distillationCandidates: HubWorkflowDistillationCandidate[];
-}
-/** One KV entry with its metadata — the get/put/cas response shape. */
-interface HubWorkflowKvEntry {
-  key: string;
-  value: unknown;
-  version: number;
-  updatedAt: string;
-}
-/** Keyspace metadata row (never the value) — the list response's entry. */
-interface HubWorkflowKvEntryMeta {
-  key: string;
-  version: number;
-  updatedAt: string;
-}
-interface HubWorkflowKvListResponse {
-  entries: HubWorkflowKvEntryMeta[];
-}
-interface HubWorkflowKvDeleteResponse {
-  deleted: boolean;
-}
-/** The opaque ref a stored artifact is referred to by — the value a
- *  script.run node returns as its step output. */
-interface HubWorkflowArtifactRef {
-  $artifact: string;
-  name: string;
-  contentType: string;
-  byteSize: number;
-  preview: string | null;
-}
-/** Artifact metadata (never the bytes), oldest first on the list response. */
-interface HubWorkflowArtifact {
-  id: string;
-  runId: string;
-  workflowId: string;
-  /** The graph node (or `step-N` positional id on linear runs) whose action
-   *  emitted the artifact. */
-  nodeId: string;
-  name: string;
-  contentType: string;
-  byteSize: number;
-  /** First 2KiB of textual content; null for binary content types. */
-  preview: string | null;
-  createdAt: string;
-}
-interface HubWorkflowArtifactsResponse {
-  artifacts: HubWorkflowArtifact[];
-}
-/** Raw artifact bytes from the download route, with their stored content type. */
-interface HubWorkflowArtifactDownload {
-  bytes: Uint8Array;
-  contentType: string;
+  failures: number;
+  /** Null when no visit carried a cost row (never a fabricated 0). */
+  totalCostUsd: number | null;
+  /** Null when no visit recorded duration spans. */
+  avgDurationMs: number | null;
 }
-type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
-/** One author-time literal a gallery starter needs the user to supply. Every
- *  declared parameter is required; `example` is a valid value that seeds the
- *  form placeholder. */
-interface HubWorkflowTemplateParameter {
-  key: string;
-  label: string;
-  type: "string" | "integer";
-  help?: string;
-  example: string;
-  default?: string;
-  defaultFrom?: "native_evaluation";
-  required?: boolean;
-  advanced?: boolean;
+/** Failures grouped by a normalized error signature (ids/numbers/whitespace
+ *  stripped), most frequent first (top 5). */
+interface HubWorkflowFailureCluster {
+  signature: string;
+  count: number;
+  sampleRunIds: string[];
 }
-interface HubWorkflowTemplate {
-  id: string;
-  name: string;
-  summary: string;
-  category: HubWorkflowTemplateCategory;
-  icon: string;
-  requiresSandbox: boolean;
-  /** Providers the template references (a "uses GitHub" hint), sorted. */
-  providers: string[];
-  parameters: HubWorkflowTemplateParameter[];
-  /** The template with parameter tokens rendered to their example values. */
-  previewYaml: string;
-  setupNotes?: string[];
+/** An agent.run node whose outputs are near-static across runs — a
+ *  CANDIDATE for distillation, reported with its measurements, never a
+ *  verdict. */
+interface HubWorkflowDistillationCandidate {
+  nodeId: string;
+  matchRatio: number;
+  samples: number;
+  avgCostUsd: number | null;
 }
-/** A connection a definition needs, with where to connect it. */
-interface HubWorkflowConnectionRequirement {
-  provider: string;
-  connected: boolean;
-  kind: "integration" | "github_app";
-  /** Where to satisfy the requirement (App install flow for `github_app`,
-   *  integrations page otherwise); null when no target exists. */
-  connectUrl: string | null;
-  /** Another requirement in the same list that must be satisfied first — a
-   *  `github_app` install is claimed through the `github` connection, so it is
-   *  refused while that connection is missing. Null when nothing blocks this
-   *  requirement. The list is ordered prerequisite-first. */
-  prerequisite: {
-    provider: string;
-    kind: "integration" | "github_app";
-  } | null;
+interface HubWorkflowHealth {
+  /** The requested window (the `runs` parameter). */
+  runsWindow: number;
+  /** Terminal runs that actually went into the stats. */
+  runsAnalyzed: number;
+  nodes: HubWorkflowNodeHealth[];
+  failureClusters: HubWorkflowFailureCluster[];
+  distillationCandidates: HubWorkflowDistillationCandidate[];
 }
-/**
- * Result of instantiating a template. `created: false` is NOT an error — an
- * actionable continuation listing the connections to satisfy before retrying
- * the same call. Invalid parameters or a compile failure throw `HubSdkError`
- * (400) instead, matching the create route's contract.
- */
-type HubWorkflowTemplateInstantiateResult = {
-  created: true;
-  workflow: HubWorkflow;
-} | {
-  created: false;
-  connectionRequirements: HubWorkflowConnectionRequirement[];
-};
 type HubWorkflowDecisionStatus = "pending" | "resolved" | "expired" | "cancelled";
 type HubWorkflowDecisionOnTimeout = "wait" | "fail" | "default";
 /** How the answer arrived: a UI click, a provider-channel event (e.g. a Slack
@@ -1461,16 +1495,6 @@ interface HubWorkflowDecisionResolveResult {
   choice: string;
   resumed: boolean;
 }
-/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
- *  revealed only at mint/rotate time (only the hash is stored). */
-interface HubWorkflowHookEndpoint {
-  url: string;
-  token?: string;
-}
-interface HubWorkflowHookToken {
-  url: string;
-  token: string;
-}
 /** One step of an agent round's execution timeline (reasoning, or a tool call
  *  with args + result), as the step-page endpoint serves it. */
 type HubWorkflowAgentStep = {
@@ -1491,297 +1515,241 @@ interface HubWorkflowRunStepsPage {
   nextCursor: number | null;
 }
 //#endregion
-//#region src/broker.d.ts
-interface HubAppBrokerOptions {
-  baseUrl: string;
-  clientId: string;
-  clientSecret: string;
-  fetch?: typeof fetch;
-}
-interface HubAppBrokerToken {
-  accessToken: string;
-  expiresIn: number;
-  scopes: string[];
-}
-interface HubAppBrokerExchange extends HubAppBrokerToken {
-  grantId: string;
-  connectionId: string;
+//#region src/workflow-definition-types.d.ts
+interface HubWorkflowAction {
+  kind: string;
+  config: Record<string, unknown>;
 }
-/** Server-only client. App secrets never become a user's general API key.
- * Every invocation mints and consumes one short-lived, exact-grant token. */
-declare class HubAppBrokerClient {
-  private readonly options;
-  private readonly baseUrl;
-  private readonly fetcher;
-  constructor(options: HubAppBrokerOptions);
-  private token;
-  private readToken;
-  exchange(input: {
-    code: string;
-    redirectUri: string;
-    connectionId?: string;
-  }): Promise<HubAppBrokerExchange>;
-  mint(grantId: string): Promise<HubAppBrokerToken>;
-  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
+/** Inbound-event matcher for a `provider_event` trigger. */
+interface HubWorkflowEventFilter {
+  event: string;
+  action?: string;
+  repo?: string;
 }
-//#endregion
-//#region src/inbound-webhooks.d.ts
-/** Provider setup uses the existing authenticated Hub transport and vault. */
-interface HubInboundWebhookCreateOptions {
-  /** Inkbox identity that owns all selected channels. */
-  identityId?: string;
-  mailboxId?: string;
-  phoneNumberId?: string;
-  imessage?: boolean;
-  /** Linq: explicit owned lines; omitted does not mean every account line. */
-  phoneNumbers?: string[];
-  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
-  phoneNumberIds?: string[];
-  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
-  signingSecret?: string;
+interface HubWorkflowTrigger {
+  id: string;
+  kind: "provider_event" | "schedule" | "webhook";
+  enabled: boolean;
+  provider: string | null;
+  connectionId: string | null;
+  eventFilter: HubWorkflowEventFilter | null;
+  cron: string | null;
+  timezone: string | null;
+  nextFireAt: string | null;
+  lastFiredAt: string | null;
+  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
+  until: string | null;
 }
-interface HubInboundWebhookCreateResponse {
-  url: string;
-  /** True only when the provider subscription was created by the server. */
-  provisioned?: boolean;
-  /** Self-configured legacy providers can return a newly minted secret once. */
-  secret?: string;
-  inboundAddress?: string;
-  requiresProviderSetup?: boolean;
+interface HubWorkflowValidationError {
+  path: string;
+  message: string;
+  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
+  code?: string;
 }
-interface HubInboundWebhookStatus {
-  configured: boolean;
-  url?: string;
-  /** Configuration is not evidence of a real delivered message. */
-  deliveryVerified: false;
-  requiresProviderSetup?: boolean;
+interface HubWorkflow {
+  id: string;
+  name: string;
+  description: string | null;
+  enabled: boolean;
+  /** Compiled engine actions (connection refs resolved to ids). */
+  actions: HubWorkflowAction[];
+  /** The durable YAML this workflow compiled from. */
+  definitionYaml: string | null;
+  validationErrors: HubWorkflowValidationError[];
+  /** Current head revision; null on pre-versioning rows until their next
+   *  update (they have no revision history to point at yet). */
+  headRev?: number | null;
+  /** Present on get/create/update detail responses; omitted on list. */
+  triggers?: HubWorkflowTrigger[];
+  /** Present on the detail response: the trigger fields a manual run must supply,
+   *  derived from the definition's `${trigger.*}` references (empty when none). */
+  manualRunInputs?: HubManualRunInput[];
+  /** Present on the get-detail response: the compiled graph topology (null
+   *  when the definition has no graph topology, or is chain-equivalent —
+   *  the legacy linear semantics). Omitted on the list projection. */
+  graph?: HubWorkflowGraphSpec | null;
+  /** Create response only, when the definition has a webhook trigger: the
+   *  hook delivery URL, plus the plaintext bearer token exactly once at mint
+   *  (absent when an active token already exists — rotate to re-reveal). */
+  hook?: HubWorkflowHookEndpoint;
+  /** Present on the list response (latest run, or null if never run); omitted on detail. */
+  lastRun?: HubWorkflowRunSummary | null;
+  createdAt: string;
+  updatedAt: string;
 }
-/** Live provider readback for one explicitly selected Linq WhatsApp number. */
-interface HubInboundPhoneNumberScope {
-  configured: true;
-  provisioned: true;
-  subscribed: true;
-  phoneNumberIds: string[];
+/** A trigger field a manual "Run now" must supply (derived from the
+ *  definition's `${trigger.*}` references). `required` is false only when every
+ *  read is wrapped in a `default(...)`. */
+interface HubManualRunInput {
+  path: string;
+  required: boolean;
 }
-declare class HubInboundWebhooksClient {
-  private readonly request;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
-  get(connectionId: string): Promise<HubInboundWebhookStatus>;
-  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
-  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
-  /** Remove event subscriptions first. This does not silently rotate a live URL. */
-  delete(connectionId: string): Promise<{
-    removed: boolean;
-  }>;
-  private path;
+type HubWorkflowValidateResponse = {
+  valid: true;
+  name: string;
+  actionCount: number;
+  triggerCount: number;
+} | {
+  valid: false;
+  errors: HubWorkflowValidationError[];
+};
+/** JSON Schema for the YAML workflow definition. */
+type HubWorkflowSchemaResponse = Record<string, unknown>;
+type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
+/** Lifecycle state of a revision. The head rev only ever points at an
+ *  `applied` revision; `proposed` is a service-token-authored suggestion
+ *  awaiting an owner decision; `rejected` is a declined proposal (kept for
+ *  audit). */
+type HubWorkflowRevisionStatus = "applied" | "proposed" | "rejected";
+/** Revision list projection — attribution + note + status, WITHOUT the YAML body. */
+interface HubWorkflowRevisionMeta {
+  rev: number;
+  createdAt: string;
+  createdBy: string;
+  source: HubWorkflowRevisionSource;
+  note: string | null;
+  status: HubWorkflowRevisionStatus;
 }
-//#endregion
-//#region src/knowledge-management.d.ts
-interface KnowledgeReference {
-  sourceId: string;
-  generation: string;
+/** One revision WITH its YAML (and the actions compiled alongside it). */
+interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
+  yaml: string;
+  actions: HubWorkflowAction[];
 }
-/** Connection references only. Provider credentials never enter this contract. */
-interface KnowledgeEmbeddingSpace {
-  connectionId: string;
-  model: string;
-  dimensions: number;
+/** A proposal (proposed or rejected revision) WITH its evidence — what the
+ *  proposer derived the suggestion from (e.g. health stats), plus
+ *  `rejectionReason` once declined. */
+interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
+  evidence: unknown;
 }
-type KnowledgeSourceInput = {
-  kind: "file";
-  name: string;
-  base64: string;
-  mediaType: string;
-} | {
-  kind: "git";
-  connectionId: string;
-  owner: string;
-  repo: string;
-  ref: string;
-  pathPrefix?: string;
-} | {
-  kind: "url";
-  url: string;
-} | {
-  kind: "s3";
-  connectionId: string;
-  bucket: string;
-  prefix: string;
-} | {
-  kind: "vector";
-  connectionId: string;
-  provider: "pinecone" | "qdrant" | "weaviate";
-  indexName: string;
-  namespace?: string;
-  embedding: KnowledgeEmbeddingSpace;
-  textField: string;
-  sourceUriField: string;
-};
-interface KnowledgeCapability {
-  supported: boolean;
-  reason?: string;
+/** Input to {@link HubWorkflowsClient.propose}. Service-token callers only. */
+interface HubWorkflowProposalInput {
+  yaml: string;
+  note?: string;
+  /** Proposer-supplied justification (any JSON value) — carried verbatim onto
+   *  the revision and shown on the approval surface. */
+  evidence?: unknown;
 }
-interface KnowledgeCapabilities {
-  delegation?: KnowledgeCapability & {
-    resource?: string;
-    scopes?: string[];
-  };
-  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
-  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
-  managedVector: KnowledgeCapability;
-  file: {
-    mediaTypes: string[];
-    maxBytes: number;
-    maxObjects: number;
-  };
+type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
+/** One author-time literal a gallery starter needs the user to supply. Every
+ *  declared parameter is required; `example` is a valid value that seeds the
+ *  form placeholder. */
+interface HubWorkflowTemplateParameter {
+  key: string;
+  label: string;
+  type: "string" | "integer";
+  help?: string;
+  example: string;
+  default?: string;
+  defaultFrom?: "native_evaluation";
+  required?: boolean;
+  advanced?: boolean;
 }
-interface KnowledgeSourceSummary {
-  /** Required query authorization, not proof that an owner policy currently permits it. */
-  retrieval?: {
-    kind: "lexical";
-  } | {
-    kind: "vector";
-    embeddingPolicy: {
-      connectionId: string;
-      actionPath: "openai.embeddings.create";
-      scope: "owner-connection-action";
-    };
-  };
+interface HubWorkflowTemplate {
   id: string;
   name: string;
-  kind: KnowledgeSourceInput["kind"];
-  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
-  approval?: {
-    id: string;
-    path: string;
-    preview: {
-      provider: string;
-      connectionId: string;
-      collection: string;
-      sourceId: string;
-      requestId: string;
-      embedding: KnowledgeEmbeddingSpace;
-      chunkCount: number;
-      sourceCount: number;
-      dataSharing: string;
-    };
-  };
-  refreshRequestId?: string;
-  generation: string | null;
-  lastError: {
-    code: string;
-    message: string;
+  summary: string;
+  category: HubWorkflowTemplateCategory;
+  icon: string;
+  requiresSandbox: boolean;
+  /** Providers the template references (a "uses GitHub" hint), sorted. */
+  providers: string[];
+  parameters: HubWorkflowTemplateParameter[];
+  /** The template with parameter tokens rendered to their example values. */
+  previewYaml: string;
+  setupNotes?: string[];
+}
+/** A connection a definition needs, with where to connect it. */
+interface HubWorkflowConnectionRequirement {
+  provider: string;
+  connected: boolean;
+  kind: "integration" | "github_app";
+  /** Where to satisfy the requirement (App install flow for `github_app`,
+   *  integrations page otherwise); null when no target exists. */
+  connectUrl: string | null;
+  /** Another requirement in the same list that must be satisfied first — a
+   *  `github_app` install is claimed through the `github` connection, so it is
+   *  refused while that connection is missing. Null when nothing blocks this
+   *  requirement. The list is ordered prerequisite-first. */
+  prerequisite: {
+    provider: string;
+    kind: "integration" | "github_app";
   } | null;
-  updatedAt: string;
 }
-type KnowledgeAttachmentAuthorization = {
-  status: "active";
+/**
+ * Result of instantiating a template. `created: false` is NOT an error — an
+ * actionable continuation listing the connections to satisfy before retrying
+ * the same call. Invalid parameters or a compile failure throw `HubSdkError`
+ * (400) instead, matching the create route's contract.
+ */
+type HubWorkflowTemplateInstantiateResult = {
+  created: true;
+  workflow: HubWorkflow;
 } | {
-  status: "unavailable";
-  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+  created: false;
+  connectionRequirements: HubWorkflowConnectionRequirement[];
 };
-interface KnowledgeAttachment {
-  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
-  authorization?: KnowledgeAttachmentAuthorization;
-  id: string;
-  sourceId: string;
-  sandboxId: string;
-  generation: string;
-  status: "active" | "detached";
+/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
+ *  revealed only at mint/rotate time (only the hash is stored). */
+interface HubWorkflowHookEndpoint {
+  url: string;
+  token?: string;
 }
-interface KnowledgeSourceCreate {
-  requestId: string;
-  name: string;
-  source: KnowledgeSourceInput;
-  target?: {
-    kind: "lexical";
-  } | {
-    kind: "managed-vector";
-    provider: "qdrant";
-    connectionId: string;
-    embedding: KnowledgeEmbeddingSpace;
-  };
+interface HubWorkflowHookToken {
+  url: string;
+  token: string;
 }
-/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
-interface KnowledgeAuthorization {
-  userId: string;
-  clientId: string;
-  resource: string;
-  scopes: Array<"knowledge:read" | "knowledge:write">;
+//#endregion
+//#region src/workflow-storage-types.d.ts
+/** One KV entry with its metadata — the get/put/cas response shape. */
+interface HubWorkflowKvEntry {
+  key: string;
+  value: unknown;
+  version: number;
+  updatedAt: string;
 }
-declare class HubKnowledgeManagementClient {
-  private readonly request;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  materialize(input: {
-    sandboxId: string;
-    references: KnowledgeReference[];
-  }): Promise<KnowledgeAttachment[]>;
-  authorization(): Promise<KnowledgeAuthorization>;
-  disconnectAuthorization(): Promise<{
-    revoked: true;
-  }>;
-  capabilities(): Promise<KnowledgeCapabilities>;
-  list(): Promise<KnowledgeSourceSummary[]>;
-  get(sourceId: string): Promise<KnowledgeSourceSummary>;
-  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
-  refresh(sourceId: string, input: {
-    requestId: string;
-    approvalToken?: string;
-  }): Promise<KnowledgeSourceSummary>;
-  attach(sourceId: string, input: {
-    sandboxId: string;
-    generation: string;
-    expectedGeneration?: string;
-  }): Promise<KnowledgeAttachment>;
-  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
-  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+/** Keyspace metadata row (never the value) — the list response's entry. */
+interface HubWorkflowKvEntryMeta {
+  key: string;
+  version: number;
+  updatedAt: string;
 }
-//#endregion
-//#region src/knowledge.d.ts
-interface HubKnowledgeRetrievalResult {
-  attachmentId: string;
-  generation: string;
-  provenance: "ingested" | "record-supplied";
-  hits: Array<{
-    id: string;
-    title: string;
-    snippet: string;
-    score?: number;
-    citations?: Array<{
-      sourceId: string;
-      sourceUri: string;
-      revision?: string;
-    }>;
-  }>;
-  elapsedMs?: number;
+interface HubWorkflowKvListResponse {
+  entries: HubWorkflowKvEntryMeta[];
 }
-interface HubKnowledgeQueryResult {
-  results: HubKnowledgeRetrievalResult[];
-  /** Individual unavailable sources do not hide evidence from healthy sources. */
-  failures: Array<{
-    attachmentId: string;
-    code: string;
-    message: string;
-  }>;
-  partial: boolean;
+interface HubWorkflowKvDeleteResponse {
+  deleted: boolean;
 }
-/** Runtime-only retrieval. The authenticated sandbox credential determines the
- * scope on the server; neither a caller nor an agent can supply another scope. */
-declare class HubKnowledgeClient {
-  private readonly request;
-  readonly management: HubKnowledgeManagementClient;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  bindings(): Promise<{
-    references: KnowledgeReference[];
-  }>;
-  query(input: {
-    query: string;
-    limit?: number;
-    expectedReferences?: KnowledgeReference[];
-  }, options?: {
-    signal?: AbortSignal;
-  }): Promise<HubKnowledgeQueryResult>;
+/** The opaque ref a stored artifact is referred to by — the value a
+ *  script.run node returns as its step output. */
+interface HubWorkflowArtifactRef {
+  $artifact: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  preview: string | null;
+}
+/** Artifact metadata (never the bytes), oldest first on the list response. */
+interface HubWorkflowArtifact {
+  id: string;
+  runId: string;
+  workflowId: string;
+  /** The graph node (or `step-N` positional id on linear runs) whose action
+   *  emitted the artifact. */
+  nodeId: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  /** First 2KiB of textual content; null for binary content types. */
+  preview: string | null;
+  createdAt: string;
+}
+interface HubWorkflowArtifactsResponse {
+  artifacts: HubWorkflowArtifact[];
+}
+/** Raw artifact bytes from the download route, with their stored content type. */
+interface HubWorkflowArtifactDownload {
+  bytes: Uint8Array;
+  contentType: string;
 }
 //#endregion
 //#region src/lines.d.ts
@@ -2123,7 +2091,7 @@ declare class HubManagedNumbersClient {
   private post;
 }
 //#endregion
-//#region src/client.d.ts
+//#region src/transport.d.ts
 type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
 interface HubClientOptions {
   baseUrl: string;
@@ -2139,18 +2107,6 @@ declare class HubSdkError extends Error {
     status?: number;
   });
 }
-declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
-declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
-declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
-type HubEnv = Record<string, string | undefined>;
-interface HubClientFromEnvOptions {
-  env?: HubEnv;
-  apiKey?: string;
-  authHeaders?: HubAuthHeaders;
-  fetch?: typeof fetch;
-}
-declare function resolveHubBaseUrl(env?: HubEnv): string;
-declare function resolveHubAuth(env?: HubEnv): string;
 declare class HubTransport {
   #private;
   readonly baseUrl: string;
@@ -2165,52 +2121,32 @@ declare class HubTransport {
   }): Promise<TData>;
   protected buildHeaders(headers: HeadersInit | undefined, callerAuth?: boolean): Promise<Headers>;
 }
-declare class HubClient extends HubTransport {
-  readonly knowledge: HubKnowledgeClient;
-  readonly allowances: HubAllowancesClient;
-  readonly apps: HubAppsClient;
-  readonly connections: HubConnectionsClient;
-  readonly channels: HubChannelsClient;
-  readonly numbers: HubManagedNumbersClient;
-  readonly eventSubscriptions: HubEventSubscriptionsClient;
-  readonly permissions: HubPermissionsClient;
-  readonly tokens: HubTokensClient;
-  readonly tools: HubToolsClient;
-  readonly approvals: HubApprovalsClient;
-  readonly audit: HubAuditClient;
-  readonly githubApp: HubGithubAppClient;
-  readonly workflows: HubWorkflowsClient;
-  readonly lines: HubLinesClient;
-  constructor(options: HubClientOptions);
-  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
-  status(): Promise<HubStatusResponse>;
-  /**
-   * Open a streaming (Server-Sent Events) response and return its raw body.
-   * Shares auth-header building + `fetch` with {@link request}, but does NOT
-   * buffer or JSON-parse the body — the caller consumes the stream.
-   *
-   * A successful stream comes back as `text/event-stream`. Anything else is an
-   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-   * page); it is surfaced the same way {@link request} surfaces errors — a
-   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-   */
-  private stream;
-  /**
-   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-   * the artifact's own content type, not JSON. Error responses on such routes
-   * are still the standard envelope, so a failure surfaces exactly like
-   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-   * otherwise an `HUB_HTTP_<status>` transport error.
-   */
-  private requestBytes;
+/** Domain clients receive the existing envelope transport as one request function. */
+type HubRequest = <TData>(path: string, init: RequestInit) => Promise<TData>;
+type HubStreamRequest = (path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>;
+type HubArtifactRequest = (path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>;
+//#endregion
+//#region src/environment.d.ts
+declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
+declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
+declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
+type HubEnv = Record<string, string | undefined>;
+interface HubClientFromEnvOptions {
+  env?: HubEnv;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
 }
+declare function resolveHubBaseUrl(env?: HubEnv): string;
+declare function resolveHubAuth(env?: HubEnv): string;
+//#endregion
+//#region src/authorization.d.ts
 interface HubTokenListOptions {
   includeExpired?: boolean;
 }
 declare class HubTokensClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mint(options: {
     actionPath: string;
     connectionId?: string;
@@ -2222,7 +2158,7 @@ declare class HubTokensClient {
 }
 declare class HubPermissionsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(connectionId: string): Promise<HubPolicyListResponse>;
   set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse>;
   /** Reset an action to its default by deleting any stored override. */
@@ -2235,6 +2171,15 @@ declare class HubPermissionsClient {
    *  connection. Manual per-action decisions are left intact. */
   revertWrites(connectionId: string): Promise<HubRevertWritesResponse>;
 }
+declare class HubApprovalsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubApprovalListResponse>;
+  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+}
+//#endregion
+//#region src/tools.d.ts
 interface HubToolSearchOptions {
   provider?: string;
   /** Max tools to return. The server defaults to a relevance-ranked shortlist
@@ -2258,7 +2203,7 @@ interface HubToolInvokeOptions {
 }
 declare class HubToolsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
   sources(): Promise<HubToolSourcesResponse>;
   describe(path: string): Promise<HubToolsDescribeResponse>;
@@ -2270,6 +2215,60 @@ declare class HubToolsClient {
   invoke<TResult = unknown>(path: string, raw: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
   private buildExecInit;
 }
+//#endregion
+//#region src/inbound-webhooks.d.ts
+/** Provider setup uses the existing authenticated Hub transport and vault. */
+interface HubInboundWebhookCreateOptions {
+  /** Inkbox identity that owns all selected channels. */
+  identityId?: string;
+  mailboxId?: string;
+  phoneNumberId?: string;
+  imessage?: boolean;
+  /** Linq: explicit owned lines; omitted does not mean every account line. */
+  phoneNumbers?: string[];
+  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
+  phoneNumberIds?: string[];
+  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
+  signingSecret?: string;
+}
+interface HubInboundWebhookCreateResponse {
+  url: string;
+  /** True only when the provider subscription was created by the server. */
+  provisioned?: boolean;
+  /** Self-configured legacy providers can return a newly minted secret once. */
+  secret?: string;
+  inboundAddress?: string;
+  requiresProviderSetup?: boolean;
+}
+interface HubInboundWebhookStatus {
+  configured: boolean;
+  url?: string;
+  /** Configuration is not evidence of a real delivered message. */
+  deliveryVerified: false;
+  requiresProviderSetup?: boolean;
+}
+/** Live provider readback for one explicitly selected Linq WhatsApp number. */
+interface HubInboundPhoneNumberScope {
+  configured: true;
+  provisioned: true;
+  subscribed: true;
+  phoneNumberIds: string[];
+}
+declare class HubInboundWebhooksClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
+  get(connectionId: string): Promise<HubInboundWebhookStatus>;
+  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
+  /** Remove event subscriptions first. This does not silently rotate a live URL. */
+  delete(connectionId: string): Promise<{
+    removed: boolean;
+  }>;
+  private path;
+}
+//#endregion
+//#region src/connections.d.ts
 interface HubConnectionStartOptions {
   returnUrl?: string;
   cli?: boolean;
@@ -2277,24 +2276,10 @@ interface HubConnectionStartOptions {
   /** GitHub accepts the exact read:user, repo, read:org set. */
   requestedScopes?: readonly string[];
 }
-declare class HubChannelsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubChannelsResponse>;
-  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
-  delete(channelId: string): Promise<HubChannelDeleteResponse>;
-}
-declare class HubEventSubscriptionsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubEventSubscriptionsResponse>;
-  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
-  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
-}
 declare class HubConnectionsClient {
   private readonly request;
   readonly inboundWebhook: HubInboundWebhooksClient;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(): Promise<HubConnectionsResponse>;
   /** Connector catalog: every provider the hub can expose, each flagged with
    *  `configured` (whether its OAuth app credentials are wired). Callers render
@@ -2312,16 +2297,27 @@ declare class HubConnectionsClient {
   revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
   health(connectionId: string): Promise<HubConnectionHealthResponse>;
 }
-declare class HubApprovalsClient {
+//#endregion
+//#region src/channels.d.ts
+declare class HubChannelsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubApprovalListResponse>;
-  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
-  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  constructor(request: HubRequest);
+  list(): Promise<HubChannelsResponse>;
+  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
+  delete(channelId: string): Promise<HubChannelDeleteResponse>;
+}
+declare class HubEventSubscriptionsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubEventSubscriptionsResponse>;
+  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
+  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
 }
+//#endregion
+//#region src/github-app.d.ts
 declare class HubGithubAppClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mintInstallationToken(input: HubGithubAppMintInstallationTokenRequest): Promise<HubGithubAppMintInstallationTokenResponse>;
   /** Every installation the caller may act through — their own and any org's
    *  they were verified against. The management surface's read. */
@@ -2343,16 +2339,20 @@ declare class HubGithubAppClient {
     repo: string;
   }): Promise<HubGithubAppIsRepoInstalledResponse>;
 }
+//#endregion
+//#region src/audit.d.ts
 declare class HubAuditClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(options?: HubAuditListRequest): Promise<HubAuditResponse>;
 }
+//#endregion
+//#region src/workflows.d.ts
 declare class HubWorkflowsClient {
   private readonly request;
   private readonly stream?;
   private readonly download?;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>, stream?: ((path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>) | undefined, download?: ((path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>) | undefined);
+  constructor(request: HubRequest, stream?: HubStreamRequest | undefined, download?: HubArtifactRequest | undefined);
   list(): Promise<HubWorkflow[]>;
   /**
    * Owner-wide fleet overview: one row per workflow with its run tallies over
@@ -2658,6 +2658,48 @@ declare class HubWorkflowsClient {
   schema(): Promise<HubWorkflowSchemaResponse>;
 }
 //#endregion
+//#region src/client.d.ts
+declare class HubClient extends HubTransport {
+  readonly knowledge: HubKnowledgeClient;
+  readonly allowances: HubAllowancesClient;
+  readonly apps: HubAppsClient;
+  readonly connections: HubConnectionsClient;
+  readonly channels: HubChannelsClient;
+  readonly numbers: HubManagedNumbersClient;
+  readonly eventSubscriptions: HubEventSubscriptionsClient;
+  readonly permissions: HubPermissionsClient;
+  readonly tokens: HubTokensClient;
+  readonly tools: HubToolsClient;
+  readonly approvals: HubApprovalsClient;
+  readonly audit: HubAuditClient;
+  readonly githubApp: HubGithubAppClient;
+  readonly workflows: HubWorkflowsClient;
+  readonly lines: HubLinesClient;
+  constructor(options: HubClientOptions);
+  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
+  status(): Promise<HubStatusResponse>;
+  /**
+   * Open a streaming (Server-Sent Events) response and return its raw body.
+   * Shares auth-header building + `fetch` with {@link request}, but does NOT
+   * buffer or JSON-parse the body — the caller consumes the stream.
+   *
+   * A successful stream comes back as `text/event-stream`. Anything else is an
+   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+   * page); it is surfaced the same way {@link request} surfaces errors — a
+   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+   */
+  private stream;
+  /**
+   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+   * the artifact's own content type, not JSON. Error responses on such routes
+   * are still the standard envelope, so a failure surfaces exactly like
+   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+   * otherwise an `HUB_HTTP_<status>` transport error.
+   */
+  private requestBytes;
+}
+//#endregion
 //#region src/event-delivery.d.ts
 type HubEventSignatureFailure = "missing" | "malformed" | "stale" | "mismatch";
 type HubEventSignatureResult = {