@tangle-network/hub-sdk 0.33.1-develop.20260828203536.11e3e70 → 0.33.2

package/dist/index.d.ts

@@ -1,4 +1,553 @@
-//#region src/types.d.ts
+//#region src/allowances.d.ts
+/**
+ * Allowances: a developer's per-member daily allowance on a meter, and the
+ * paywall decision past it. The platform counts every admitted turn and reads
+ * each payer's dollars from the ledger; the app keeps only its checkout and
+ * records a paying member with {@link HubAllowancesClient.grant}.
+ *
+ * Only the meter's owner may call these, signed in or with a root API key of
+ * their own. A delegated or resource-bound key, such as the key a hosted end
+ * user's sandbox runs on, is refused.
+ */
+type HubAllowanceTier = "free" | "paid" | "owner";
+type HubAllowanceRole = "owner" | "member";
+interface HubAllowancePlanInput {
+  free: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+  };
+  /** Null turns billing off: past the free allowance nothing lifts the limit. */
+  paid: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+    priceUsdMonthly: number;
+  } | null;
+  owner?: {
+    turnsPerDay: number;
+  };
+  /** Key resource type whose ledger spend counts against a payer's dollars. */
+  spendResourceType: string | null;
+}
+interface HubAllowancePlan extends HubAllowancePlanInput {
+  meter: string;
+  owner: {
+    turnsPerDay: number;
+  };
+  /** False while the meter runs on the default plan. */
+  configured: boolean;
+  updatedAt: string | null;
+}
+interface HubAllowanceSubject {
+  member: string;
+  role?: HubAllowanceRole;
+  /** The member whose keys pay for the turn, when that is someone else. */
+  payer?: string;
+  payerRole?: HubAllowanceRole;
+}
+interface HubAllowanceDecision {
+  /** `paywall`: paying lifts the limit. `allowance_reached`: nothing does today. */
+  decision: "admit" | "paywall" | "allowance_reached";
+  tier: HubAllowanceTier;
+  paywall: boolean;
+  turns: {
+    used: number;
+    limit: number;
+  };
+  usd: {
+    spent: number;
+    limit: number;
+    remaining: number;
+  } | null;
+  day: string;
+  resetsAt: string;
+  /**
+   * A paying payer's spend in the current paid period against what funds it:
+   * the plan price less Tangle's 10% fee, plus the free daily allowance for
+   * the period. A paid turn is refused once `remaining` is gone.
+   */
+  period?: {
+    spent: number;
+    funded: number;
+    remaining: number;
+    startsAt: string;
+    endsAt: string;
+  };
+  replay?: boolean;
+}
+interface HubAllowanceUsage {
+  day: string;
+  turns: number;
+  members: Array<{
+    member: string;
+    turns: number;
+    tier: HubAllowanceTier;
+    usdSpent: number | null;
+  }>;
+  lines: Array<{
+    line: string;
+    turns: number;
+  }>;
+}
+interface HubAllowanceSyncInput {
+  source: string;
+  revision: number;
+  expiresAt: string | null;
+  reference: string | null;
+}
+interface HubAllowanceSyncReceipt extends HubAllowanceSyncInput {
+  member: string;
+}
+interface HubAllowanceGrant {
+  member: string;
+  tier: "paid";
+  expiresAt: string;
+  reference: string | null;
+}
+declare class HubAllowancesClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  plan(meter: string): Promise<HubAllowancePlan>;
+  setPlan(meter: string, plan: HubAllowancePlanInput): Promise<HubAllowancePlan>;
+  /** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+  admit(meter: string, input: HubAllowanceSubject & {
+    turnId: string;
+    line?: string;
+    channel?: string;
+  }): Promise<HubAllowanceDecision>;
+  /** What the member's next turn would get, without counting anything. */
+  status(meter: string, subject: HubAllowanceSubject): Promise<HubAllowanceDecision>;
+  /** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+  grant(meter: string, member: string, input: {
+    expiresAt: string;
+    reference?: string | null;
+  }): Promise<HubAllowanceGrant>;
+  /** Synchronize a paid grant by durable product revision. Null expiry writes
+   * a retained revocation. A delayed older update is refused, never reactivated.
+   * There is no fallback to the unversioned grant endpoint on older servers. */
+  syncGrant(meter: string, member: string, input: HubAllowanceSyncInput): Promise<HubAllowanceSyncReceipt>;
+  revoke(meter: string, member: string): Promise<void>;
+  /** Turns per member and per line on one UTC day (default today). */
+  usage(meter: string, day?: string): Promise<HubAllowanceUsage>;
+  private path;
+  private memberPath;
+  private body;
+}
+//#endregion
+//#region src/apps.d.ts
+/** The compliance claim an owner latches through a BAA acceptance. Positive
+ * claims only: `{ hipaa: true }` or absent — `hipaa: false` is unspellable. */
+interface HubAppComplianceClaim {
+  hipaa: true;
+}
+/** Owner-facing compliance state: the latched claim and the acceptance behind it. */
+interface HubAppComplianceState {
+  compliance: HubAppComplianceClaim | null;
+  agreement: {
+    version: string;
+    url: string;
+  } | null;
+  acceptance: {
+    agreementVersion: string;
+    agreementUrl: string;
+    acceptedByUserId: string;
+    acceptedAt: string;
+  } | null;
+}
+/** App identity and customer permissions over the existing Platform transport.
+ * These operations do not authorize spending or expose upstream credentials. */
+interface HubApp {
+  id: string;
+  clientId: string;
+  oauthClientId: string | null;
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl: string | null;
+  accessPayer?: "user" | "app-owner";
+  /** Latched HIPAA declaration; absent or null means "no claim". */
+  compliance?: HubAppComplianceClaim | null;
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubAppCreateInput {
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl?: string;
+  /** The registered app owner funds eligibility; customer permissions remain separate. */
+  accessPayer?: "user" | "app-owner";
+  /** Associate an existing owned login client in the same transaction as creation. */
+  oauthClientId?: string;
+}
+interface HubAppGrant {
+  id: string;
+  appId: string;
+  userId: string;
+  connectionId: string;
+  scopes: string[];
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+  revokedAt: string | null;
+  /** Display metadata is additive; older deployments may omit it. */
+  appName?: string | null;
+  oauthClientId?: string | null;
+  providerId?: string | null;
+  accountDisplay?: string | null;
+  connectionDisplayName?: string | null;
+}
+interface HubAppGrantRevoked {
+  grantId: string;
+  status: "revoked";
+  revokedAt: string | null;
+  tokensRevoked: number;
+}
+declare class HubAppsClient {
+  private readonly request;
+  readonly grants: {
+    list: () => Promise<HubAppGrant[]>;
+    revoke: (grantId: string) => Promise<HubAppGrantRevoked>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  list(): Promise<HubApp[]>;
+  /** The secret is returned only by creation; keep it in your server vault. */
+  create(input: HubAppCreateInput): Promise<{
+    app: HubApp;
+    clientSecret: string;
+  }>;
+  /** Immutable association of two existing records with the same owner. */
+  linkOAuthClient(appId: string, clientId: string): Promise<{
+    appId: string;
+    oauthClientId: string;
+  }>;
+  revoke(appId: string): Promise<{
+    appId: string;
+    grantsRevoked: number;
+    tokensRevoked: number;
+  }>;
+  /** Current latched compliance state and the BAA acceptance behind it. */
+  getCompliance(appId: string): Promise<HubAppComplianceState>;
+  /**
+   * Latch HIPAA compliance for this app. The request MUST carry the exact
+   * `agreementVersion` the deployment currently offers — the acceptance is
+   * recorded before the claim exists, and the claim can never be cleared:
+   * `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+   */
+  setCompliance(appId: string, input: {
+    hipaa: boolean;
+    agreementVersion?: string;
+  }): Promise<HubAppComplianceState>;
+}
+//#endregion
+//#region src/tool-types.d.ts
+interface HubToolSource {
+  sourceId: string;
+  providerId: string;
+  displayName: string;
+  toolCount: number;
+  connectionStatus: "connected" | "missing" | "unknown";
+  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
+  configured: boolean;
+}
+/** Per-tool catalog risk class. The first three mirror the platform's
+ *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
+ *  classify (substrate connectors). */
+type HubToolRisk = "read" | "write" | "destructive" | "unknown";
+interface HubTool {
+  path: string;
+  providerId?: string;
+  title?: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  connectionRequired?: boolean;
+  connectionStatus?: "connected" | "missing" | "unknown";
+  requiredConnectionProviderId?: string;
+  policyState?: "allow" | "ask" | "deny" | "unknown";
+  risk?: HubToolRisk;
+}
+interface HubToolSourcesResponse {
+  sources: HubToolSource[];
+}
+interface HubToolsSearchResponse {
+  tools: HubTool[];
+}
+interface HubToolsDescribeResponse {
+  tool: HubTool;
+}
+interface HubExecResponse<TResult = unknown> {
+  result: TResult;
+  /** True when the result was replayed from a previous call with the same
+   *  idempotency key, so the action did not run again. */
+  replayed?: boolean;
+}
+//#endregion
+//#region src/broker.d.ts
+interface HubAppBrokerOptions {
+  baseUrl: string;
+  clientId: string;
+  clientSecret: string;
+  fetch?: typeof fetch;
+}
+interface HubAppBrokerToken {
+  accessToken: string;
+  expiresIn: number;
+  scopes: string[];
+}
+interface HubAppBrokerExchange extends HubAppBrokerToken {
+  grantId: string;
+  connectionId: string;
+}
+/** Server-only client. App secrets never become a user's general API key.
+ * Every invocation mints and consumes one short-lived, exact-grant token. */
+declare class HubAppBrokerClient {
+  private readonly options;
+  private readonly baseUrl;
+  private readonly fetcher;
+  constructor(options: HubAppBrokerOptions);
+  private token;
+  private readToken;
+  exchange(input: {
+    code: string;
+    redirectUri: string;
+    connectionId?: string;
+  }): Promise<HubAppBrokerExchange>;
+  mint(grantId: string): Promise<HubAppBrokerToken>;
+  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
+}
+//#endregion
+//#region src/knowledge-management.d.ts
+interface KnowledgeReference {
+  sourceId: string;
+  generation: string;
+}
+/** Connection references only. Provider credentials never enter this contract. */
+interface KnowledgeEmbeddingSpace {
+  connectionId: string;
+  model: string;
+  dimensions: number;
+}
+type KnowledgeSourceInput = {
+  kind: "file";
+  name: string;
+  base64: string;
+  mediaType: string;
+} | {
+  kind: "git";
+  connectionId: string;
+  owner: string;
+  repo: string;
+  ref: string;
+  pathPrefix?: string;
+} | {
+  kind: "url";
+  url: string;
+} | {
+  kind: "s3";
+  connectionId: string;
+  bucket: string;
+  prefix: string;
+} | {
+  kind: "vector";
+  connectionId: string;
+  provider: "pinecone" | "qdrant" | "weaviate";
+  indexName: string;
+  namespace?: string;
+  embedding: KnowledgeEmbeddingSpace;
+  textField: string;
+  sourceUriField: string;
+};
+interface KnowledgeCapability {
+  supported: boolean;
+  reason?: string;
+}
+interface KnowledgeCapabilities {
+  delegation?: KnowledgeCapability & {
+    resource?: string;
+    scopes?: string[];
+  };
+  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
+  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
+  managedVector: KnowledgeCapability;
+  file: {
+    mediaTypes: string[];
+    maxBytes: number;
+    maxObjects: number;
+  };
+}
+interface KnowledgeSourceSummary {
+  /** Required query authorization, not proof that an owner policy currently permits it. */
+  retrieval?: {
+    kind: "lexical";
+  } | {
+    kind: "vector";
+    embeddingPolicy: {
+      connectionId: string;
+      actionPath: "openai.embeddings.create";
+      scope: "owner-connection-action";
+    };
+  };
+  id: string;
+  name: string;
+  kind: KnowledgeSourceInput["kind"];
+  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
+  approval?: {
+    id: string;
+    path: string;
+    preview: {
+      provider: string;
+      connectionId: string;
+      collection: string;
+      sourceId: string;
+      requestId: string;
+      embedding: KnowledgeEmbeddingSpace;
+      chunkCount: number;
+      sourceCount: number;
+      dataSharing: string;
+    };
+  };
+  refreshRequestId?: string;
+  generation: string | null;
+  lastError: {
+    code: string;
+    message: string;
+  } | null;
+  updatedAt: string;
+}
+type KnowledgeAttachmentAuthorization = {
+  status: "active";
+} | {
+  status: "unavailable";
+  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+};
+interface KnowledgeAttachment {
+  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
+  authorization?: KnowledgeAttachmentAuthorization;
+  id: string;
+  sourceId: string;
+  sandboxId: string;
+  generation: string;
+  status: "active" | "detached";
+}
+interface KnowledgeSourceCreate {
+  requestId: string;
+  name: string;
+  source: KnowledgeSourceInput;
+  target?: {
+    kind: "lexical";
+  } | {
+    kind: "managed-vector";
+    provider: "qdrant";
+    connectionId: string;
+    embedding: KnowledgeEmbeddingSpace;
+  };
+}
+/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
+interface KnowledgeAuthorization {
+  userId: string;
+  clientId: string;
+  resource: string;
+  scopes: Array<"knowledge:read" | "knowledge:write">;
+}
+declare class HubKnowledgeManagementClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  materialize(input: {
+    sandboxId: string;
+    references: KnowledgeReference[];
+  }): Promise<KnowledgeAttachment[]>;
+  authorization(): Promise<KnowledgeAuthorization>;
+  disconnectAuthorization(): Promise<{
+    revoked: true;
+  }>;
+  capabilities(): Promise<KnowledgeCapabilities>;
+  list(): Promise<KnowledgeSourceSummary[]>;
+  get(sourceId: string): Promise<KnowledgeSourceSummary>;
+  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
+  refresh(sourceId: string, input: {
+    requestId: string;
+    approvalToken?: string;
+  }): Promise<KnowledgeSourceSummary>;
+  attach(sourceId: string, input: {
+    sandboxId: string;
+    generation: string;
+    expectedGeneration?: string;
+  }): Promise<KnowledgeAttachment>;
+  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
+  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+}
+//#endregion
+//#region src/knowledge.d.ts
+interface HubKnowledgeRetrievalResult {
+  attachmentId: string;
+  generation: string;
+  provenance: "ingested" | "record-supplied";
+  hits: Array<{
+    id: string;
+    title: string;
+    snippet: string;
+    score?: number;
+    citations?: Array<{
+      sourceId: string;
+      sourceUri: string;
+      revision?: string;
+    }>;
+  }>;
+  elapsedMs?: number;
+}
+interface HubKnowledgeQueryResult {
+  results: HubKnowledgeRetrievalResult[];
+  /** Individual unavailable sources do not hide evidence from healthy sources. */
+  failures: Array<{
+    attachmentId: string;
+    code: string;
+    message: string;
+  }>;
+  partial: boolean;
+}
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+ * scope on the server; neither a caller nor an agent can supply another scope. */
+declare class HubKnowledgeClient {
+  private readonly request;
+  readonly management: HubKnowledgeManagementClient;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  bindings(): Promise<{
+    references: KnowledgeReference[];
+  }>;
+  query(input: {
+    query: string;
+    limit?: number;
+    expectedReferences?: KnowledgeReference[];
+  }, options?: {
+    signal?: AbortSignal;
+  }): Promise<HubKnowledgeQueryResult>;
+}
+//#endregion
+//#region src/audit-types.d.ts
+interface HubAuditEvent {
+  id: string;
+  action: string;
+  targetUserId: string | null;
+  targetKeyId: string | null;
+  metadata: unknown;
+  createdAt: string;
+}
+interface HubAuditListRequest {
+  provider?: string;
+  action?: string;
+  status?: string;
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+}
+interface HubAuditResponse {
+  events: HubAuditEvent[];
+  nextCursor: string | null;
+}
+//#endregion
+//#region src/transport-types.d.ts
 type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
 interface HubSuccessEnvelope<TData> {
   success: true;
@@ -8,13 +557,12 @@ interface HubErrorEnvelope {
   success: false;
   error: HubErrorBody;
 }
-type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
 interface HubErrorBody {
   code: HubErrorCode;
   message: string;
   details?: unknown;
 }
-type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | "SERVICE_DRAINING" | "WORKFLOW_STREAM_INTERRUPTED" | `HUB_HTTP_${number}`;
 interface HubStatusResponse {
   contract: unknown;
   principal: HubPrincipal;
@@ -31,22 +579,103 @@ interface HubStatusConnections {
   connectedProviderCount: number;
   unhealthyProviderCount: number;
 }
-interface HubConnection {
+//#endregion
+//#region src/authorization-types.d.ts
+interface HubTokenMintResponse {
+  token: string;
+  tokenId: string;
+  expiresAt: string;
+}
+interface HubCapabilityToken {
   id: string;
   providerId: string;
-  displayName: string;
-  accountDisplay: string | null;
-  providerAccountId: string | null;
-  scopes: string[];
-  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
-  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  connectionId: string;
+  connectionDisplay: string | null;
+  actionPath: string;
+  expiresAt: string;
+  status: "active" | "consumed" | "expired" | "revoked";
+  principalKind: HubPrincipalKind;
+  createdAt: string;
+}
+interface HubTokensListResponse {
+  tokens: HubCapabilityToken[];
+}
+interface HubTokenRevokeResponse {
+  tokenId: string;
+  status: HubCapabilityToken["status"];
+}
+type HubPolicyDecision = "allow" | "ask" | "deny";
+interface HubPolicyUpdateRequest {
+  connectionId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+}
+interface HubPolicyDeleteRequest {
+  connectionId: string;
+  actionPath: string;
+}
+interface HubPolicyDeleteResponse {
+  connectionId: string;
+  actionPath: string;
+  /** Whether a stored override existed and was removed (false = already default). */
+  deleted: boolean;
+}
+interface HubPolicy {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
   createdAt: string;
   updatedAt: string;
-  lastUsedAt: string | null;
 }
-interface HubConnectionsResponse {
-  connections: HubConnection[];
+interface HubPolicyResponse {
+  policy: HubPolicy;
+}
+interface HubPolicyListResponse {
+  policies: HubPolicy[];
+}
+interface HubAllowWritesResponse {
+  connectionId: string;
+  providerId: string;
+  /** Write actions the connection's provider exposes. */
+  writeActions: number;
+  /** Rows newly created (excludes actions that already had a policy). */
+  granted: number;
+  actionPaths: string[];
+}
+interface HubRevertWritesResponse {
+  connectionId: string;
+  /** `allow_writes` rows deleted. */
+  reverted: number;
+}
+type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
+interface HubApproval {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  inputHash: string;
+  requesterPrincipal: Record<string, unknown>;
+  status: HubApprovalStatus;
+  requestedAt: string;
+  expiresAt: string;
+  resolvedAt: string | null;
+}
+interface HubApprovalCapabilityToken {
+  tokenId: string;
+  token: string;
+  expiresAt: string;
+}
+interface HubApprovalDecisionResponse {
+  approval: HubApproval;
+  capabilityToken?: HubApprovalCapabilityToken;
+}
+interface HubApprovalListResponse {
+  approvals: HubApproval[];
 }
+//#endregion
+//#region src/channel-types.d.ts
 interface HubEmailChannel {
   id: string;
   kind: "email";
@@ -167,6 +796,24 @@ interface HubEventDelivery {
   providerEvent: HubProviderEvent;
   firedAt: string;
 }
+//#endregion
+//#region src/connection-types.d.ts
+interface HubConnection {
+  id: string;
+  providerId: string;
+  displayName: string;
+  accountDisplay: string | null;
+  providerAccountId: string | null;
+  scopes: string[];
+  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
+  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+}
+interface HubConnectionsResponse {
+  connections: HubConnection[];
+}
 /** A connector's auth model. */
 type HubProviderAuthKind = "oauth2" | "api_key" | "none" | "custom";
 /** One non-secret value needed before an OAuth redirect can be built. Tenant-
@@ -218,25 +865,6 @@ interface HubProvidersResponse {
   /** Count of substrate-bundled connector manifests behind this catalog. */
   substrateBundled: number;
 }
-interface HubOAuthStartRequest {
-  provider: string;
-  returnUrl?: string;
-  cli?: boolean;
-  connectionParameters?: Record<string, string>;
-}
-interface HubOAuthCallbackSuccessQuery {
-  provider: string;
-  code: string;
-  state: string;
-  error?: undefined;
-}
-interface HubOAuthCallbackErrorQuery {
-  provider: string;
-  error: string;
-  state: string;
-  code?: undefined;
-}
-type HubOAuthCallbackQuery = HubOAuthCallbackSuccessQuery | HubOAuthCallbackErrorQuery;
 interface HubOAuthStartResponse {
   provider: string;
   redirectUrl: string;
@@ -253,6 +881,9 @@ interface HubWhatsappEmbeddedSignupStartResponse {
   appId: string;
   configId: string;
   sdkVersion: string;
+  /** Embedded Signup flow the login configuration selects. "v4" takes empty
+   *  extras; "v2" needs featureType and sessionInfoVersion. Absent means "v2". */
+  signupVersion?: "v2" | "v4";
   state: string;
   expiresAt: string;
   scopes: string[];
@@ -271,34 +902,33 @@ interface HubWhatsappEmbeddedSignupCompleteResponse {
   reconnected: boolean;
   connection: HubConnection | null;
 }
-interface HubOAuthCallbackResponse {
-  connectionId: string;
-  provider: string;
-  cli: boolean;
-  reconnected: boolean;
-}
 /** Connect a non-OAuth (api-key) connector by submitting the user's key. The
  *  server validates the key with a live probe before persisting; `provider` is
  *  carried in the path, `apiKey` in the body. */
 interface HubApiKeyConnectRequest {
   provider: string;
   apiKey: string;
+  /** Connector-owned setup values. Hub validates them before testing the key. */
+  metadata?: HubApiKeyConnectionMetadata;
 }
+type HubApiKeyConnectionMetadata = {
+  propertyId: string;
+  currency?: string;
+} | {
+  listings: Array<{
+    id: string;
+    pms: string;
+  }>;
+};
 /** Result of an api-key connect: the created (or reconnected) connection.
  *  Synchronous — there is no redirect leg, unlike the OAuth flow. */
 interface HubApiKeyConnectResponse {
   connection: HubConnection;
   reconnected: boolean;
 }
-interface HubConnectionDeleteRequest {
-  connectionId: string;
-}
 interface HubConnectionDeleteResponse {
   connection: HubConnection;
 }
-interface HubConnectionHealthRequest {
-  connectionId: string;
-}
 type HubConnectionHealthStatus = "healthy" | "reconnect_required" | "unhealthy" | "rate_limited" | "unsupported";
 interface HubConnectionHealthError {
   code: string;
@@ -313,193 +943,8 @@ interface HubConnectionHealthResponse {
   connection: HubConnection;
   health: HubConnectionHealthInfo;
 }
-interface HubToolSource {
-  sourceId: string;
-  providerId: string;
-  displayName: string;
-  toolCount: number;
-  connectionStatus: "connected" | "missing" | "unknown";
-  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
-  configured: boolean;
-}
-/** Per-tool catalog risk class. The first three mirror the platform's
- *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
- *  classify (substrate connectors). */
-type HubToolRisk = "read" | "write" | "destructive" | "unknown";
-interface HubTool {
-  path: string;
-  providerId?: string;
-  title?: string;
-  description?: string;
-  inputSchema?: unknown;
-  outputSchema?: unknown;
-  connectionRequired?: boolean;
-  connectionStatus?: "connected" | "missing" | "unknown";
-  requiredConnectionProviderId?: string;
-  policyState?: "allow" | "ask" | "deny" | "unknown";
-  risk?: HubToolRisk;
-}
-interface HubToolSourcesResponse {
-  sources: HubToolSource[];
-}
-interface HubToolsSearchRequest {
-  query: string;
-  provider?: string;
-}
-interface HubToolsSearchResponse {
-  tools: HubTool[];
-}
-interface HubToolsDescribeRequest {
-  path: string;
-}
-interface HubToolsDescribeResponse {
-  tool: HubTool;
-}
-interface HubExecRequest {
-  path: string;
-  input?: unknown;
-  connectionId?: string;
-  /** Caller-minted key for this exec. The platform ledger replays the first
-   *  call's result for a retry that carries the same key, and rejects a key
-   *  reused for a different request. On the capability-token arm the key only
-   *  reaches the connector for provider-native dedupe: that arm is at-most-once
-   *  per token and replays no stored result. */
-  idempotencyKey?: string;
-}
-interface HubExecResponse<TResult = unknown> {
-  result: TResult;
-  /** True when the result was replayed from a previous call with the same
-   *  idempotency key, so the action did not run again. */
-  replayed?: boolean;
-}
-interface HubTokenMintRequest {
-  connectionId?: string;
-  provider?: string;
-  actionPath: string;
-  ttlSeconds?: number;
-}
-interface HubTokenMintResponse {
-  token: string;
-  tokenId: string;
-  expiresAt: string;
-}
-interface HubCapabilityToken {
-  id: string;
-  providerId: string;
-  connectionId: string;
-  connectionDisplay: string | null;
-  actionPath: string;
-  expiresAt: string;
-  status: "active" | "consumed" | "expired" | "revoked";
-  principalKind: HubPrincipalKind;
-  createdAt: string;
-}
-interface HubTokensListResponse {
-  tokens: HubCapabilityToken[];
-}
-interface HubTokenRevokeResponse {
-  tokenId: string;
-  status: HubCapabilityToken["status"];
-}
-type HubPolicyDecision = "allow" | "ask" | "deny";
-interface HubPolicyUpdateRequest {
-  connectionId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-}
-interface HubPolicyListRequest {
-  connectionId: string;
-}
-interface HubPolicyDeleteRequest {
-  connectionId: string;
-  actionPath: string;
-}
-interface HubPolicyDeleteResponse {
-  connectionId: string;
-  actionPath: string;
-  /** Whether a stored override existed and was removed (false = already default). */
-  deleted: boolean;
-}
-interface HubPolicy {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-  createdAt: string;
-  updatedAt: string;
-}
-interface HubPolicyResponse {
-  policy: HubPolicy;
-}
-interface HubPolicyListResponse {
-  policies: HubPolicy[];
-}
-interface HubAllowWritesResponse {
-  connectionId: string;
-  providerId: string;
-  /** Write actions the connection's provider exposes. */
-  writeActions: number;
-  /** Rows newly created (excludes actions that already had a policy). */
-  granted: number;
-  actionPaths: string[];
-}
-interface HubRevertWritesResponse {
-  connectionId: string;
-  /** `allow_writes` rows deleted. */
-  reverted: number;
-}
-type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
-interface HubApproval {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  inputHash: string;
-  requesterPrincipal: Record<string, unknown>;
-  status: HubApprovalStatus;
-  requestedAt: string;
-  expiresAt: string;
-  resolvedAt: string | null;
-}
-interface HubApprovalCapabilityToken {
-  tokenId: string;
-  token: string;
-  expiresAt: string;
-}
-interface HubApprovalDecisionResponse {
-  approval: HubApproval;
-  capabilityToken?: HubApprovalCapabilityToken;
-}
-interface HubApprovalListResponse {
-  approvals: HubApproval[];
-}
-interface HubAuditEvent {
-  id: string;
-  action: string;
-  targetUserId: string | null;
-  targetKeyId: string | null;
-  metadata: unknown;
-  createdAt: string;
-}
-interface HubAuditListRequest {
-  provider?: string;
-  action?: string;
-  status?: string;
-  since?: string;
-  until?: string;
-  cursor?: string;
-  limit?: number;
-}
-interface HubAuditResponse {
-  events: HubAuditEvent[];
-  nextCursor: string | null;
-}
-interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
-  error: HubErrorEnvelope["error"] & {
-    code: "HUB_NOT_IMPLEMENTED";
-  };
-}
+//#endregion
+//#region src/github-app-types.d.ts
 interface HubGithubAppMintInstallationTokenRequest {
   /** HTTPS or SSH GitHub URL — alternative to installationId. */
   repoUrl?: string;
@@ -528,7 +973,7 @@ interface HubGithubAppInstallation {
   accountType: string | null;
   /** "all" ⇒ every repo under the account; "selected" ⇒ only repoFullNames. */
   repositorySelection: "all" | "selected";
-  /** Lowercased "owner/repo" — empty when repositorySelection = "all". */
+  /** Metadata omits names; use githubApp.listRepos(id) for a live caller-safe list. */
   repoFullNames: string[];
   suspended: boolean;
 }
@@ -581,43 +1026,55 @@ interface HubGithubAppSyncResponse {
 }
 interface HubGithubAppListReposResponse {
   installationId: number;
-  /** Lowercased "owner/repo" — covers the full registry view of the install. */
+  /** Complete live intersection of App coverage and the caller's GitHub access. */
   repoFullNames: string[];
-}
-interface HubGithubAppIsRepoInstalledRequest {
-  owner: string;
-  repo: string;
+  /** True only when both upstream listings completed; failures return an error. */
+  complete: true;
 }
 interface HubGithubAppIsRepoInstalledResponse {
   installed: boolean;
   installationId: number | null;
 }
-interface HubWorkflowAction {
-  kind: string;
-  config: Record<string, unknown>;
-}
-/** Inbound-event matcher for a `provider_event` trigger. */
-interface HubWorkflowEventFilter {
-  event: string;
-  action?: string;
-  repo?: string;
-}
-interface HubWorkflowTrigger {
+//#endregion
+//#region src/workflow-graph-types.d.ts
+/** How a node's incoming edges release it (default `"all"` — omitted on the
+ *  wire for it, so specs compiled before join rules existed round-trip). */
+type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
+type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+type HubWorkflowConditionScalar = string | number | boolean | null;
+/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
+ *  runner against the steps context on the source node's completion. */
+type HubWorkflowCondition = {
+  path: string;
+  op: HubWorkflowConditionOp;
+  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
+} | {
+  all: HubWorkflowCondition[];
+} | {
+  any: HubWorkflowCondition[];
+} | {
+  not: HubWorkflowCondition;
+};
+interface HubWorkflowGraphNode {
   id: string;
-  kind: "provider_event" | "schedule" | "webhook";
-  enabled: boolean;
-  provider: string | null;
-  connectionId: string | null;
-  eventFilter: HubWorkflowEventFilter | null;
-  cron: string | null;
-  timezone: string | null;
-  nextFireAt: string | null;
-  lastFiredAt: string | null;
+  index: number;
+  join?: HubWorkflowGraphJoinRule;
 }
-interface HubWorkflowValidationError {
-  path: string;
-  message: string;
+interface HubWorkflowGraphEdge {
+  from: string;
+  to: string;
+  /** Guard the runner evaluates on the source's completion; unguarded edges
+   *  carry no `when`. */
+  when?: HubWorkflowCondition;
+}
+/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
+interface HubWorkflowGraphSpec {
+  nodes: HubWorkflowGraphNode[];
+  edges: HubWorkflowGraphEdge[];
+  maxNodeVisits: number;
 }
+//#endregion
+//#region src/workflow-run-types.d.ts
 type HubWorkflowRunStatus = "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled";
 /** One agent iteration of an `agent.run`, as the single-run detail carries it
  *  (JSON-clean ISO timestamps) — including the round's own output `text`. */
@@ -831,6 +1288,8 @@ interface HubWorkflowRunSummary {
   error: string | null;
   createdAt: string;
   completedAt: string | null;
+  /** Execution start; null while queued, absent from older responses. */
+  startedAt?: string | null;
 }
 /** One page of run history; `nextCursor` is null on the last page. */
 interface HubWorkflowRunsPage {
@@ -866,6 +1325,160 @@ interface HubWorkflowFleetInsights {
   windowStart: string;
   workflows: HubWorkflowFleetEntry[];
 }
+/** One journal completion on the wire: the node that completed and the guard
+ *  verdict evaluated for each of its guarded outgoing edges, keyed by edgeKey
+ *  (`"from->to"`). Only GUARDED edges ever appear. */
+interface HubWorkflowEdgeVerdicts {
+  nodeId: string;
+  verdicts: Record<string, boolean>;
+}
+/** How an action's `onError` policy handled a failure so the run continued
+ *  (the action itself still reads `failed`). */
+interface HubWorkflowOnErrorOutcome {
+  policy: "continue" | "fallback";
+  /** The recovery leaf's result when the policy ran a `{ do }` fallback. */
+  fallback?: {
+    kind: string;
+    status: "succeeded" | "failed";
+    output?: unknown;
+    error?: string;
+    costUsd?: number;
+  };
+}
+/** One node's aggregate across the analyzed runs. */
+interface HubWorkflowNodeHealth {
+  /** The author's graph node id, or `step-N` for a linear run's nodes (and for
+   *  a node whose run cannot be mapped back to a definition). */
+  nodeId: string;
+  visits: number;
+  failures: number;
+  /** Null when no visit carried a cost row (never a fabricated 0). */
+  totalCostUsd: number | null;
+  /** Null when no visit recorded duration spans. */
+  avgDurationMs: number | null;
+}
+/** Failures grouped by a normalized error signature (ids/numbers/whitespace
+ *  stripped), most frequent first (top 5). */
+interface HubWorkflowFailureCluster {
+  signature: string;
+  count: number;
+  sampleRunIds: string[];
+}
+/** An agent.run node whose outputs are near-static across runs — a
+ *  CANDIDATE for distillation, reported with its measurements, never a
+ *  verdict. */
+interface HubWorkflowDistillationCandidate {
+  nodeId: string;
+  matchRatio: number;
+  samples: number;
+  avgCostUsd: number | null;
+}
+interface HubWorkflowHealth {
+  /** The requested window (the `runs` parameter). */
+  runsWindow: number;
+  /** Terminal runs that actually went into the stats. */
+  runsAnalyzed: number;
+  nodes: HubWorkflowNodeHealth[];
+  failureClusters: HubWorkflowFailureCluster[];
+  distillationCandidates: HubWorkflowDistillationCandidate[];
+}
+type HubWorkflowDecisionStatus = "pending" | "resolved" | "expired" | "cancelled";
+type HubWorkflowDecisionOnTimeout = "wait" | "fail" | "default";
+/** How the answer arrived: a UI click, a provider-channel event (e.g. a Slack
+ *  reaction), or the timeout policy. */
+type HubWorkflowDecisionResolvedVia = "in_app" | "channel" | "system";
+interface HubWorkflowDecision {
+  id: string;
+  runId: string;
+  workflowId: string;
+  actionIndex: number;
+  title: string;
+  prompt: string | null;
+  options: string[];
+  status: HubWorkflowDecisionStatus;
+  onTimeout: HubWorkflowDecisionOnTimeout;
+  defaultChoice: string | null;
+  choice: string | null;
+  note: string | null;
+  timedOut: boolean;
+  requestedAt: string;
+  expiresAt: string | null;
+  resolvedAt: string | null;
+  /** Null while pending, and on a row settled without an answer (expired /
+   *  cancelled). */
+  resolvedVia: HubWorkflowDecisionResolvedVia | null;
+  /** `channel` answers only: the provider whose event carried the answer and
+   *  the raw external actor id it came from. */
+  resolvedViaProvider: string | null;
+  resolvedByExternalActor: string | null;
+}
+/** A pending decision on the cross-workflow list, named by its workflow
+ *  (null when the workflow was deleted while the run was parked). */
+interface HubWorkflowPendingDecision extends HubWorkflowDecision {
+  workflowName: string | null;
+}
+interface HubWorkflowPendingDecisionsResponse {
+  decisions: HubWorkflowPendingDecision[];
+}
+/** Result of resolving a decision. `resumed` is false when the resolution
+ *  stuck but the run could not be resumed (already terminal/cancelled). */
+interface HubWorkflowDecisionResolveResult {
+  runId: string;
+  decisionId: string;
+  choice: string;
+  resumed: boolean;
+}
+/** One step of an agent round's execution timeline (reasoning, or a tool call
+ *  with args + result), as the step-page endpoint serves it. */
+type HubWorkflowAgentStep = {
+  kind: "reasoning";
+  text: string;
+} | {
+  kind: "tool"; /** Tool name, e.g. "read", "bash". */
+  tool: string;
+  status: "pending" | "running" | "completed" | "error"; /** Arguments the tool was called with (pretty JSON). */
+  input?: string; /** Result the tool returned on success (pretty JSON / text). */
+  output?: string; /** Error message when the tool failed. */
+  error?: string;
+};
+/** One page of a round's step archive. `nextCursor` is the last `stepIndex`
+ *  held — pass it as `after` for the next page; null on the last page. */
+interface HubWorkflowRunStepsPage {
+  steps: HubWorkflowAgentStep[];
+  nextCursor: number | null;
+}
+//#endregion
+//#region src/workflow-definition-types.d.ts
+interface HubWorkflowAction {
+  kind: string;
+  config: Record<string, unknown>;
+}
+/** Inbound-event matcher for a `provider_event` trigger. */
+interface HubWorkflowEventFilter {
+  event: string;
+  action?: string;
+  repo?: string;
+}
+interface HubWorkflowTrigger {
+  id: string;
+  kind: "provider_event" | "schedule" | "webhook";
+  enabled: boolean;
+  provider: string | null;
+  connectionId: string | null;
+  eventFilter: HubWorkflowEventFilter | null;
+  cron: string | null;
+  timezone: string | null;
+  nextFireAt: string | null;
+  lastFiredAt: string | null;
+  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
+  until: string | null;
+}
+interface HubWorkflowValidationError {
+  path: string;
+  message: string;
+  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
+  code?: string;
+}
 interface HubWorkflow {
   id: string;
   name: string;
@@ -890,87 +1503,31 @@ interface HubWorkflow {
   graph?: HubWorkflowGraphSpec | null;
   /** Create response only, when the definition has a webhook trigger: the
    *  hook delivery URL, plus the plaintext bearer token exactly once at mint
-   *  (absent when an active token already exists — rotate to re-reveal). */
-  hook?: HubWorkflowHookEndpoint;
-  /** Present on the list response (latest run, or null if never run); omitted on detail. */
-  lastRun?: HubWorkflowRunSummary | null;
-  createdAt: string;
-  updatedAt: string;
-}
-/** A trigger field a manual "Run now" must supply (derived from the
- *  definition's `${trigger.*}` references). `required` is false only when every
- *  read is wrapped in a `default(...)`. */
-interface HubManualRunInput {
-  path: string;
-  required: boolean;
-}
-type HubWorkflowValidateResponse = {
-  valid: true;
-  name: string;
-  actionCount: number;
-  triggerCount: number;
-} | {
-  valid: false;
-  errors: HubWorkflowValidationError[];
-};
-/** JSON Schema for the YAML workflow definition. */
-type HubWorkflowSchemaResponse = Record<string, unknown>;
-/** How a node's incoming edges release it (default `"all"` — omitted on the
- *  wire for it, so specs compiled before join rules existed round-trip). */
-type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
-type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
-type HubWorkflowConditionScalar = string | number | boolean | null;
-/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
- *  runner against the steps context on the source node's completion. */
-type HubWorkflowCondition = {
-  path: string;
-  op: HubWorkflowConditionOp;
-  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
-} | {
-  all: HubWorkflowCondition[];
-} | {
-  any: HubWorkflowCondition[];
-} | {
-  not: HubWorkflowCondition;
-};
-interface HubWorkflowGraphNode {
-  id: string;
-  index: number;
-  join?: HubWorkflowGraphJoinRule;
-}
-interface HubWorkflowGraphEdge {
-  from: string;
-  to: string;
-  /** Guard the runner evaluates on the source's completion; unguarded edges
-   *  carry no `when`. */
-  when?: HubWorkflowCondition;
-}
-/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
-interface HubWorkflowGraphSpec {
-  nodes: HubWorkflowGraphNode[];
-  edges: HubWorkflowGraphEdge[];
-  maxNodeVisits: number;
-}
-/** One journal completion on the wire: the node that completed and the guard
- *  verdict evaluated for each of its guarded outgoing edges, keyed by edgeKey
- *  (`"from->to"`). Only GUARDED edges ever appear. */
-interface HubWorkflowEdgeVerdicts {
-  nodeId: string;
-  verdicts: Record<string, boolean>;
-}
-/** How an action's `onError` policy handled a failure so the run continued
- *  (the action itself still reads `failed`). */
-interface HubWorkflowOnErrorOutcome {
-  policy: "continue" | "fallback";
-  /** The recovery leaf's result when the policy ran a `{ do }` fallback. */
-  fallback?: {
-    kind: string;
-    status: "succeeded" | "failed";
-    output?: unknown;
-    error?: string;
-    costUsd?: number;
-  };
+   *  (absent when an active token already exists — rotate to re-reveal). */
+  hook?: HubWorkflowHookEndpoint;
+  /** Present on the list response (latest run, or null if never run); omitted on detail. */
+  lastRun?: HubWorkflowRunSummary | null;
+  createdAt: string;
+  updatedAt: string;
+}
+/** A trigger field a manual "Run now" must supply (derived from the
+ *  definition's `${trigger.*}` references). `required` is false only when every
+ *  read is wrapped in a `default(...)`. */
+interface HubManualRunInput {
+  path: string;
+  required: boolean;
 }
+type HubWorkflowValidateResponse = {
+  valid: true;
+  name: string;
+  actionCount: number;
+  triggerCount: number;
+} | {
+  valid: false;
+  errors: HubWorkflowValidationError[];
+};
+/** JSON Schema for the YAML workflow definition. */
+type HubWorkflowSchemaResponse = Record<string, unknown>;
 type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
 /** Lifecycle state of a revision. The head rev only ever points at an
  *  `applied` revision; `proposed` is a service-token-authored suggestion
@@ -997,51 +1554,75 @@ interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
 interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
   evidence: unknown;
 }
-/** Input to {@link HubWorkflowsClient.propose}. Service-token callers only. */
-interface HubWorkflowProposalInput {
-  yaml: string;
-  note?: string;
-  /** Proposer-supplied justification (any JSON value) — carried verbatim onto
-   *  the revision and shown on the approval surface. */
-  evidence?: unknown;
-}
-/** One node's aggregate across the analyzed runs. */
-interface HubWorkflowNodeHealth {
-  /** The author's graph node id, or `step-N` for a linear run's nodes (and for
-   *  a node whose run cannot be mapped back to a definition). */
-  nodeId: string;
-  visits: number;
-  failures: number;
-  /** Null when no visit carried a cost row (never a fabricated 0). */
-  totalCostUsd: number | null;
-  /** Null when no visit recorded duration spans. */
-  avgDurationMs: number | null;
+type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
+/** One author-time literal a gallery starter needs the user to supply. Every
+ *  declared parameter is required; `example` is a valid value that seeds the
+ *  form placeholder. */
+interface HubWorkflowTemplateParameter {
+  key: string;
+  label: string;
+  type: "string" | "integer";
+  help?: string;
+  example: string;
+  default?: string;
+  defaultFrom?: "native_evaluation";
+  required?: boolean;
+  advanced?: boolean;
 }
-/** Failures grouped by a normalized error signature (ids/numbers/whitespace
- *  stripped), most frequent first (top 5). */
-interface HubWorkflowFailureCluster {
-  signature: string;
-  count: number;
-  sampleRunIds: string[];
+interface HubWorkflowTemplate {
+  id: string;
+  name: string;
+  summary: string;
+  category: HubWorkflowTemplateCategory;
+  icon: string;
+  requiresSandbox: boolean;
+  /** Providers the template references (a "uses GitHub" hint), sorted. */
+  providers: string[];
+  parameters: HubWorkflowTemplateParameter[];
+  /** The template with parameter tokens rendered to their example values. */
+  previewYaml: string;
+  setupNotes?: string[];
 }
-/** An agent.run node whose outputs are near-static across runs — a
- *  CANDIDATE for distillation, reported with its measurements, never a
- *  verdict. */
-interface HubWorkflowDistillationCandidate {
-  nodeId: string;
-  matchRatio: number;
-  samples: number;
-  avgCostUsd: number | null;
+/** A connection a definition needs, with where to connect it. */
+interface HubWorkflowConnectionRequirement {
+  provider: string;
+  connected: boolean;
+  kind: "integration" | "github_app";
+  /** Where to satisfy the requirement (App install flow for `github_app`,
+   *  integrations page otherwise); null when no target exists. */
+  connectUrl: string | null;
+  /** Another requirement in the same list that must be satisfied first — a
+   *  `github_app` install is claimed through the `github` connection, so it is
+   *  refused while that connection is missing. Null when nothing blocks this
+   *  requirement. The list is ordered prerequisite-first. */
+  prerequisite: {
+    provider: string;
+    kind: "integration" | "github_app";
+  } | null;
 }
-interface HubWorkflowHealth {
-  /** The requested window (the `runs` parameter). */
-  runsWindow: number;
-  /** Terminal runs that actually went into the stats. */
-  runsAnalyzed: number;
-  nodes: HubWorkflowNodeHealth[];
-  failureClusters: HubWorkflowFailureCluster[];
-  distillationCandidates: HubWorkflowDistillationCandidate[];
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+declare function workflowConnectionRequirementKey(ref: Readonly<Pick<HubWorkflowConnectionRequirement, "provider" | "kind">>): string;
+/**
+ * Result of instantiating a template. `created: false` is NOT an error — an
+ * actionable continuation listing the connections to satisfy before retrying
+ * the same call. Invalid parameters or a compile failure throw `HubSdkError`
+ * (400) instead, matching the create route's contract.
+ */
+type HubWorkflowTemplateInstantiateResult = {
+  created: true;
+  workflow: HubWorkflow;
+} | {
+  created: false;
+  connectionRequirements: HubWorkflowConnectionRequirement[];
+};
+/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
+ *  revealed only at mint/rotate time (only the hash is stored). */
+interface HubWorkflowHookEndpoint {
+  url: string;
+  token?: string;
 }
+//#endregion
+//#region src/workflow-storage-types.d.ts
 /** One KV entry with its metadata — the get/put/cas response shape. */
 interface HubWorkflowKvEntry {
   key: string;
@@ -1093,137 +1674,347 @@ interface HubWorkflowArtifactDownload {
   bytes: Uint8Array;
   contentType: string;
 }
-type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
-/** One author-time literal a gallery starter needs the user to supply. Every
- *  declared parameter is required; `example` is a valid value that seeds the
- *  form placeholder. */
-interface HubWorkflowTemplateParameter {
-  key: string;
-  label: string;
-  type: "string" | "integer";
-  help?: string;
-  example: string;
-}
-interface HubWorkflowTemplate {
+//#endregion
+//#region src/lines.d.ts
+interface HubLineMember {
   id: string;
-  name: string;
-  summary: string;
-  category: HubWorkflowTemplateCategory;
-  icon: string;
-  requiresSandbox: boolean;
-  /** Providers the template references (a "uses GitHub" hint), sorted. */
-  providers: string[];
-  parameters: HubWorkflowTemplateParameter[];
-  /** The template with parameter tokens rendered to their example values. */
-  previewYaml: string;
+  label: string | null;
+  role: string;
+  self?: boolean;
+  consent?: "enabled" | "required";
 }
-/** A connection a definition needs, with where to connect it. */
-interface HubWorkflowConnectionRequirement {
-  provider: string;
-  connected: boolean;
-  kind: "integration" | "github_app";
-  /** Where to satisfy the requirement (App install flow for `github_app`,
-   *  integrations page otherwise); null when no target exists. */
-  connectUrl: string | null;
-  /** Another requirement in the same list that must be satisfied first — a
-   *  `github_app` install is claimed through the `github` connection, so it is
-   *  refused while that connection is missing. Null when nothing blocks this
-   *  requirement. The list is ordered prerequisite-first. */
-  prerequisite: {
-    provider: string;
-    kind: "integration" | "github_app";
+interface HubLineContext {
+  self: {
+    id: string;
+    label: string | null;
+    role: string;
+  };
+  line: {
+    id: string;
+    label: string | null;
+    transport: string;
+  };
+  members: HubLineMember[];
+  capabilities: Record<string, {
+    allowed: boolean;
+    reason?: string;
+  }>;
+  pendingReminders: Array<{
+    messageId: string;
+    wakeAt?: string;
+    prompt: string | null;
+  }>;
+  quotas: {
+    selfMessagesToday: number;
+    selfMessagesPerDay: number;
+    selfMessagesPending: number;
+    selfMessagesPendingLimit: number;
+  };
+}
+interface HubLineSendInput {
+  toMember: string;
+  text: string;
+  notBefore?: string;
+  onBehalfOf?: string;
+  idempotencyKey?: string;
+}
+/** An asset URL safe to share with the recipient and provider. Hub never fetches it.
+ * Meta WhatsApp API-key lines send it with `text` as the caption. Other transports refuse it.
+ * Use public HTTPS without a query, fragment or credentials. */
+interface HubLineImage {
+  url: string;
+}
+interface HubLineOwnerSendInput {
+  memberId: string;
+  text: string;
+  image?: HubLineImage;
+  notBefore?: string;
+  idempotencyKey: string;
+  /** Ask a coded question; the member's reply that starts with `code` returns here. */
+  reply?: HubLineReplyCodeInput;
+}
+interface HubLineReplyCodeInput {
+  /** A letter, then up to seven letters or digits, with at least one digit (`F7`). Hub compares it case-insensitively. */
+  code: string;
+  /** 60 to 604800; the window opens when the send first becomes eligible. */
+  ttlSeconds: number;
+  /**
+   * 1 to 20 distinct texted choices, each 1-32 of `a-z 0-9 _ -` after lower-casing.
+   * An answer must then be `<code> <option>[ <note>]`; any other coded text keeps the question open.
+   */
+  options?: string[];
+}
+/** The coded question's state on an owner send receipt. */
+interface HubLineReplyCode {
+  /** Upper case. */
+  code: string;
+  expiresAt: string;
+  /** Authoritative closure fence; absent on older Hub, never infer it from local time. */
+  closed?: boolean;
+  /** The first coded answer; `text` is null after content retention ends. */
+  answer: {
+    messageId: string;
+    text: string | null;
+    receivedAt: string; /** The named option, lower case; null when the send listed no options. */
+    option: string | null; /** Words after the option; null when there were none or retention ended. */
+    note: string | null;
   } | null;
 }
-/**
- * Result of instantiating a template. `created: false` is NOT an error — an
- * actionable continuation listing the connections to satisfy before retrying
- * the same call. Invalid parameters or a compile failure throw `HubSdkError`
- * (400) instead, matching the create route's contract.
- */
-type HubWorkflowTemplateInstantiateResult = {
-  created: true;
-  workflow: HubWorkflow;
-} | {
-  created: false;
-  connectionRequirements: HubWorkflowConnectionRequirement[];
-};
-type HubWorkflowDecisionStatus = "pending" | "resolved" | "expired" | "cancelled";
-type HubWorkflowDecisionOnTimeout = "wait" | "fail" | "default";
-/** How the answer arrived: a UI click, a provider-channel event (e.g. a Slack
- *  reaction), or the timeout policy. */
-type HubWorkflowDecisionResolvedVia = "in_app" | "channel" | "system";
-interface HubWorkflowDecision {
+interface HubLineReminderInput {
+  text: string;
+  notBefore: string;
+  idempotencyKey: string;
+}
+interface HubLineApplicationDispatchCurrentInput {
+  attachmentId: string;
+  memberId: string;
+  memberRevision: string;
+  senderAddress: string;
+  textSha256: string;
+  binding: string;
+  dispatchFence: string;
+  dispatchDeadline: string;
+}
+interface HubLineMemberApplication {
   id: string;
-  runId: string;
-  workflowId: string;
-  actionIndex: number;
-  title: string;
-  prompt: string | null;
-  options: string[];
-  status: HubWorkflowDecisionStatus;
-  onTimeout: HubWorkflowDecisionOnTimeout;
-  defaultChoice: string | null;
-  choice: string | null;
-  note: string | null;
-  timedOut: boolean;
-  requestedAt: string;
-  expiresAt: string | null;
-  resolvedAt: string | null;
-  /** Null while pending, and on a row settled without an answer (expired /
-   *  cancelled). */
-  resolvedVia: HubWorkflowDecisionResolvedVia | null;
-  /** `channel` answers only: the provider whose event carried the answer and
-   *  the raw external actor id it came from. */
-  resolvedViaProvider: string | null;
-  resolvedByExternalActor: string | null;
-}
-/** A pending decision on the cross-workflow list, named by its workflow
- *  (null when the workflow was deleted while the run was parked). */
-interface HubWorkflowPendingDecision extends HubWorkflowDecision {
-  workflowName: string | null;
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  status: "active" | "revoked";
+  application: {
+    url: string;
+    binding: string;
+  };
+  /** Hub's name for the app at this callback; present on reads. */
+  app?: {
+    name: string;
+  };
+  createdAt: string;
+  revokedAt: string | null;
+}
+interface HubLineMemberApplicationInput {
+  expectedSelectionId: string | null;
+  expectedMemberRevision: string;
+  subjectId: string;
+  application: {
+    url: string;
+    binding: string;
+    secret: string;
+  };
 }
-interface HubWorkflowPendingDecisionsResponse {
-  decisions: HubWorkflowPendingDecision[];
+interface HubLineProviderDelivery {
+  provider: "meta_whatsapp";
+  messageId: string;
+  acceptedAt: string;
+  sentAt: string | null;
+  deliveredAt: string | null;
+  readAt: string | null;
+  failedAt: string | null;
+  failureCode: number | null;
+}
+interface HubLineSendReceipt {
+  /** Absent on older Hub. Replied/accepted never implies delivered. */
+  delivery?: HubLineProviderDelivery | null;
+  message: {
+    id: string;
+    status: string;
+    text: string | null;
+    image?: HubLineImage;
+  };
+  eligibleAt: string | null;
+  expiresAt: string;
+  /** Null when the send asked no coded question; absent from Hub before reply codes. */
+  reply?: HubLineReplyCode | null;
+}
+interface HubLineReminderReceipt {
+  state: "queued" | "skipped";
+  lineId: string;
+  messageId?: string;
+  sessionId?: string;
+  completion?: string;
+  reason?: string;
+}
+interface HubLineScheduledSendOptions {
+  lineId: string;
+  memberId: string;
+  text: string;
+  timezone: string;
+  name?: string;
+  notBefore?: string;
+  /**
+   * RFC 3339 instant the schedule stops at. Required when the calling key
+   * expires, and no later than that expiry: a schedule never outlives the
+   * key that wrote it.
+   */
+  until?: string;
 }
-/** Result of resolving a decision. `resumed` is false when the resolution
- *  stuck but the run could not be resumed (already terminal/cancelled). */
-interface HubWorkflowDecisionResolveResult {
-  runId: string;
-  decisionId: string;
-  choice: string;
-  resumed: boolean;
+interface HubLineCheckinOptions {
+  lineId: string;
+  member: string;
+  timezone: string;
+  prompt: string;
+  name?: string;
+  /** RFC 3339 instant the schedule stops at; see {@link HubLineScheduledSendOptions.until}. */
+  until?: string;
 }
-/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
- *  revealed only at mint/rotate time (only the hash is stored). */
-interface HubWorkflowHookEndpoint {
-  url: string;
-  token?: string;
+/** Line calls share HubClient authentication and envelope handling. */
+declare class HubLinesClient {
+  private readonly request;
+  private readonly createWorkflow;
+  private readonly requestApplicationDispatchCurrent?;
+  readonly members: {
+    list: (lineId: string) => Promise<HubLineMember[]>;
+  };
+  readonly memberApplications: {
+    get: (lineId: string, memberId: string) => Promise<{
+      memberRevision: string;
+      selection: HubLineMemberApplication | null;
+    }>;
+    select: (lineId: string, memberId: string, input: HubLineMemberApplicationInput) => Promise<HubLineMemberApplication>;
+    clear: (lineId: string, memberId: string, input: {
+      expectedSelectionId: string;
+      expectedMemberRevision: string;
+    }) => Promise<void>;
+  };
+  readonly checkins: {
+    schedule: (cron: string, options: HubLineCheckinOptions) => Promise<HubWorkflow>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>, createWorkflow: (yaml: string) => Promise<HubWorkflow>, requestApplicationDispatchCurrent?: ((path: string, init: RequestInit, callbackBearer: string) => Promise<{
+    current: boolean;
+  }>) | undefined);
+  scheduleSend(cron: string, options: HubLineScheduledSendOptions): Promise<HubWorkflow>;
+  context(): Promise<HubLineContext>;
+  send(lineId: string, input: HubLineSendInput | HubLineOwnerSendInput): Promise<HubLineSendReceipt>;
+  /** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+  sentMessage(lineId: string, messageId: string): Promise<HubLineSendReceipt>;
+  remind(lineId: string, input: HubLineReminderInput): Promise<HubLineReminderReceipt>;
+  applicationDispatchCurrent(lineId: string, messageId: string, input: HubLineApplicationDispatchCurrentInput, callbackBearer: string): Promise<boolean>;
 }
-interface HubWorkflowHookToken {
-  url: string;
+//#endregion
+//#region src/managed-numbers.d.ts
+interface HubNumberReadiness {
+  configured: boolean;
+  provider: "inkbox";
+  transports: Array<"sms" | "imessage">;
+  billing: "prepaid_activation";
+  automaticRentalBilling: false;
+  deliveryVerified: false;
+}
+interface HubNumberQuote {
+  transport: "sms" | "imessage";
+  activationCents: number;
+  currency: "usd";
+  termsVersion: string;
+  terms: string;
+  expiresAt: number;
+  /** The binding the quote was issued for. Absent from older servers. */
+  clientReference?: string;
+  /** Opaque. Pass it back to `create`; never decode it. */
   token: string;
 }
-/** One step of an agent round's execution timeline (reasoning, or a tool call
- *  with args + result), as the step-page endpoint serves it. */
-type HubWorkflowAgentStep = {
-  kind: "reasoning";
-  text: string;
-} | {
-  kind: "tool"; /** Tool name, e.g. "read", "bash". */
-  tool: string;
-  status: "pending" | "running" | "completed" | "error"; /** Arguments the tool was called with (pretty JSON). */
-  input?: string; /** Result the tool returned on success (pretty JSON / text). */
-  output?: string; /** Error message when the tool failed. */
-  error?: string;
-};
-/** One page of a round's step archive. `nextCursor` is the last `stepIndex`
- *  held — pass it as `after` for the next page; null on the last page. */
-interface HubWorkflowRunStepsPage {
-  steps: HubWorkflowAgentStep[];
-  nextCursor: number | null;
+/** One page of the owner's orders, newest first. */
+interface HubNumberOrderPage {
+  orders: HubNumberOrder[];
+  /** Present while more orders exist. Older servers omit it and return one
+   * bounded page, so an absent cursor never proves an order does not exist. */
+  nextCursor?: string | null;
+}
+interface HubNumberListQuery {
+  /** Only orders requested for this binding, including closed ones. */
+  clientReference?: string;
+  cursor?: string;
+  /** 1 to 100; the server default is 100. */
+  limit?: number;
+}
+/** An operator's terminal decision on an order stuck in `needs_review`.
+ * Read-only for a creator: the resolution is made through the platform's
+ * admin surface, never through this client. */
+interface HubNumberResolution {
+  action: "release" | "settle" | "abandon";
+  operator: string;
+  reason: string;
+  at: number;
+  /** Present while the operator's action is still running. The decision is
+   * not final and the order can still return to review. */
+  pending?: true;
+  /** Present when a `settle` handed a live, unfinished order back to
+   * provisioning, so the order is working again rather than closed. */
+  requeued?: true;
+}
+interface HubNumberOrder {
+  id: string;
+  clientReference: string;
+  transport: "sms" | "imessage";
+  status: "pending" | "provider_pending" | "needs_review" | "ready_for_setup" | "cancelled";
+  phase: "identity" | "number" | "credential" | "connection" | "complete";
+  address: string | null;
+  connectionId: string | null;
+  identityId: string | null;
+  providerNumberId: string | null;
+  billingStatus: "unreserved" | "reserved" | "settled" | "released";
+  cancellation: "none" | "requested" | "needs_review" | "released" | "abandoned";
+  errorCode: string | null;
+  nextAttemptAt: number | null;
+  resolution: HubNumberResolution | null;
+  deliveryVerified: false;
+  activationCents: number;
+  currency: "usd";
+  terms: string;
+}
+/** Administrative number operations through Hub's authenticated transport.
+ * A mutation is one attempt; an uncertain create reuses its quote and reference. */
+declare class HubManagedNumbersClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  readiness(): Promise<HubNumberReadiness>;
+  /** One page of orders. Scope by `clientReference` to ask about one binding,
+   * and follow `nextCursor` for the rest; a page is never ownership evidence. */
+  list(query?: HubNumberListQuery): Promise<HubNumberOrderPage>;
+  get(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  quote(input: {
+    transport: "sms" | "imessage";
+    clientReference: string;
+  }): Promise<{
+    quote: HubNumberQuote;
+  }>;
+  /** `clientReference` and `transport`, when given, must match the signed
+   * quote or Hub refuses the purchase with a conflict. */
+  create(input: {
+    quoteToken: string;
+    consent: true;
+    state?: string;
+    clientReference?: string;
+    transport?: "sms" | "imessage";
+  }): Promise<{
+    order: HubNumberOrder;
+  }>;
+  /** Fences references so no order can take them again. Call it as the last
+   * step before retiring the resource they name: a purchase that races the
+   * retirement is then refused (`409 number_reference_fenced`) instead of
+   * binding a line to a resource that is gone. Refused with
+   * `409 number_reference_held` while a live order holds one of them; cancel
+   * it first. A cancelled order no longer holds its reference, so the fence
+   * succeeds as soon as `cancel` returns, whether or not its release is still
+   * pending. Repeating a fence is harmless. */
+  fence(input: {
+    clientReferences: string[];
+  }): Promise<{
+    clientReferences: string[];
+  }>;
+  advance(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  cancel(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  private path;
+  private post;
 }
 //#endregion
-//#region src/client.d.ts
+//#region src/transport.d.ts
 type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
 interface HubClientOptions {
   baseUrl: string;
@@ -1239,6 +2030,26 @@ declare class HubSdkError extends Error {
     status?: number;
   });
 }
+declare class HubTransport {
+  #private;
+  readonly baseUrl: string;
+  readonly fetch: typeof fetch;
+  readonly authHeaders?: HubAuthHeaders;
+  constructor(options: HubClientOptions);
+  /** The API key this client authenticates with, when it has one. */
+  get apiKey(): string | undefined;
+  protected request<TData>(path: string, init: RequestInit, options?: {
+    auth?: "client" | "caller";
+    validateData?: (data: unknown) => data is TData;
+  }): Promise<TData>;
+  protected buildHeaders(headers: HeadersInit | undefined, callerAuth?: boolean): Promise<Headers>;
+}
+/** Domain clients receive the existing envelope transport as one request function. */
+type HubRequest = <TData>(path: string, init: RequestInit) => Promise<TData>;
+type HubStreamRequest = (path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>;
+type HubArtifactRequest = (path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>;
+//#endregion
+//#region src/environment.d.ts
 declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
 declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
 declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
@@ -1251,53 +2062,14 @@ interface HubClientFromEnvOptions {
 }
 declare function resolveHubBaseUrl(env?: HubEnv): string;
 declare function resolveHubAuth(env?: HubEnv): string;
-declare class HubClient {
-  readonly baseUrl: string;
-  readonly fetch: typeof fetch;
-  readonly apiKey?: string;
-  readonly authHeaders?: HubAuthHeaders;
-  readonly connections: HubConnectionsClient;
-  readonly channels: HubChannelsClient;
-  readonly eventSubscriptions: HubEventSubscriptionsClient;
-  readonly permissions: HubPermissionsClient;
-  readonly tokens: HubTokensClient;
-  readonly tools: HubToolsClient;
-  readonly approvals: HubApprovalsClient;
-  readonly audit: HubAuditClient;
-  readonly githubApp: HubGithubAppClient;
-  readonly workflows: HubWorkflowsClient;
-  constructor(options: HubClientOptions);
-  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
-  status(): Promise<HubStatusResponse>;
-  private request;
-  /**
-   * Open a streaming (Server-Sent Events) response and return its raw body.
-   * Shares auth-header building + `fetch` with {@link request}, but does NOT
-   * buffer or JSON-parse the body — the caller consumes the stream.
-   *
-   * A successful stream comes back as `text/event-stream`. Anything else is an
-   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-   * page); it is surfaced the same way {@link request} surfaces errors — a
-   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-   */
-  private stream;
-  /**
-   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-   * the artifact's own content type, not JSON. Error responses on such routes
-   * are still the standard envelope, so a failure surfaces exactly like
-   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-   * otherwise an `HUB_HTTP_<status>` transport error.
-   */
-  private requestBytes;
-  private buildHeaders;
-}
+//#endregion
+//#region src/authorization.d.ts
 interface HubTokenListOptions {
   includeExpired?: boolean;
 }
 declare class HubTokensClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mint(options: {
     actionPath: string;
     connectionId?: string;
@@ -1309,7 +2081,7 @@ declare class HubTokensClient {
 }
 declare class HubPermissionsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(connectionId: string): Promise<HubPolicyListResponse>;
   set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse>;
   /** Reset an action to its default by deleting any stored override. */
@@ -1322,6 +2094,15 @@ declare class HubPermissionsClient {
    *  connection. Manual per-action decisions are left intact. */
   revertWrites(connectionId: string): Promise<HubRevertWritesResponse>;
 }
+declare class HubApprovalsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubApprovalListResponse>;
+  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+}
+//#endregion
+//#region src/tools.d.ts
 interface HubToolSearchOptions {
   provider?: string;
   /** Max tools to return. The server defaults to a relevance-ranked shortlist
@@ -1345,7 +2126,7 @@ interface HubToolInvokeOptions {
 }
 declare class HubToolsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
   sources(): Promise<HubToolSourcesResponse>;
   describe(path: string): Promise<HubToolsDescribeResponse>;
@@ -1357,28 +2138,71 @@ declare class HubToolsClient {
   invoke<TResult = unknown>(path: string, raw: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
   private buildExecInit;
 }
+//#endregion
+//#region src/inbound-webhooks.d.ts
+/** Provider setup uses the existing authenticated Hub transport and vault. */
+interface HubInboundWebhookCreateOptions {
+  /** Inkbox identity that owns all selected channels. */
+  identityId?: string;
+  mailboxId?: string;
+  phoneNumberId?: string;
+  imessage?: boolean;
+  /** Linq: explicit owned lines; omitted does not mean every account line. */
+  phoneNumbers?: string[];
+  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
+  phoneNumberIds?: string[];
+  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
+  signingSecret?: string;
+}
+interface HubInboundWebhookCreateResponse {
+  url: string;
+  /** True only when the provider subscription was created by the server. */
+  provisioned?: boolean;
+  /** Self-configured legacy providers can return a newly minted secret once. */
+  secret?: string;
+  inboundAddress?: string;
+  requiresProviderSetup?: boolean;
+}
+interface HubInboundWebhookStatus {
+  configured: boolean;
+  url?: string;
+  /** Configuration is not evidence of a real delivered message. */
+  deliveryVerified: false;
+  requiresProviderSetup?: boolean;
+}
+/** Live provider readback for one explicitly selected Linq WhatsApp number. */
+interface HubInboundPhoneNumberScope {
+  configured: true;
+  provisioned: true;
+  subscribed: true;
+  phoneNumberIds: string[];
+}
+declare class HubInboundWebhooksClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
+  get(connectionId: string): Promise<HubInboundWebhookStatus>;
+  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
+  /** Remove event subscriptions first. This does not silently rotate a live URL. */
+  delete(connectionId: string): Promise<{
+    removed: boolean;
+  }>;
+  private path;
+}
+//#endregion
+//#region src/connections.d.ts
 interface HubConnectionStartOptions {
   returnUrl?: string;
   cli?: boolean;
   connectionParameters?: Record<string, string>;
-}
-declare class HubChannelsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubChannelsResponse>;
-  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
-  delete(channelId: string): Promise<HubChannelDeleteResponse>;
-}
-declare class HubEventSubscriptionsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubEventSubscriptionsResponse>;
-  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
-  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
+  /** GitHub accepts the exact read:user, repo, read:org set. */
+  requestedScopes?: readonly string[];
 }
 declare class HubConnectionsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  readonly inboundWebhook: HubInboundWebhooksClient;
+  constructor(request: HubRequest);
   list(): Promise<HubConnectionsResponse>;
   /** Connector catalog: every provider the hub can expose, each flagged with
    *  `configured` (whether its OAuth app credentials are wired). Callers render
@@ -1390,21 +2214,33 @@ declare class HubConnectionsClient {
   /** Connect a non-OAuth (api-key) connector by submitting the user's key.
    *  The server validates the key with a live probe before persisting and
    *  returns the created (or reconnected) connection — there is no redirect,
-   *  unlike `start`. */
-  connectApiKey(provider: string, apiKey: string): Promise<HubApiKeyConnectResponse>;
+   *  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+   *  requires listing ID/PMS pairs; other providers have no metadata. */
+  connectApiKey(provider: string, apiKey: string, metadata?: HubApiKeyConnectRequest["metadata"]): Promise<HubApiKeyConnectResponse>;
   revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
   health(connectionId: string): Promise<HubConnectionHealthResponse>;
 }
-declare class HubApprovalsClient {
+//#endregion
+//#region src/channels.d.ts
+declare class HubChannelsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubApprovalListResponse>;
-  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
-  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  constructor(request: HubRequest);
+  list(): Promise<HubChannelsResponse>;
+  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
+  delete(channelId: string): Promise<HubChannelDeleteResponse>;
+}
+declare class HubEventSubscriptionsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubEventSubscriptionsResponse>;
+  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
+  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
 }
+//#endregion
+//#region src/github-app.d.ts
 declare class HubGithubAppClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mintInstallationToken(input: HubGithubAppMintInstallationTokenRequest): Promise<HubGithubAppMintInstallationTokenResponse>;
   /** Every installation the caller may act through — their own and any org's
    *  they were verified against. The management surface's read. */
@@ -1426,16 +2262,50 @@ declare class HubGithubAppClient {
     repo: string;
   }): Promise<HubGithubAppIsRepoInstalledResponse>;
 }
+//#endregion
+//#region src/audit.d.ts
 declare class HubAuditClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(options?: HubAuditListRequest): Promise<HubAuditResponse>;
 }
-declare class HubWorkflowsClient {
-  private readonly request;
+//#endregion
+//#region src/workflows-kv.d.ts
+/** The workflow's durable keyspace, shared by all its runs. */
+declare class WorkflowKvResource {
+  protected readonly request: HubRequest;
+  constructor(request: HubRequest);
+  /**
+   * The workflow's whole keyspace as metadata (key, version, updatedAt — never
+   * values), key-ordered. Bounded by the server's per-workflow key cap.
+   */
+  listKv(id: string): Promise<HubWorkflowKvListResponse>;
+  /** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
+  getKv(id: string, key: string): Promise<HubWorkflowKvEntry>;
+  /**
+   * Upsert a key; returns the entry with its NEW version (increments on every
+   * write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
+   * or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
+   * value, stored and read back verbatim, so the client never gives it a shape.
+   */
+  putKv(id: string, key: string, raw: unknown): Promise<HubWorkflowKvEntry>;
+  /**
+   * Compare-and-swap: the write lands only when the stored version still
+   * equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
+   * (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
+   * caller's value, stored and read back verbatim, so the client never gives it
+   * a shape.
+   */
+  casKv(id: string, key: string, expectedVersion: number, raw: unknown): Promise<HubWorkflowKvEntry>;
+  /** Delete a key; idempotent — `deleted` reports whether a row was removed. */
+  deleteKv(id: string, key: string): Promise<HubWorkflowKvDeleteResponse>;
+}
+//#endregion
+//#region src/workflows.d.ts
+declare class HubWorkflowsClient extends WorkflowKvResource {
   private readonly stream?;
   private readonly download?;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>, stream?: ((path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>) | undefined, download?: ((path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>) | undefined);
+  constructor(request: HubRequest, stream?: HubStreamRequest | undefined, download?: HubArtifactRequest | undefined);
   list(): Promise<HubWorkflow[]>;
   /**
    * Owner-wide fleet overview: one row per workflow with its run tallies over
@@ -1483,8 +2353,9 @@ declare class HubWorkflowsClient {
    * `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
    * workflow that reads no trigger fields. Throws `HubSdkError`:
    * `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
-   * names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`
-   * for an unknown/foreign id. Pass `opts.signal` to abort a slow request.
+   * names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+   * still runs once; pausing only stops its triggers. Pass `opts.signal` to
+   * abort a slow request.
    */
   run(id: string, inputs?: HubWorkflowRunInputs, opts?: {
     signal?: AbortSignal;
@@ -1519,8 +2390,8 @@ declare class HubWorkflowsClient {
    * follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
    * other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
    * terminal-failed/cancelled (queued/running/waiting, or succeeded),
-   * `WORKFLOW_DISABLED` when the workflow has since been disabled, `NOT_FOUND`
-   * for an unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+   * `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+   * failure still retries. Pass `opts.signal` to abort a slow request.
    */
   retryRun(id: string, runId: string, opts?: {
     signal?: AbortSignal;
@@ -1538,10 +2409,18 @@ declare class HubWorkflowsClient {
    * poll) arrive — the persisted record, read via {@link getRun}, stays the
    * source of truth. Pass `signal` to cancel; iterating to `run.done` (or
    * breaking early) releases the connection.
+   *
+   * A stream that ends before `run.done` or `run.waiting` (the Platform is
+   * restarting or handing over) is reopened after a second, as is one refused
+   * with `SERVICE_DRAINING`; the reopened stream starts with a fresh
+   * `snapshot`. After 30 reopens in a row that deliver nothing it throws
+   * `HubSdkError(WORKFLOW_STREAM_INTERRUPTED)`.
    */
   watchRun(id: string, runId: string, opts?: {
     signal?: AbortSignal;
   }): AsyncGenerator<HubWorkflowRunStreamEvent>;
+  /** One connection's events, then how it ended. */
+  private watchRunOnce;
   /**
    * Poll {@link getRun} until the run reaches a terminal state (`succeeded` or
    * `failed`) and return its detail. The scripting primitive behind "run and
@@ -1592,44 +2471,6 @@ declare class HubWorkflowsClient {
   health(id: string, opts?: {
     runs?: number;
   }): Promise<HubWorkflowHealth>;
-  /**
-   * Propose a definition change — the intelligence path. SERVICE-TOKEN
-   * callers only (user principals get `HubSdkError(SERVICE_TOKEN_REQUIRED)`,
-   * 403). The YAML is compile-validated server-side (`WORKFLOW_INVALID` on
-   * failure) and appended as a `proposed` revision; the head NEVER advances
-   * until an owner approves.
-   */
-  propose(id: string, input: HubWorkflowProposalInput): Promise<HubWorkflowProposal>;
-  /**
-   * Pending (proposed) and declined (rejected) revisions, newest first, with
-   * their evidence — the approval surface's input.
-   */
-  listProposals(id: string): Promise<HubWorkflowProposal[]>;
-  /**
-   * Accept a proposal: its YAML lands as a NEW applied head revision through
-   * the same compile + advance path as {@link rollback} (re-validated against
-   * today's connections/models), and the proposal settles to `applied`.
-   * Throws `HubSdkError`: `PROPOSAL_NOT_PENDING` (409) when the rev is not a
-   * pending proposal, `WORKFLOW_INVALID` when it no longer compiles,
-   * `CONFLICT` on a concurrent modification.
-   */
-  approveProposal(id: string, rev: number): Promise<HubWorkflow>;
-  /**
-   * Decline a proposal: the revision settles to `rejected` (head untouched);
-   * an optional reason is merged into its evidence as `rejectionReason`.
-   * Throws `HubSdkError(PROPOSAL_NOT_PENDING)` (409) when the rev is not a
-   * pending proposal.
-   */
-  rejectProposal(id: string, rev: number, opts?: {
-    reason?: string;
-  }): Promise<HubWorkflowProposal>;
-  /**
-   * Mint a fresh webhook hook token, retiring the current one immediately.
-   * The plaintext token is returned exactly once (only the hash is stored).
-   * Requires an active webhook trigger — otherwise `HubSdkError` with
-   * `NO_WEBHOOK_TRIGGER` (409).
-   */
-  rotateHookToken(id: string): Promise<HubWorkflowHookToken>;
   /**
    * One agent round's execution timeline, paged. `action` is the action's
    * `${steps[N]}` position and `iteration` the round's position in that
@@ -1663,30 +2504,6 @@ declare class HubWorkflowsClient {
    * `downloadUrl` attached to an `$artifact` ref in a run detail points at.
    */
   downloadArtifact(id: string, runId: string, artifactId: string): Promise<HubWorkflowArtifactDownload>;
-  /**
-   * The workflow's whole keyspace as metadata (key, version, updatedAt — never
-   * values), key-ordered. Bounded by the server's per-workflow key cap.
-   */
-  listKv(id: string): Promise<HubWorkflowKvListResponse>;
-  /** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
-  getKv(id: string, key: string): Promise<HubWorkflowKvEntry>;
-  /**
-   * Upsert a key; returns the entry with its NEW version (increments on every
-   * write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
-   * or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
-   * value, stored and read back verbatim, so the client never gives it a shape.
-   */
-  putKv(id: string, key: string, raw: unknown): Promise<HubWorkflowKvEntry>;
-  /**
-   * Compare-and-swap: the write lands only when the stored version still
-   * equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
-   * (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
-   * caller's value, stored and read back verbatim, so the client never gives it
-   * a shape.
-   */
-  casKv(id: string, key: string, expectedVersion: number, raw: unknown): Promise<HubWorkflowKvEntry>;
-  /** Delete a key; idempotent — `deleted` reports whether a row was removed. */
-  deleteKv(id: string, key: string): Promise<HubWorkflowKvDeleteResponse>;
   /** The curated starter gallery runnable on THIS deployment: metadata,
    *  parameters, referenced providers, and a concrete `previewYaml` per card. */
   listTemplates(): Promise<HubWorkflowTemplate[]>;
@@ -1740,6 +2557,48 @@ declare class HubWorkflowsClient {
   schema(): Promise<HubWorkflowSchemaResponse>;
 }
 //#endregion
+//#region src/client.d.ts
+declare class HubClient extends HubTransport {
+  readonly knowledge: HubKnowledgeClient;
+  readonly allowances: HubAllowancesClient;
+  readonly apps: HubAppsClient;
+  readonly connections: HubConnectionsClient;
+  readonly channels: HubChannelsClient;
+  readonly numbers: HubManagedNumbersClient;
+  readonly eventSubscriptions: HubEventSubscriptionsClient;
+  readonly permissions: HubPermissionsClient;
+  readonly tokens: HubTokensClient;
+  readonly tools: HubToolsClient;
+  readonly approvals: HubApprovalsClient;
+  readonly audit: HubAuditClient;
+  readonly githubApp: HubGithubAppClient;
+  readonly workflows: HubWorkflowsClient;
+  readonly lines: HubLinesClient;
+  constructor(options: HubClientOptions);
+  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
+  status(): Promise<HubStatusResponse>;
+  /**
+   * Open a streaming (Server-Sent Events) response and return its raw body.
+   * Shares auth-header building + `fetch` with {@link request}, but does NOT
+   * buffer or JSON-parse the body — the caller consumes the stream.
+   *
+   * A successful stream comes back as `text/event-stream`. Anything else is an
+   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+   * page); it is surfaced the same way {@link request} surfaces errors — a
+   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+   */
+  private stream;
+  /**
+   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+   * the artifact's own content type, not JSON. Error responses on such routes
+   * are still the standard envelope, so a failure surfaces exactly like
+   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+   * otherwise an `HUB_HTTP_<status>` transport error.
+   */
+  private requestBytes;
+}
+//#endregion
 //#region src/event-delivery.d.ts
 type HubEventSignatureFailure = "missing" | "malformed" | "stale" | "mismatch";
 type HubEventSignatureResult = {
@@ -1810,8 +2669,174 @@ declare function authenticateHubEventRequest(input: AuthenticateHubEventRequestI
 declare function verifyHubEventSignature(input: VerifyHubEventSignatureInput): Promise<HubEventSignatureResult>;
 declare function parseHubEventDelivery(input: string | unknown): HubEventDelivery;
 //#endregion
+//#region src/knowledge-approval.d.ts
+/** Called only after the owner reviews this exact pending effect and clicks
+ * Approve. Re-read first: a stale tab cannot approve a substituted operation. */
+declare function approveKnowledgeSource(input: {
+  port: Pick<HubKnowledgeManagementClient, "get" | "refresh">;
+  approvals: Pick<HubApprovalsClient, "approve">;
+  source: KnowledgeSourceSummary;
+}): Promise<KnowledgeSourceSummary>;
+//#endregion
+//#region src/line-grants.d.ts
+type HubOwnerAskSendInput = Pick<HubLineOwnerSendInput, "text" | "image" | "reply" | "idempotencyKey">;
+interface HubLineGrantBinding {
+  workspaceId: string;
+  workspaceAgentId: string;
+}
+interface HubLineGrant {
+  id: string;
+  /** Canonical Hub identity that consented this grant; distinct from the app-local owner. */
+  ownerUserId?: string;
+  purpose?: "agent" | "owner_asks";
+  lineId: string;
+  connectionId: string;
+  workspaceId: string;
+  workspaceAgentId: string;
+  agentProfileVersion: string;
+  backendSha256: string;
+  attachmentId: string | null;
+  intakeMode: "guests" | "owner_only";
+  /** "application" grants select the app's callback for the owner member instead of attaching. */
+  execution: "backend" | "application" | "none";
+  applicationOrigin: string | null;
+  priorAttachmentId: string | null;
+  priorAttachmentActive: boolean;
+  monthlyBudgetUsd: number;
+  monthlySpentUsd: number;
+}
+interface HubLineGrantLine {
+  id: string;
+  connectionId: string;
+  transport: "sms" | "imessage" | "whatsapp";
+  status: string;
+  address: string | null;
+  attachment: {
+    id: string;
+    sandboxId: string;
+    status: string;
+  } | null;
+}
+interface HubLineGrantAttachInput {
+  workspaceAgentId: string;
+  agentProfileVersion: string;
+  renewalCode?: string;
+  respond: {
+    kind: "agent";
+    backend: Record<string, unknown>;
+  };
+}
+interface HubLineGrantAttachment {
+  id: string;
+  sandboxId: string;
+  status: string;
+  members?: Array<{
+    id: string;
+    role: string;
+  }>;
+}
+interface HubLineGrantThread {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+}
+interface HubLineGrantMessage {
+  id: string;
+  threadId: string;
+  direction: string;
+  text: string | null;
+}
+/** The consented owner member on the owner's current attachment. */
+interface HubLineGrantMemberApplication {
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  /** Pass back unchanged as `expectedMemberRevision`. */
+  memberRevision: string;
+  /** False until the owner has texted the line and Hub recorded consent. */
+  eligible: boolean;
+  /** Hub-derived; every callback for this grant carries it. */
+  binding: string;
+  selection: {
+    id: string; /** True when this grant's callback is the selected application. */
+    own: boolean;
+    /**
+     * Hub's name for the app that answers the owner's texts, shown to the
+     * owner in every app they consented on this line: a registered app's
+     * name, or "Another app" when Hub has none. Absent before Platform named
+     * selection holders.
+     */
+    app?: {
+      name: string;
+    }; /** When the current app started answering. */
+    selectedAt?: string; /** This app's own callback; never returned for another app. */
+    url?: string;
+    createdAt?: string;
+  } | null;
+}
+interface HubLineGrantSelectApplicationInput {
+  /** The current selection exactly as read. */
+  expectedSelectionId: string | null;
+  /**
+   * Set only when the owner chose to move their texts here from the app shown
+   * in `selection.app`: that selection's id, also passed as
+   * `expectedSelectionId`. Without it Hub never replaces another app.
+   */
+  replaceSelectionId?: string;
+  expectedMemberRevision: string;
+  /** HTTPS callback on the owner-approved application origin. */
+  url: string;
+  /** Bearer Hub sends to the callback; 32-512 printable ASCII characters. */
+  secret: string;
+}
+interface HubLineGrantApplicationSelection {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  status: string;
+  application: {
+    url: string;
+    binding: string;
+  };
+  createdAt: string;
+  revokedAt: string | null;
+}
+/** Every call uses HubTransport's authHeaders, so one-use app broker tokens can be minted per request. */
+declare class HubLineGrantsClient extends HubTransport {
+  current(binding: HubLineGrantBinding): Promise<HubLineGrant>;
+  line(binding: HubLineGrantBinding): Promise<HubLineGrantLine>;
+  attach(binding: HubLineGrantBinding, input: HubLineGrantAttachInput): Promise<HubLineGrantAttachment>;
+  detach(binding: HubLineGrantBinding): Promise<{
+    detached: boolean;
+  }>;
+  threads(binding: HubLineGrantBinding): Promise<HubLineGrantThread[]>;
+  messages(binding: HubLineGrantBinding, threadId: string): Promise<HubLineGrantMessage[]>;
+  memberApplication(binding: HubLineGrantBinding): Promise<HubLineGrantMemberApplication>;
+  /**
+   * Route the owner's texts to this app's callback; the incumbent attachment
+   * stays. `replaceSelectionId` moves them from another app on the owner's
+   * explicit choice.
+   */
+  selectApplication(binding: HubLineGrantBinding, input: HubLineGrantSelectApplicationInput): Promise<HubLineGrantApplicationSelection>;
+  /** Return the owner's texts to the incumbent attachment. */
+  clearApplication(binding: HubLineGrantBinding, input: {
+    expectedSelectionId: string;
+    expectedMemberRevision: string;
+  }): Promise<void>;
+  /** Ask only the verified owner member named by this owner_asks grant. */
+  send(binding: HubLineGrantBinding, input: HubOwnerAskSendInput): Promise<HubLineSendReceipt>;
+  /** Only a send created by this same grant is visible. */
+  outbox(binding: HubLineGrantBinding, messageId: string): Promise<HubLineSendReceipt>;
+  revoke(binding: HubLineGrantBinding, expectedGrantId?: string): Promise<{
+    revoked: boolean;
+  }>;
+}
+//#endregion
 //#region src/redaction.d.ts
 declare function redactHubValue(value: unknown): unknown;
 //#endregion
-export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppDisconnectResponse, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListInstallationsResponse, type HubGithubAppListReposResponse, type HubGithubAppManagedInstallation, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubGithubAppSyncResponse, type HubGithubAppSyncedInstallation, type HubManualRunInput, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthConnectionParameter, type HubOAuthStartRequest, type HubOAuthStartResponse, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowAgentStep, type HubWorkflowArtifact, type HubWorkflowArtifactDownload, type HubWorkflowArtifactRef, type HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, type HubWorkflowConnectionRequirement, type HubWorkflowDecision, type HubWorkflowDecisionOnTimeout, type HubWorkflowDecisionResolveResult, type HubWorkflowDecisionResolvedVia, type HubWorkflowDecisionStatus, type HubWorkflowDistillationCandidate, type HubWorkflowEdgeVerdicts, type HubWorkflowEventFilter, type HubWorkflowFailureCluster, type HubWorkflowFleetEntry, type HubWorkflowFleetInsights, type HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, type HubWorkflowHealth, type HubWorkflowHookEndpoint, type HubWorkflowHookToken, type HubWorkflowKvDeleteResponse, type HubWorkflowKvEntry, type HubWorkflowKvEntryMeta, type HubWorkflowKvListResponse, type HubWorkflowNodeHealth, type HubWorkflowOnErrorOutcome, type HubWorkflowPendingDecision, type HubWorkflowPendingDecisionsResponse, type HubWorkflowProposal, type HubWorkflowProposalInput, type HubWorkflowRevision, type HubWorkflowRevisionMeta, type HubWorkflowRevisionSource, type HubWorkflowRevisionStatus, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunRetried, type HubWorkflowRunStatus, type HubWorkflowRunStepsPage, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTemplate, type HubWorkflowTemplateCategory, type HubWorkflowTemplateInstantiateResult, type HubWorkflowTemplateParameter, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, type VerifyHubEventSignatureInput, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, HubAgentIterationSpan, HubAgentRunDetail, HubAllowWritesResponse, type HubAllowanceDecision, type HubAllowanceGrant, type HubAllowancePlan, type HubAllowancePlanInput, type HubAllowanceRole, type HubAllowanceSubject, type HubAllowanceSyncInput, type HubAllowanceSyncReceipt, type HubAllowanceTier, type HubAllowanceUsage, HubAllowancesClient, HubApiKeyConnectRequest, HubApiKeyConnectResponse, HubApiKeyConnectionMetadata, type HubApp, HubAppBrokerClient, type HubAppBrokerExchange, type HubAppBrokerOptions, type HubAppBrokerToken, type HubAppComplianceClaim, type HubAppComplianceState, type HubAppCreateInput, type HubAppGrant, type HubAppGrantRevoked, HubApproval, HubApprovalCapabilityToken, HubApprovalDecisionResponse, HubApprovalListResponse, HubApprovalStatus, HubApprovalsClient, HubAppsClient, HubAuditClient, HubAuditEvent, HubAuditListRequest, HubAuditResponse, type HubAuthHeaders, HubCapabilityToken, HubChannel, HubChannelCreateResponse, HubChannelDeleteResponse, HubChannelsClient, HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, HubConnection, HubConnectionDeleteResponse, HubConnectionHealthError, HubConnectionHealthInfo, HubConnectionHealthResponse, HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, HubConnectionsResponse, HubEmailChannel, HubEmailChannelCreateRequest, type HubEnv, HubErrorBody, HubErrorCode, HubErrorEnvelope, HubEventCondition, HubEventConditionScalar, HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, HubEventSubscription, HubEventSubscriptionCallback, HubEventSubscriptionCreateRequest, HubEventSubscriptionCreateResponse, HubEventSubscriptionDeleteResponse, HubEventSubscriptionFilter, HubEventSubscriptionSource, HubEventSubscriptionsClient, HubEventSubscriptionsResponse, HubExecResponse, HubGithubAppClient, HubGithubAppDisconnectResponse, HubGithubAppInstallation, HubGithubAppInstallationResponse, HubGithubAppIsRepoInstalledResponse, HubGithubAppListInstallationsResponse, HubGithubAppListReposResponse, HubGithubAppManagedInstallation, HubGithubAppMintInstallationTokenRequest, HubGithubAppMintInstallationTokenResponse, HubGithubAppSyncResponse, HubGithubAppSyncedInstallation, type HubInboundPhoneNumberScope, type HubInboundWebhookCreateOptions, type HubInboundWebhookCreateResponse, type HubInboundWebhookStatus, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, type HubKnowledgeQueryResult, type HubKnowledgeRetrievalResult, type HubLineApplicationDispatchCurrentInput, type HubLineCheckinOptions, type HubLineContext, type HubLineGrant, type HubLineGrantApplicationSelection, type HubLineGrantAttachInput, type HubLineGrantAttachment, type HubLineGrantBinding, type HubLineGrantLine, type HubLineGrantMemberApplication, type HubLineGrantMessage, type HubLineGrantSelectApplicationInput, type HubLineGrantThread, HubLineGrantsClient, type HubLineImage, type HubLineMember, type HubLineMemberApplication, type HubLineMemberApplicationInput, type HubLineOwnerSendInput, type HubLineProviderDelivery, type HubLineReminderInput, type HubLineReminderReceipt, type HubLineReplyCode, type HubLineReplyCodeInput, type HubLineScheduledSendOptions, type HubLineSendInput, type HubLineSendReceipt, HubLinesClient, HubManagedNumbersClient, HubManualRunInput, type HubNumberListQuery, type HubNumberOrder, type HubNumberOrderPage, type HubNumberQuote, type HubNumberReadiness, type HubNumberResolution, HubOAuthConnectionParameter, HubOAuthStartResponse, type HubOwnerAskSendInput, HubPermissionsClient, HubPolicy, HubPolicyDecision, HubPolicyDeleteRequest, HubPolicyDeleteResponse, HubPolicyListResponse, HubPolicyResponse, HubPolicyUpdateRequest, HubPrincipal, HubPrincipalKind, HubProvider, HubProviderAuthKind, HubProviderEvent, HubProvidersResponse, HubRevertWritesResponse, HubSdkError, HubStatusConnections, HubStatusResponse, HubSuccessEnvelope, type HubTokenListOptions, HubTokenMintResponse, HubTokenRevokeResponse, HubTokensClient, HubTokensListResponse, HubTool, type HubToolInvokeOptions, HubToolRisk, type HubToolSearchOptions, HubToolSource, HubToolSourcesResponse, HubToolsClient, HubToolsDescribeResponse, HubToolsSearchResponse, HubWhatsappEmbeddedSignupCompleteRequest, HubWhatsappEmbeddedSignupCompleteResponse, HubWhatsappEmbeddedSignupStartRequest, HubWhatsappEmbeddedSignupStartResponse, HubWorkflow, HubWorkflowAction, HubWorkflowActionResult, HubWorkflowAgentStep, HubWorkflowArtifact, HubWorkflowArtifactDownload, HubWorkflowArtifactRef, HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, HubWorkflowConnectionRequirement, HubWorkflowDecision, HubWorkflowDecisionOnTimeout, HubWorkflowDecisionResolveResult, HubWorkflowDecisionResolvedVia, HubWorkflowDecisionStatus, HubWorkflowDistillationCandidate, HubWorkflowEdgeVerdicts, HubWorkflowEventFilter, HubWorkflowFailureCluster, HubWorkflowFleetEntry, HubWorkflowFleetInsights, HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, HubWorkflowHealth, HubWorkflowHookEndpoint, HubWorkflowKvDeleteResponse, HubWorkflowKvEntry, HubWorkflowKvEntryMeta, HubWorkflowKvListResponse, HubWorkflowNodeHealth, HubWorkflowOnErrorOutcome, HubWorkflowPendingDecision, HubWorkflowPendingDecisionsResponse, HubWorkflowProposal, HubWorkflowRevision, HubWorkflowRevisionMeta, HubWorkflowRevisionSource, HubWorkflowRevisionStatus, HubWorkflowRun, HubWorkflowRunCancelResult, HubWorkflowRunDetail, HubWorkflowRunEnqueued, HubWorkflowRunInputs, HubWorkflowRunRetried, HubWorkflowRunStatus, HubWorkflowRunStepsPage, HubWorkflowRunStreamEvent, HubWorkflowRunSummary, HubWorkflowRunsPage, HubWorkflowSchemaResponse, HubWorkflowTemplate, HubWorkflowTemplateCategory, HubWorkflowTemplateInstantiateResult, HubWorkflowTemplateParameter, HubWorkflowTrigger, HubWorkflowValidateResponse, HubWorkflowValidationError, HubWorkflowsClient, KnowledgeAttachment, KnowledgeAttachmentAuthorization, KnowledgeAuthorization, KnowledgeCapabilities, KnowledgeCapability, KnowledgeEmbeddingSpace, KnowledgeReference, KnowledgeSourceCreate, KnowledgeSourceInput, KnowledgeSourceSummary, type VerifyHubEventSignatureInput, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature, workflowConnectionRequirementKey };
 //# sourceMappingURL=index.d.ts.map