@tangle-network/hub-sdk 0.60.78-develop.20261017134105.a6b32a2 → 0.60.78-develop.20261021225232.c7da8cb

package/dist/index.d.ts

@@ -240,141 +240,561 @@ declare class HubAppsClient {
   }): Promise<HubAppComplianceState>;
 }
 //#endregion
-//#region src/types.d.ts
-type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
-interface HubSuccessEnvelope<TData> {
-  success: true;
-  data: TData;
+//#region src/tool-types.d.ts
+interface HubToolSource {
+  sourceId: string;
+  providerId: string;
+  displayName: string;
+  toolCount: number;
+  connectionStatus: "connected" | "missing" | "unknown";
+  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
+  configured: boolean;
 }
-interface HubErrorEnvelope {
-  success: false;
-  error: HubErrorBody;
+/** Per-tool catalog risk class. The first three mirror the platform's
+ *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
+ *  classify (substrate connectors). */
+type HubToolRisk = "read" | "write" | "destructive" | "unknown";
+interface HubTool {
+  path: string;
+  providerId?: string;
+  title?: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  connectionRequired?: boolean;
+  connectionStatus?: "connected" | "missing" | "unknown";
+  requiredConnectionProviderId?: string;
+  policyState?: "allow" | "ask" | "deny" | "unknown";
+  risk?: HubToolRisk;
 }
-type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
-interface HubErrorBody {
-  code: HubErrorCode;
-  message: string;
-  details?: unknown;
+interface HubToolSourcesResponse {
+  sources: HubToolSource[];
 }
-type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
-interface HubStatusResponse {
-  contract: unknown;
-  principal: HubPrincipal;
-  connections: HubStatusConnections;
+interface HubToolsSearchRequest {
+  query: string;
+  provider?: string;
 }
-interface HubPrincipal {
-  kind: HubPrincipalKind;
-  userId: string;
-  apiKeyId?: string;
-  sandboxId?: string;
-  requestId?: string;
+interface HubToolsSearchResponse {
+  tools: HubTool[];
 }
-interface HubStatusConnections {
-  connectedProviderCount: number;
-  unhealthyProviderCount: number;
+interface HubToolsDescribeRequest {
+  path: string;
 }
-interface HubConnection {
-  id: string;
-  providerId: string;
-  displayName: string;
-  accountDisplay: string | null;
-  providerAccountId: string | null;
-  scopes: string[];
-  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
-  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
-  createdAt: string;
-  updatedAt: string;
-  lastUsedAt: string | null;
+interface HubToolsDescribeResponse {
+  tool: HubTool;
 }
-interface HubConnectionsResponse {
-  connections: HubConnection[];
+interface HubExecRequest {
+  path: string;
+  input?: unknown;
+  connectionId?: string;
+  /** Caller-minted key for this exec. The platform ledger replays the first
+   *  call's result for a retry that carries the same key, and rejects a key
+   *  reused for a different request. On the capability-token arm the key only
+   *  reaches the connector for provider-native dedupe: that arm is at-most-once
+   *  per token and replays no stored result. */
+  idempotencyKey?: string;
 }
-interface HubEmailChannel {
-  id: string;
-  kind: "email";
-  providerId: "email";
-  connectionId: string;
-  clientReference: string | null;
-  label: string | null;
-  address: string;
-  status: "active";
-  createdAt: string;
-  updatedAt: string;
+interface HubExecResponse<TResult = unknown> {
+  result: TResult;
+  /** True when the result was replayed from a previous call with the same
+   *  idempotency key, so the action did not run again. */
+  replayed?: boolean;
 }
-type HubChannel = HubEmailChannel;
-interface HubChannelsResponse {
-  channels: HubChannel[];
+//#endregion
+//#region src/broker.d.ts
+interface HubAppBrokerOptions {
+  baseUrl: string;
+  clientId: string;
+  clientSecret: string;
+  fetch?: typeof fetch;
 }
-interface HubEmailChannelCreateRequest {
-  /**
-   * Product-owned idempotency key. Retrying the same request returns the
-   * original mailbox instead of provisioning another address.
-   */
-  clientReference?: string;
-  label?: string;
+interface HubAppBrokerToken {
+  accessToken: string;
+  expiresIn: number;
+  scopes: string[];
 }
-interface HubChannelCreateResponse {
-  channel: HubChannel;
-  /** True only when this request created the channel. */
-  created: boolean;
+interface HubAppBrokerExchange extends HubAppBrokerToken {
+  grantId: string;
+  connectionId: string;
 }
-interface HubChannelDeleteResponse {
-  removed: true;
+/** Server-only client. App secrets never become a user's general API key.
+ * Every invocation mints and consumes one short-lived, exact-grant token. */
+declare class HubAppBrokerClient {
+  private readonly options;
+  private readonly baseUrl;
+  private readonly fetcher;
+  constructor(options: HubAppBrokerOptions);
+  private token;
+  private readToken;
+  exchange(input: {
+    code: string;
+    redirectUri: string;
+    connectionId?: string;
+  }): Promise<HubAppBrokerExchange>;
+  mint(grantId: string): Promise<HubAppBrokerToken>;
+  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
 }
-type HubEventConditionScalar = string | number | boolean | null;
-type HubEventCondition = {
-  path: string;
-  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
-  value?: HubEventConditionScalar | HubEventConditionScalar[];
+//#endregion
+//#region src/knowledge-management.d.ts
+interface KnowledgeReference {
+  sourceId: string;
+  generation: string;
+}
+/** Connection references only. Provider credentials never enter this contract. */
+interface KnowledgeEmbeddingSpace {
+  connectionId: string;
+  model: string;
+  dimensions: number;
+}
+type KnowledgeSourceInput = {
+  kind: "file";
+  name: string;
+  base64: string;
+  mediaType: string;
 } | {
-  all: HubEventCondition[];
+  kind: "git";
+  connectionId: string;
+  owner: string;
+  repo: string;
+  ref: string;
+  pathPrefix?: string;
 } | {
-  any: HubEventCondition[];
+  kind: "url";
+  url: string;
 } | {
-  not: HubEventCondition;
-};
-interface HubEventSubscriptionFilter {
-  action?: string;
-  repo?: string;
-  when?: HubEventCondition;
-}
-type HubEventSubscriptionSource = {
-  type: "channel";
-  channelId: string;
+  kind: "s3";
+  connectionId: string;
+  bucket: string;
+  prefix: string;
 } | {
-  type: "connection";
+  kind: "vector";
   connectionId: string;
+  provider: "pinecone" | "qdrant" | "weaviate";
+  indexName: string;
+  namespace?: string;
+  embedding: KnowledgeEmbeddingSpace;
+  textField: string;
+  sourceUriField: string;
 };
-interface HubEventSubscriptionCallback {
-  url: string;
-  secret: string;
+interface KnowledgeCapability {
+  supported: boolean;
+  reason?: string;
 }
-interface HubEventSubscriptionCreateRequest {
-  /**
-   * Product-owned idempotency key. Reusing it with the same source and filter
-   * returns the existing subscription; reusing it for different input fails.
-   */
-  clientReference: string;
-  label?: string;
-  source: HubEventSubscriptionSource;
-  event: string;
-  filter?: HubEventSubscriptionFilter;
-  callback: HubEventSubscriptionCallback;
+interface KnowledgeCapabilities {
+  delegation?: KnowledgeCapability & {
+    resource?: string;
+    scopes?: string[];
+  };
+  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
+  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
+  managedVector: KnowledgeCapability;
+  file: {
+    mediaTypes: string[];
+    maxBytes: number;
+    maxObjects: number;
+  };
 }
-interface HubEventSubscription {
+interface KnowledgeSourceSummary {
+  /** Required query authorization, not proof that an owner policy currently permits it. */
+  retrieval?: {
+    kind: "lexical";
+  } | {
+    kind: "vector";
+    embeddingPolicy: {
+      connectionId: string;
+      actionPath: "openai.embeddings.create";
+      scope: "owner-connection-action";
+    };
+  };
   id: string;
-  clientReference: string;
-  label: string | null;
-  source: HubEventSubscriptionSource;
-  providerId: string;
-  connectionId: string;
-  event: string;
-  filter: HubEventSubscriptionFilter;
-  workflowId: string;
-  status: "active" | "error";
-  lastError: string | null;
-  createdAt: string;
-  updatedAt: string;
+  name: string;
+  kind: KnowledgeSourceInput["kind"];
+  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
+  approval?: {
+    id: string;
+    path: string;
+    preview: {
+      provider: string;
+      connectionId: string;
+      collection: string;
+      sourceId: string;
+      requestId: string;
+      embedding: KnowledgeEmbeddingSpace;
+      chunkCount: number;
+      sourceCount: number;
+      dataSharing: string;
+    };
+  };
+  refreshRequestId?: string;
+  generation: string | null;
+  lastError: {
+    code: string;
+    message: string;
+  } | null;
+  updatedAt: string;
+}
+type KnowledgeAttachmentAuthorization = {
+  status: "active";
+} | {
+  status: "unavailable";
+  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+};
+interface KnowledgeAttachment {
+  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
+  authorization?: KnowledgeAttachmentAuthorization;
+  id: string;
+  sourceId: string;
+  sandboxId: string;
+  generation: string;
+  status: "active" | "detached";
+}
+interface KnowledgeSourceCreate {
+  requestId: string;
+  name: string;
+  source: KnowledgeSourceInput;
+  target?: {
+    kind: "lexical";
+  } | {
+    kind: "managed-vector";
+    provider: "qdrant";
+    connectionId: string;
+    embedding: KnowledgeEmbeddingSpace;
+  };
+}
+/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
+interface KnowledgeAuthorization {
+  userId: string;
+  clientId: string;
+  resource: string;
+  scopes: Array<"knowledge:read" | "knowledge:write">;
+}
+declare class HubKnowledgeManagementClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  materialize(input: {
+    sandboxId: string;
+    references: KnowledgeReference[];
+  }): Promise<KnowledgeAttachment[]>;
+  authorization(): Promise<KnowledgeAuthorization>;
+  disconnectAuthorization(): Promise<{
+    revoked: true;
+  }>;
+  capabilities(): Promise<KnowledgeCapabilities>;
+  list(): Promise<KnowledgeSourceSummary[]>;
+  get(sourceId: string): Promise<KnowledgeSourceSummary>;
+  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
+  refresh(sourceId: string, input: {
+    requestId: string;
+    approvalToken?: string;
+  }): Promise<KnowledgeSourceSummary>;
+  attach(sourceId: string, input: {
+    sandboxId: string;
+    generation: string;
+    expectedGeneration?: string;
+  }): Promise<KnowledgeAttachment>;
+  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
+  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+}
+//#endregion
+//#region src/knowledge.d.ts
+interface HubKnowledgeRetrievalResult {
+  attachmentId: string;
+  generation: string;
+  provenance: "ingested" | "record-supplied";
+  hits: Array<{
+    id: string;
+    title: string;
+    snippet: string;
+    score?: number;
+    citations?: Array<{
+      sourceId: string;
+      sourceUri: string;
+      revision?: string;
+    }>;
+  }>;
+  elapsedMs?: number;
+}
+interface HubKnowledgeQueryResult {
+  results: HubKnowledgeRetrievalResult[];
+  /** Individual unavailable sources do not hide evidence from healthy sources. */
+  failures: Array<{
+    attachmentId: string;
+    code: string;
+    message: string;
+  }>;
+  partial: boolean;
+}
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+ * scope on the server; neither a caller nor an agent can supply another scope. */
+declare class HubKnowledgeClient {
+  private readonly request;
+  readonly management: HubKnowledgeManagementClient;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  bindings(): Promise<{
+    references: KnowledgeReference[];
+  }>;
+  query(input: {
+    query: string;
+    limit?: number;
+    expectedReferences?: KnowledgeReference[];
+  }, options?: {
+    signal?: AbortSignal;
+  }): Promise<HubKnowledgeQueryResult>;
+}
+//#endregion
+//#region src/audit-types.d.ts
+interface HubAuditEvent {
+  id: string;
+  action: string;
+  targetUserId: string | null;
+  targetKeyId: string | null;
+  metadata: unknown;
+  createdAt: string;
+}
+interface HubAuditListRequest {
+  provider?: string;
+  action?: string;
+  status?: string;
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+}
+interface HubAuditResponse {
+  events: HubAuditEvent[];
+  nextCursor: string | null;
+}
+//#endregion
+//#region src/transport-types.d.ts
+type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
+interface HubSuccessEnvelope<TData> {
+  success: true;
+  data: TData;
+}
+interface HubErrorEnvelope {
+  success: false;
+  error: HubErrorBody;
+}
+type HubEnvelope<TData> = HubSuccessEnvelope<TData> | HubErrorEnvelope;
+interface HubErrorBody {
+  code: HubErrorCode;
+  message: string;
+  details?: unknown;
+}
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | `HUB_HTTP_${number}`;
+interface HubStatusResponse {
+  contract: unknown;
+  principal: HubPrincipal;
+  connections: HubStatusConnections;
+}
+interface HubPrincipal {
+  kind: HubPrincipalKind;
+  userId: string;
+  apiKeyId?: string;
+  sandboxId?: string;
+  requestId?: string;
+}
+interface HubStatusConnections {
+  connectedProviderCount: number;
+  unhealthyProviderCount: number;
+}
+interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
+  error: HubErrorEnvelope["error"] & {
+    code: "HUB_NOT_IMPLEMENTED";
+  };
+}
+//#endregion
+//#region src/authorization-types.d.ts
+interface HubTokenMintRequest {
+  connectionId?: string;
+  provider?: string;
+  actionPath: string;
+  ttlSeconds?: number;
+}
+interface HubTokenMintResponse {
+  token: string;
+  tokenId: string;
+  expiresAt: string;
+}
+interface HubCapabilityToken {
+  id: string;
+  providerId: string;
+  connectionId: string;
+  connectionDisplay: string | null;
+  actionPath: string;
+  expiresAt: string;
+  status: "active" | "consumed" | "expired" | "revoked";
+  principalKind: HubPrincipalKind;
+  createdAt: string;
+}
+interface HubTokensListResponse {
+  tokens: HubCapabilityToken[];
+}
+interface HubTokenRevokeResponse {
+  tokenId: string;
+  status: HubCapabilityToken["status"];
+}
+type HubPolicyDecision = "allow" | "ask" | "deny";
+interface HubPolicyUpdateRequest {
+  connectionId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+}
+interface HubPolicyListRequest {
+  connectionId: string;
+}
+interface HubPolicyDeleteRequest {
+  connectionId: string;
+  actionPath: string;
+}
+interface HubPolicyDeleteResponse {
+  connectionId: string;
+  actionPath: string;
+  /** Whether a stored override existed and was removed (false = already default). */
+  deleted: boolean;
+}
+interface HubPolicy {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubPolicyResponse {
+  policy: HubPolicy;
+}
+interface HubPolicyListResponse {
+  policies: HubPolicy[];
+}
+interface HubAllowWritesResponse {
+  connectionId: string;
+  providerId: string;
+  /** Write actions the connection's provider exposes. */
+  writeActions: number;
+  /** Rows newly created (excludes actions that already had a policy). */
+  granted: number;
+  actionPaths: string[];
+}
+interface HubRevertWritesResponse {
+  connectionId: string;
+  /** `allow_writes` rows deleted. */
+  reverted: number;
+}
+type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
+interface HubApproval {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  inputHash: string;
+  requesterPrincipal: Record<string, unknown>;
+  status: HubApprovalStatus;
+  requestedAt: string;
+  expiresAt: string;
+  resolvedAt: string | null;
+}
+interface HubApprovalCapabilityToken {
+  tokenId: string;
+  token: string;
+  expiresAt: string;
+}
+interface HubApprovalDecisionResponse {
+  approval: HubApproval;
+  capabilityToken?: HubApprovalCapabilityToken;
+}
+interface HubApprovalListResponse {
+  approvals: HubApproval[];
+}
+//#endregion
+//#region src/channel-types.d.ts
+interface HubEmailChannel {
+  id: string;
+  kind: "email";
+  providerId: "email";
+  connectionId: string;
+  clientReference: string | null;
+  label: string | null;
+  address: string;
+  status: "active";
+  createdAt: string;
+  updatedAt: string;
+}
+type HubChannel = HubEmailChannel;
+interface HubChannelsResponse {
+  channels: HubChannel[];
+}
+interface HubEmailChannelCreateRequest {
+  /**
+   * Product-owned idempotency key. Retrying the same request returns the
+   * original mailbox instead of provisioning another address.
+   */
+  clientReference?: string;
+  label?: string;
+}
+interface HubChannelCreateResponse {
+  channel: HubChannel;
+  /** True only when this request created the channel. */
+  created: boolean;
+}
+interface HubChannelDeleteResponse {
+  removed: true;
+}
+type HubEventConditionScalar = string | number | boolean | null;
+type HubEventCondition = {
+  path: string;
+  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+  value?: HubEventConditionScalar | HubEventConditionScalar[];
+} | {
+  all: HubEventCondition[];
+} | {
+  any: HubEventCondition[];
+} | {
+  not: HubEventCondition;
+};
+interface HubEventSubscriptionFilter {
+  action?: string;
+  repo?: string;
+  when?: HubEventCondition;
+}
+type HubEventSubscriptionSource = {
+  type: "channel";
+  channelId: string;
+} | {
+  type: "connection";
+  connectionId: string;
+};
+interface HubEventSubscriptionCallback {
+  url: string;
+  secret: string;
+}
+interface HubEventSubscriptionCreateRequest {
+  /**
+   * Product-owned idempotency key. Reusing it with the same source and filter
+   * returns the existing subscription; reusing it for different input fails.
+   */
+  clientReference: string;
+  label?: string;
+  source: HubEventSubscriptionSource;
+  event: string;
+  filter?: HubEventSubscriptionFilter;
+  callback: HubEventSubscriptionCallback;
+}
+interface HubEventSubscription {
+  id: string;
+  clientReference: string;
+  label: string | null;
+  source: HubEventSubscriptionSource;
+  providerId: string;
+  connectionId: string;
+  event: string;
+  filter: HubEventSubscriptionFilter;
+  workflowId: string;
+  status: "active" | "error";
+  lastError: string | null;
+  createdAt: string;
+  updatedAt: string;
 }
 interface HubEventSubscriptionsResponse {
   subscriptions: HubEventSubscription[];
@@ -409,6 +829,24 @@ interface HubEventDelivery {
   providerEvent: HubProviderEvent;
   firedAt: string;
 }
+//#endregion
+//#region src/connection-types.d.ts
+interface HubConnection {
+  id: string;
+  providerId: string;
+  displayName: string;
+  accountDisplay: string | null;
+  providerAccountId: string | null;
+  scopes: string[];
+  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
+  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+}
+interface HubConnectionsResponse {
+  connections: HubConnection[];
+}
 /** A connector's auth model. */
 type HubProviderAuthKind = "oauth2" | "api_key" | "none" | "custom";
 /** One non-secret value needed before an OAuth redirect can be built. Tenant-
@@ -570,193 +1008,8 @@ interface HubConnectionHealthResponse {
   connection: HubConnection;
   health: HubConnectionHealthInfo;
 }
-interface HubToolSource {
-  sourceId: string;
-  providerId: string;
-  displayName: string;
-  toolCount: number;
-  connectionStatus: "connected" | "missing" | "unknown";
-  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
-  configured: boolean;
-}
-/** Per-tool catalog risk class. The first three mirror the platform's
- *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
- *  classify (substrate connectors). */
-type HubToolRisk = "read" | "write" | "destructive" | "unknown";
-interface HubTool {
-  path: string;
-  providerId?: string;
-  title?: string;
-  description?: string;
-  inputSchema?: unknown;
-  outputSchema?: unknown;
-  connectionRequired?: boolean;
-  connectionStatus?: "connected" | "missing" | "unknown";
-  requiredConnectionProviderId?: string;
-  policyState?: "allow" | "ask" | "deny" | "unknown";
-  risk?: HubToolRisk;
-}
-interface HubToolSourcesResponse {
-  sources: HubToolSource[];
-}
-interface HubToolsSearchRequest {
-  query: string;
-  provider?: string;
-}
-interface HubToolsSearchResponse {
-  tools: HubTool[];
-}
-interface HubToolsDescribeRequest {
-  path: string;
-}
-interface HubToolsDescribeResponse {
-  tool: HubTool;
-}
-interface HubExecRequest {
-  path: string;
-  input?: unknown;
-  connectionId?: string;
-  /** Caller-minted key for this exec. The platform ledger replays the first
-   *  call's result for a retry that carries the same key, and rejects a key
-   *  reused for a different request. On the capability-token arm the key only
-   *  reaches the connector for provider-native dedupe: that arm is at-most-once
-   *  per token and replays no stored result. */
-  idempotencyKey?: string;
-}
-interface HubExecResponse<TResult = unknown> {
-  result: TResult;
-  /** True when the result was replayed from a previous call with the same
-   *  idempotency key, so the action did not run again. */
-  replayed?: boolean;
-}
-interface HubTokenMintRequest {
-  connectionId?: string;
-  provider?: string;
-  actionPath: string;
-  ttlSeconds?: number;
-}
-interface HubTokenMintResponse {
-  token: string;
-  tokenId: string;
-  expiresAt: string;
-}
-interface HubCapabilityToken {
-  id: string;
-  providerId: string;
-  connectionId: string;
-  connectionDisplay: string | null;
-  actionPath: string;
-  expiresAt: string;
-  status: "active" | "consumed" | "expired" | "revoked";
-  principalKind: HubPrincipalKind;
-  createdAt: string;
-}
-interface HubTokensListResponse {
-  tokens: HubCapabilityToken[];
-}
-interface HubTokenRevokeResponse {
-  tokenId: string;
-  status: HubCapabilityToken["status"];
-}
-type HubPolicyDecision = "allow" | "ask" | "deny";
-interface HubPolicyUpdateRequest {
-  connectionId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-}
-interface HubPolicyListRequest {
-  connectionId: string;
-}
-interface HubPolicyDeleteRequest {
-  connectionId: string;
-  actionPath: string;
-}
-interface HubPolicyDeleteResponse {
-  connectionId: string;
-  actionPath: string;
-  /** Whether a stored override existed and was removed (false = already default). */
-  deleted: boolean;
-}
-interface HubPolicy {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  decision: HubPolicyDecision;
-  createdAt: string;
-  updatedAt: string;
-}
-interface HubPolicyResponse {
-  policy: HubPolicy;
-}
-interface HubPolicyListResponse {
-  policies: HubPolicy[];
-}
-interface HubAllowWritesResponse {
-  connectionId: string;
-  providerId: string;
-  /** Write actions the connection's provider exposes. */
-  writeActions: number;
-  /** Rows newly created (excludes actions that already had a policy). */
-  granted: number;
-  actionPaths: string[];
-}
-interface HubRevertWritesResponse {
-  connectionId: string;
-  /** `allow_writes` rows deleted. */
-  reverted: number;
-}
-type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
-interface HubApproval {
-  id: string;
-  connectionId: string;
-  providerId: string;
-  actionPath: string;
-  inputHash: string;
-  requesterPrincipal: Record<string, unknown>;
-  status: HubApprovalStatus;
-  requestedAt: string;
-  expiresAt: string;
-  resolvedAt: string | null;
-}
-interface HubApprovalCapabilityToken {
-  tokenId: string;
-  token: string;
-  expiresAt: string;
-}
-interface HubApprovalDecisionResponse {
-  approval: HubApproval;
-  capabilityToken?: HubApprovalCapabilityToken;
-}
-interface HubApprovalListResponse {
-  approvals: HubApproval[];
-}
-interface HubAuditEvent {
-  id: string;
-  action: string;
-  targetUserId: string | null;
-  targetKeyId: string | null;
-  metadata: unknown;
-  createdAt: string;
-}
-interface HubAuditListRequest {
-  provider?: string;
-  action?: string;
-  status?: string;
-  since?: string;
-  until?: string;
-  cursor?: string;
-  limit?: number;
-}
-interface HubAuditResponse {
-  events: HubAuditEvent[];
-  nextCursor: string | null;
-}
-interface HubUnimplementedErrorEnvelope extends HubErrorEnvelope {
-  error: HubErrorEnvelope["error"] & {
-    code: "HUB_NOT_IMPLEMENTED";
-  };
-}
+//#endregion
+//#region src/github-app-types.d.ts
 interface HubGithubAppMintInstallationTokenRequest {
   /** HTTPS or SSH GitHub URL — alternative to installationId. */
   repoUrl?: string;
@@ -848,39 +1101,49 @@ interface HubGithubAppIsRepoInstalledRequest {
   repo: string;
 }
 interface HubGithubAppIsRepoInstalledResponse {
-  installed: boolean;
-  installationId: number | null;
-}
-interface HubWorkflowAction {
-  kind: string;
-  config: Record<string, unknown>;
-}
-/** Inbound-event matcher for a `provider_event` trigger. */
-interface HubWorkflowEventFilter {
-  event: string;
-  action?: string;
-  repo?: string;
+  installed: boolean;
+  installationId: number | null;
 }
-interface HubWorkflowTrigger {
+//#endregion
+//#region src/workflow-graph-types.d.ts
+/** How a node's incoming edges release it (default `"all"` — omitted on the
+ *  wire for it, so specs compiled before join rules existed round-trip). */
+type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
+type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+type HubWorkflowConditionScalar = string | number | boolean | null;
+/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
+ *  runner against the steps context on the source node's completion. */
+type HubWorkflowCondition = {
+  path: string;
+  op: HubWorkflowConditionOp;
+  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
+} | {
+  all: HubWorkflowCondition[];
+} | {
+  any: HubWorkflowCondition[];
+} | {
+  not: HubWorkflowCondition;
+};
+interface HubWorkflowGraphNode {
   id: string;
-  kind: "provider_event" | "schedule" | "webhook";
-  enabled: boolean;
-  provider: string | null;
-  connectionId: string | null;
-  eventFilter: HubWorkflowEventFilter | null;
-  cron: string | null;
-  timezone: string | null;
-  nextFireAt: string | null;
-  lastFiredAt: string | null;
-  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
-  until: string | null;
+  index: number;
+  join?: HubWorkflowGraphJoinRule;
 }
-interface HubWorkflowValidationError {
-  path: string;
-  message: string;
-  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
-  code?: string;
+interface HubWorkflowGraphEdge {
+  from: string;
+  to: string;
+  /** Guard the runner evaluates on the source's completion; unguarded edges
+   *  carry no `when`. */
+  when?: HubWorkflowCondition;
+}
+/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
+interface HubWorkflowGraphSpec {
+  nodes: HubWorkflowGraphNode[];
+  edges: HubWorkflowGraphEdge[];
+  maxNodeVisits: number;
 }
+//#endregion
+//#region src/workflow-run-types.d.ts
 type HubWorkflowRunStatus = "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled";
 /** One agent iteration of an `agent.run`, as the single-run detail carries it
  *  (JSON-clean ISO timestamps) — including the round's own output `text`. */
@@ -1129,91 +1392,6 @@ interface HubWorkflowFleetInsights {
   windowStart: string;
   workflows: HubWorkflowFleetEntry[];
 }
-interface HubWorkflow {
-  id: string;
-  name: string;
-  description: string | null;
-  enabled: boolean;
-  /** Compiled engine actions (connection refs resolved to ids). */
-  actions: HubWorkflowAction[];
-  /** The durable YAML this workflow compiled from. */
-  definitionYaml: string | null;
-  validationErrors: HubWorkflowValidationError[];
-  /** Current head revision; null on pre-versioning rows until their next
-   *  update (they have no revision history to point at yet). */
-  headRev?: number | null;
-  /** Present on get/create/update detail responses; omitted on list. */
-  triggers?: HubWorkflowTrigger[];
-  /** Present on the detail response: the trigger fields a manual run must supply,
-   *  derived from the definition's `${trigger.*}` references (empty when none). */
-  manualRunInputs?: HubManualRunInput[];
-  /** Present on the get-detail response: the compiled graph topology (null
-   *  when the definition has no graph topology, or is chain-equivalent —
-   *  the legacy linear semantics). Omitted on the list projection. */
-  graph?: HubWorkflowGraphSpec | null;
-  /** Create response only, when the definition has a webhook trigger: the
-   *  hook delivery URL, plus the plaintext bearer token exactly once at mint
-   *  (absent when an active token already exists — rotate to re-reveal). */
-  hook?: HubWorkflowHookEndpoint;
-  /** Present on the list response (latest run, or null if never run); omitted on detail. */
-  lastRun?: HubWorkflowRunSummary | null;
-  createdAt: string;
-  updatedAt: string;
-}
-/** A trigger field a manual "Run now" must supply (derived from the
- *  definition's `${trigger.*}` references). `required` is false only when every
- *  read is wrapped in a `default(...)`. */
-interface HubManualRunInput {
-  path: string;
-  required: boolean;
-}
-type HubWorkflowValidateResponse = {
-  valid: true;
-  name: string;
-  actionCount: number;
-  triggerCount: number;
-} | {
-  valid: false;
-  errors: HubWorkflowValidationError[];
-};
-/** JSON Schema for the YAML workflow definition. */
-type HubWorkflowSchemaResponse = Record<string, unknown>;
-/** How a node's incoming edges release it (default `"all"` — omitted on the
- *  wire for it, so specs compiled before join rules existed round-trip). */
-type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
-type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
-type HubWorkflowConditionScalar = string | number | boolean | null;
-/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
- *  runner against the steps context on the source node's completion. */
-type HubWorkflowCondition = {
-  path: string;
-  op: HubWorkflowConditionOp;
-  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
-} | {
-  all: HubWorkflowCondition[];
-} | {
-  any: HubWorkflowCondition[];
-} | {
-  not: HubWorkflowCondition;
-};
-interface HubWorkflowGraphNode {
-  id: string;
-  index: number;
-  join?: HubWorkflowGraphJoinRule;
-}
-interface HubWorkflowGraphEdge {
-  from: string;
-  to: string;
-  /** Guard the runner evaluates on the source's completion; unguarded edges
-   *  carry no `when`. */
-  when?: HubWorkflowCondition;
-}
-/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
-interface HubWorkflowGraphSpec {
-  nodes: HubWorkflowGraphNode[];
-  edges: HubWorkflowGraphEdge[];
-  maxNodeVisits: number;
-}
 /** One journal completion on the wire: the node that completed and the guard
  *  verdict evaluated for each of its guarded outgoing edges, keyed by edgeKey
  *  (`"from->to"`). Only GUARDED edges ever appear. */
@@ -1234,182 +1412,43 @@ interface HubWorkflowOnErrorOutcome {
     costUsd?: number;
   };
 }
-type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
-/** Lifecycle state of a revision. The head rev only ever points at an
- *  `applied` revision; `proposed` is a service-token-authored suggestion
- *  awaiting an owner decision; `rejected` is a declined proposal (kept for
- *  audit). */
-type HubWorkflowRevisionStatus = "applied" | "proposed" | "rejected";
-/** Revision list projection — attribution + note + status, WITHOUT the YAML body. */
-interface HubWorkflowRevisionMeta {
-  rev: number;
-  createdAt: string;
-  createdBy: string;
-  source: HubWorkflowRevisionSource;
-  note: string | null;
-  status: HubWorkflowRevisionStatus;
-}
-/** One revision WITH its YAML (and the actions compiled alongside it). */
-interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
-  yaml: string;
-  actions: HubWorkflowAction[];
-}
-/** A proposal (proposed or rejected revision) WITH its evidence — what the
- *  proposer derived the suggestion from (e.g. health stats), plus
- *  `rejectionReason` once declined. */
-interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
-  evidence: unknown;
-}
-/** Input to {@link HubWorkflowsClient.propose}. Service-token callers only. */
-interface HubWorkflowProposalInput {
-  yaml: string;
-  note?: string;
-  /** Proposer-supplied justification (any JSON value) — carried verbatim onto
-   *  the revision and shown on the approval surface. */
-  evidence?: unknown;
-}
-/** One node's aggregate across the analyzed runs. */
-interface HubWorkflowNodeHealth {
-  /** The author's graph node id, or `step-N` for a linear run's nodes (and for
-   *  a node whose run cannot be mapped back to a definition). */
-  nodeId: string;
-  visits: number;
-  failures: number;
-  /** Null when no visit carried a cost row (never a fabricated 0). */
-  totalCostUsd: number | null;
-  /** Null when no visit recorded duration spans. */
-  avgDurationMs: number | null;
-}
-/** Failures grouped by a normalized error signature (ids/numbers/whitespace
- *  stripped), most frequent first (top 5). */
-interface HubWorkflowFailureCluster {
-  signature: string;
-  count: number;
-  sampleRunIds: string[];
-}
-/** An agent.run node whose outputs are near-static across runs — a
- *  CANDIDATE for distillation, reported with its measurements, never a
- *  verdict. */
-interface HubWorkflowDistillationCandidate {
-  nodeId: string;
-  matchRatio: number;
-  samples: number;
-  avgCostUsd: number | null;
-}
-interface HubWorkflowHealth {
-  /** The requested window (the `runs` parameter). */
-  runsWindow: number;
-  /** Terminal runs that actually went into the stats. */
-  runsAnalyzed: number;
-  nodes: HubWorkflowNodeHealth[];
-  failureClusters: HubWorkflowFailureCluster[];
-  distillationCandidates: HubWorkflowDistillationCandidate[];
-}
-/** One KV entry with its metadata — the get/put/cas response shape. */
-interface HubWorkflowKvEntry {
-  key: string;
-  value: unknown;
-  version: number;
-  updatedAt: string;
-}
-/** Keyspace metadata row (never the value) — the list response's entry. */
-interface HubWorkflowKvEntryMeta {
-  key: string;
-  version: number;
-  updatedAt: string;
-}
-interface HubWorkflowKvListResponse {
-  entries: HubWorkflowKvEntryMeta[];
-}
-interface HubWorkflowKvDeleteResponse {
-  deleted: boolean;
-}
-/** The opaque ref a stored artifact is referred to by — the value a
- *  script.run node returns as its step output. */
-interface HubWorkflowArtifactRef {
-  $artifact: string;
-  name: string;
-  contentType: string;
-  byteSize: number;
-  preview: string | null;
-}
-/** Artifact metadata (never the bytes), oldest first on the list response. */
-interface HubWorkflowArtifact {
-  id: string;
-  runId: string;
-  workflowId: string;
-  /** The graph node (or `step-N` positional id on linear runs) whose action
-   *  emitted the artifact. */
-  nodeId: string;
-  name: string;
-  contentType: string;
-  byteSize: number;
-  /** First 2KiB of textual content; null for binary content types. */
-  preview: string | null;
-  createdAt: string;
-}
-interface HubWorkflowArtifactsResponse {
-  artifacts: HubWorkflowArtifact[];
-}
-/** Raw artifact bytes from the download route, with their stored content type. */
-interface HubWorkflowArtifactDownload {
-  bytes: Uint8Array;
-  contentType: string;
+/** One node's aggregate across the analyzed runs. */
+interface HubWorkflowNodeHealth {
+  /** The author's graph node id, or `step-N` for a linear run's nodes (and for
+   *  a node whose run cannot be mapped back to a definition). */
+  nodeId: string;
+  visits: number;
+  failures: number;
+  /** Null when no visit carried a cost row (never a fabricated 0). */
+  totalCostUsd: number | null;
+  /** Null when no visit recorded duration spans. */
+  avgDurationMs: number | null;
 }
-type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
-/** One author-time literal a gallery starter needs the user to supply. Every
- *  declared parameter is required; `example` is a valid value that seeds the
- *  form placeholder. */
-interface HubWorkflowTemplateParameter {
-  key: string;
-  label: string;
-  type: "string" | "integer";
-  help?: string;
-  example: string;
+/** Failures grouped by a normalized error signature (ids/numbers/whitespace
+ *  stripped), most frequent first (top 5). */
+interface HubWorkflowFailureCluster {
+  signature: string;
+  count: number;
+  sampleRunIds: string[];
 }
-interface HubWorkflowTemplate {
-  id: string;
-  name: string;
-  summary: string;
-  category: HubWorkflowTemplateCategory;
-  icon: string;
-  requiresSandbox: boolean;
-  /** Providers the template references (a "uses GitHub" hint), sorted. */
-  providers: string[];
-  parameters: HubWorkflowTemplateParameter[];
-  /** The template with parameter tokens rendered to their example values. */
-  previewYaml: string;
+/** An agent.run node whose outputs are near-static across runs — a
+ *  CANDIDATE for distillation, reported with its measurements, never a
+ *  verdict. */
+interface HubWorkflowDistillationCandidate {
+  nodeId: string;
+  matchRatio: number;
+  samples: number;
+  avgCostUsd: number | null;
 }
-/** A connection a definition needs, with where to connect it. */
-interface HubWorkflowConnectionRequirement {
-  provider: string;
-  connected: boolean;
-  kind: "integration" | "github_app";
-  /** Where to satisfy the requirement (App install flow for `github_app`,
-   *  integrations page otherwise); null when no target exists. */
-  connectUrl: string | null;
-  /** Another requirement in the same list that must be satisfied first — a
-   *  `github_app` install is claimed through the `github` connection, so it is
-   *  refused while that connection is missing. Null when nothing blocks this
-   *  requirement. The list is ordered prerequisite-first. */
-  prerequisite: {
-    provider: string;
-    kind: "integration" | "github_app";
-  } | null;
+interface HubWorkflowHealth {
+  /** The requested window (the `runs` parameter). */
+  runsWindow: number;
+  /** Terminal runs that actually went into the stats. */
+  runsAnalyzed: number;
+  nodes: HubWorkflowNodeHealth[];
+  failureClusters: HubWorkflowFailureCluster[];
+  distillationCandidates: HubWorkflowDistillationCandidate[];
 }
-/**
- * Result of instantiating a template. `created: false` is NOT an error — an
- * actionable continuation listing the connections to satisfy before retrying
- * the same call. Invalid parameters or a compile failure throw `HubSdkError`
- * (400) instead, matching the create route's contract.
- */
-type HubWorkflowTemplateInstantiateResult = {
-  created: true;
-  workflow: HubWorkflow;
-} | {
-  created: false;
-  connectionRequirements: HubWorkflowConnectionRequirement[];
-};
 type HubWorkflowDecisionStatus = "pending" | "resolved" | "expired" | "cancelled";
 type HubWorkflowDecisionOnTimeout = "wait" | "fail" | "default";
 /** How the answer arrived: a UI click, a provider-channel event (e.g. a Slack
@@ -1456,16 +1495,6 @@ interface HubWorkflowDecisionResolveResult {
   choice: string;
   resumed: boolean;
 }
-/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
- *  revealed only at mint/rotate time (only the hash is stored). */
-interface HubWorkflowHookEndpoint {
-  url: string;
-  token?: string;
-}
-interface HubWorkflowHookToken {
-  url: string;
-  token: string;
-}
 /** One step of an agent round's execution timeline (reasoning, or a tool call
  *  with args + result), as the step-page endpoint serves it. */
 type HubWorkflowAgentStep = {
@@ -1486,297 +1515,243 @@ interface HubWorkflowRunStepsPage {
   nextCursor: number | null;
 }
 //#endregion
-//#region src/broker.d.ts
-interface HubAppBrokerOptions {
-  baseUrl: string;
-  clientId: string;
-  clientSecret: string;
-  fetch?: typeof fetch;
-}
-interface HubAppBrokerToken {
-  accessToken: string;
-  expiresIn: number;
-  scopes: string[];
-}
-interface HubAppBrokerExchange extends HubAppBrokerToken {
-  grantId: string;
-  connectionId: string;
+//#region src/workflow-definition-types.d.ts
+interface HubWorkflowAction {
+  kind: string;
+  config: Record<string, unknown>;
 }
-/** Server-only client. App secrets never become a user's general API key.
- * Every invocation mints and consumes one short-lived, exact-grant token. */
-declare class HubAppBrokerClient {
-  private readonly options;
-  private readonly baseUrl;
-  private readonly fetcher;
-  constructor(options: HubAppBrokerOptions);
-  private token;
-  private readToken;
-  exchange(input: {
-    code: string;
-    redirectUri: string;
-    connectionId?: string;
-  }): Promise<HubAppBrokerExchange>;
-  mint(grantId: string): Promise<HubAppBrokerToken>;
-  invoke<T = unknown>(grantId: string, connectionId: string, actionPath: string, input: Record<string, unknown>): Promise<HubExecResponse<T>>;
+/** Inbound-event matcher for a `provider_event` trigger. */
+interface HubWorkflowEventFilter {
+  event: string;
+  action?: string;
+  repo?: string;
 }
-//#endregion
-//#region src/inbound-webhooks.d.ts
-/** Provider setup uses the existing authenticated Hub transport and vault. */
-interface HubInboundWebhookCreateOptions {
-  /** Inkbox identity that owns all selected channels. */
-  identityId?: string;
-  mailboxId?: string;
-  phoneNumberId?: string;
-  imessage?: boolean;
-  /** Linq: explicit owned lines; omitted does not mean every account line. */
-  phoneNumbers?: string[];
-  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
-  phoneNumberIds?: string[];
-  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
-  signingSecret?: string;
+interface HubWorkflowTrigger {
+  id: string;
+  kind: "provider_event" | "schedule" | "webhook";
+  enabled: boolean;
+  provider: string | null;
+  connectionId: string | null;
+  eventFilter: HubWorkflowEventFilter | null;
+  cron: string | null;
+  timezone: string | null;
+  nextFireAt: string | null;
+  lastFiredAt: string | null;
+  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
+  until: string | null;
 }
-interface HubInboundWebhookCreateResponse {
-  url: string;
-  /** True only when the provider subscription was created by the server. */
-  provisioned?: boolean;
-  /** Self-configured legacy providers can return a newly minted secret once. */
-  secret?: string;
-  inboundAddress?: string;
-  requiresProviderSetup?: boolean;
+interface HubWorkflowValidationError {
+  path: string;
+  message: string;
+  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
+  code?: string;
 }
-interface HubInboundWebhookStatus {
-  configured: boolean;
-  url?: string;
-  /** Configuration is not evidence of a real delivered message. */
-  deliveryVerified: false;
-  requiresProviderSetup?: boolean;
+interface HubWorkflow {
+  id: string;
+  name: string;
+  description: string | null;
+  enabled: boolean;
+  /** Compiled engine actions (connection refs resolved to ids). */
+  actions: HubWorkflowAction[];
+  /** The durable YAML this workflow compiled from. */
+  definitionYaml: string | null;
+  validationErrors: HubWorkflowValidationError[];
+  /** Current head revision; null on pre-versioning rows until their next
+   *  update (they have no revision history to point at yet). */
+  headRev?: number | null;
+  /** Present on get/create/update detail responses; omitted on list. */
+  triggers?: HubWorkflowTrigger[];
+  /** Present on the detail response: the trigger fields a manual run must supply,
+   *  derived from the definition's `${trigger.*}` references (empty when none). */
+  manualRunInputs?: HubManualRunInput[];
+  /** Present on the get-detail response: the compiled graph topology (null
+   *  when the definition has no graph topology, or is chain-equivalent —
+   *  the legacy linear semantics). Omitted on the list projection. */
+  graph?: HubWorkflowGraphSpec | null;
+  /** Create response only, when the definition has a webhook trigger: the
+   *  hook delivery URL, plus the plaintext bearer token exactly once at mint
+   *  (absent when an active token already exists — rotate to re-reveal). */
+  hook?: HubWorkflowHookEndpoint;
+  /** Present on the list response (latest run, or null if never run); omitted on detail. */
+  lastRun?: HubWorkflowRunSummary | null;
+  createdAt: string;
+  updatedAt: string;
 }
-/** Live provider readback for one explicitly selected Linq WhatsApp number. */
-interface HubInboundPhoneNumberScope {
-  configured: true;
-  provisioned: true;
-  subscribed: true;
-  phoneNumberIds: string[];
+/** A trigger field a manual "Run now" must supply (derived from the
+ *  definition's `${trigger.*}` references). `required` is false only when every
+ *  read is wrapped in a `default(...)`. */
+interface HubManualRunInput {
+  path: string;
+  required: boolean;
 }
-declare class HubInboundWebhooksClient {
-  private readonly request;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
-  get(connectionId: string): Promise<HubInboundWebhookStatus>;
-  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
-  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
-  /** Remove event subscriptions first. This does not silently rotate a live URL. */
-  delete(connectionId: string): Promise<{
-    removed: boolean;
-  }>;
-  private path;
+type HubWorkflowValidateResponse = {
+  valid: true;
+  name: string;
+  actionCount: number;
+  triggerCount: number;
+} | {
+  valid: false;
+  errors: HubWorkflowValidationError[];
+};
+/** JSON Schema for the YAML workflow definition. */
+type HubWorkflowSchemaResponse = Record<string, unknown>;
+type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
+/** Lifecycle state of a revision. The head rev only ever points at an
+ *  `applied` revision; `proposed` is a service-token-authored suggestion
+ *  awaiting an owner decision; `rejected` is a declined proposal (kept for
+ *  audit). */
+type HubWorkflowRevisionStatus = "applied" | "proposed" | "rejected";
+/** Revision list projection — attribution + note + status, WITHOUT the YAML body. */
+interface HubWorkflowRevisionMeta {
+  rev: number;
+  createdAt: string;
+  createdBy: string;
+  source: HubWorkflowRevisionSource;
+  note: string | null;
+  status: HubWorkflowRevisionStatus;
 }
-//#endregion
-//#region src/knowledge-management.d.ts
-interface KnowledgeReference {
-  sourceId: string;
-  generation: string;
+/** One revision WITH its YAML (and the actions compiled alongside it). */
+interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
+  yaml: string;
+  actions: HubWorkflowAction[];
 }
-/** Connection references only. Provider credentials never enter this contract. */
-interface KnowledgeEmbeddingSpace {
-  connectionId: string;
-  model: string;
-  dimensions: number;
+/** A proposal (proposed or rejected revision) WITH its evidence — what the
+ *  proposer derived the suggestion from (e.g. health stats), plus
+ *  `rejectionReason` once declined. */
+interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
+  evidence: unknown;
 }
-type KnowledgeSourceInput = {
-  kind: "file";
-  name: string;
-  base64: string;
-  mediaType: string;
-} | {
-  kind: "git";
-  connectionId: string;
-  owner: string;
-  repo: string;
-  ref: string;
-  pathPrefix?: string;
-} | {
-  kind: "url";
-  url: string;
-} | {
-  kind: "s3";
-  connectionId: string;
-  bucket: string;
-  prefix: string;
-} | {
-  kind: "vector";
-  connectionId: string;
-  provider: "pinecone" | "qdrant" | "weaviate";
-  indexName: string;
-  namespace?: string;
-  embedding: KnowledgeEmbeddingSpace;
-  textField: string;
-  sourceUriField: string;
-};
-interface KnowledgeCapability {
-  supported: boolean;
-  reason?: string;
+/** Input to {@link HubWorkflowsClient.propose}. Service-token callers only. */
+interface HubWorkflowProposalInput {
+  yaml: string;
+  note?: string;
+  /** Proposer-supplied justification (any JSON value) — carried verbatim onto
+   *  the revision and shown on the approval surface. */
+  evidence?: unknown;
 }
-interface KnowledgeCapabilities {
-  delegation?: KnowledgeCapability & {
-    resource?: string;
-    scopes?: string[];
-  };
-  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
-  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
-  managedVector: KnowledgeCapability;
-  file: {
-    mediaTypes: string[];
-    maxBytes: number;
-    maxObjects: number;
-  };
+type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
+/** One author-time literal a gallery starter needs the user to supply. Every
+ *  declared parameter is required; `example` is a valid value that seeds the
+ *  form placeholder. */
+interface HubWorkflowTemplateParameter {
+  key: string;
+  label: string;
+  type: "string" | "integer";
+  help?: string;
+  example: string;
+  default?: string;
+  defaultFrom?: "native_evaluation";
+  required?: boolean;
+  advanced?: boolean;
 }
-interface KnowledgeSourceSummary {
-  /** Required query authorization, not proof that an owner policy currently permits it. */
-  retrieval?: {
-    kind: "lexical";
-  } | {
-    kind: "vector";
-    embeddingPolicy: {
-      connectionId: string;
-      actionPath: "openai.embeddings.create";
-      scope: "owner-connection-action";
-    };
-  };
+interface HubWorkflowTemplate {
   id: string;
   name: string;
-  kind: KnowledgeSourceInput["kind"];
-  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
-  approval?: {
-    id: string;
-    path: string;
-    preview: {
-      provider: string;
-      connectionId: string;
-      collection: string;
-      sourceId: string;
-      requestId: string;
-      embedding: KnowledgeEmbeddingSpace;
-      chunkCount: number;
-      sourceCount: number;
-      dataSharing: string;
-    };
-  };
-  refreshRequestId?: string;
-  generation: string | null;
-  lastError: {
-    code: string;
-    message: string;
+  summary: string;
+  category: HubWorkflowTemplateCategory;
+  icon: string;
+  requiresSandbox: boolean;
+  /** Providers the template references (a "uses GitHub" hint), sorted. */
+  providers: string[];
+  parameters: HubWorkflowTemplateParameter[];
+  /** The template with parameter tokens rendered to their example values. */
+  previewYaml: string;
+  setupNotes?: string[];
+}
+/** A connection a definition needs, with where to connect it. */
+interface HubWorkflowConnectionRequirement {
+  provider: string;
+  connected: boolean;
+  kind: "integration" | "github_app";
+  /** Where to satisfy the requirement (App install flow for `github_app`,
+   *  integrations page otherwise); null when no target exists. */
+  connectUrl: string | null;
+  /** Another requirement in the same list that must be satisfied first — a
+   *  `github_app` install is claimed through the `github` connection, so it is
+   *  refused while that connection is missing. Null when nothing blocks this
+   *  requirement. The list is ordered prerequisite-first. */
+  prerequisite: {
+    provider: string;
+    kind: "integration" | "github_app";
   } | null;
-  updatedAt: string;
 }
-type KnowledgeAttachmentAuthorization = {
-  status: "active";
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+declare function workflowConnectionRequirementKey(ref: Readonly<Pick<HubWorkflowConnectionRequirement, "provider" | "kind">>): string;
+/**
+ * Result of instantiating a template. `created: false` is NOT an error — an
+ * actionable continuation listing the connections to satisfy before retrying
+ * the same call. Invalid parameters or a compile failure throw `HubSdkError`
+ * (400) instead, matching the create route's contract.
+ */
+type HubWorkflowTemplateInstantiateResult = {
+  created: true;
+  workflow: HubWorkflow;
 } | {
-  status: "unavailable";
-  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+  created: false;
+  connectionRequirements: HubWorkflowConnectionRequirement[];
 };
-interface KnowledgeAttachment {
-  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
-  authorization?: KnowledgeAttachmentAuthorization;
-  id: string;
-  sourceId: string;
-  sandboxId: string;
-  generation: string;
-  status: "active" | "detached";
+/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
+ *  revealed only at mint/rotate time (only the hash is stored). */
+interface HubWorkflowHookEndpoint {
+  url: string;
+  token?: string;
 }
-interface KnowledgeSourceCreate {
-  requestId: string;
-  name: string;
-  source: KnowledgeSourceInput;
-  target?: {
-    kind: "lexical";
-  } | {
-    kind: "managed-vector";
-    provider: "qdrant";
-    connectionId: string;
-    embedding: KnowledgeEmbeddingSpace;
-  };
+interface HubWorkflowHookToken {
+  url: string;
+  token: string;
 }
-/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
-interface KnowledgeAuthorization {
-  userId: string;
-  clientId: string;
-  resource: string;
-  scopes: Array<"knowledge:read" | "knowledge:write">;
+//#endregion
+//#region src/workflow-storage-types.d.ts
+/** One KV entry with its metadata — the get/put/cas response shape. */
+interface HubWorkflowKvEntry {
+  key: string;
+  value: unknown;
+  version: number;
+  updatedAt: string;
 }
-declare class HubKnowledgeManagementClient {
-  private readonly request;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  materialize(input: {
-    sandboxId: string;
-    references: KnowledgeReference[];
-  }): Promise<KnowledgeAttachment[]>;
-  authorization(): Promise<KnowledgeAuthorization>;
-  disconnectAuthorization(): Promise<{
-    revoked: true;
-  }>;
-  capabilities(): Promise<KnowledgeCapabilities>;
-  list(): Promise<KnowledgeSourceSummary[]>;
-  get(sourceId: string): Promise<KnowledgeSourceSummary>;
-  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
-  refresh(sourceId: string, input: {
-    requestId: string;
-    approvalToken?: string;
-  }): Promise<KnowledgeSourceSummary>;
-  attach(sourceId: string, input: {
-    sandboxId: string;
-    generation: string;
-    expectedGeneration?: string;
-  }): Promise<KnowledgeAttachment>;
-  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
-  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+/** Keyspace metadata row (never the value) — the list response's entry. */
+interface HubWorkflowKvEntryMeta {
+  key: string;
+  version: number;
+  updatedAt: string;
 }
-//#endregion
-//#region src/knowledge.d.ts
-interface HubKnowledgeRetrievalResult {
-  attachmentId: string;
-  generation: string;
-  provenance: "ingested" | "record-supplied";
-  hits: Array<{
-    id: string;
-    title: string;
-    snippet: string;
-    score?: number;
-    citations?: Array<{
-      sourceId: string;
-      sourceUri: string;
-      revision?: string;
-    }>;
-  }>;
-  elapsedMs?: number;
+interface HubWorkflowKvListResponse {
+  entries: HubWorkflowKvEntryMeta[];
 }
-interface HubKnowledgeQueryResult {
-  results: HubKnowledgeRetrievalResult[];
-  /** Individual unavailable sources do not hide evidence from healthy sources. */
-  failures: Array<{
-    attachmentId: string;
-    code: string;
-    message: string;
-  }>;
-  partial: boolean;
+interface HubWorkflowKvDeleteResponse {
+  deleted: boolean;
 }
-/** Runtime-only retrieval. The authenticated sandbox credential determines the
- * scope on the server; neither a caller nor an agent can supply another scope. */
-declare class HubKnowledgeClient {
-  private readonly request;
-  readonly management: HubKnowledgeManagementClient;
-  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
-  bindings(): Promise<{
-    references: KnowledgeReference[];
-  }>;
-  query(input: {
-    query: string;
-    limit?: number;
-    expectedReferences?: KnowledgeReference[];
-  }, options?: {
-    signal?: AbortSignal;
-  }): Promise<HubKnowledgeQueryResult>;
+/** The opaque ref a stored artifact is referred to by — the value a
+ *  script.run node returns as its step output. */
+interface HubWorkflowArtifactRef {
+  $artifact: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  preview: string | null;
+}
+/** Artifact metadata (never the bytes), oldest first on the list response. */
+interface HubWorkflowArtifact {
+  id: string;
+  runId: string;
+  workflowId: string;
+  /** The graph node (or `step-N` positional id on linear runs) whose action
+   *  emitted the artifact. */
+  nodeId: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  /** First 2KiB of textual content; null for binary content types. */
+  preview: string | null;
+  createdAt: string;
+}
+interface HubWorkflowArtifactsResponse {
+  artifacts: HubWorkflowArtifact[];
+}
+/** Raw artifact bytes from the download route, with their stored content type. */
+interface HubWorkflowArtifactDownload {
+  bytes: Uint8Array;
+  contentType: string;
 }
 //#endregion
 //#region src/lines.d.ts
@@ -2118,7 +2093,7 @@ declare class HubManagedNumbersClient {
   private post;
 }
 //#endregion
-//#region src/client.d.ts
+//#region src/transport.d.ts
 type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
 interface HubClientOptions {
   baseUrl: string;
@@ -2134,76 +2109,46 @@ declare class HubSdkError extends Error {
     status?: number;
   });
 }
-declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
-declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
-declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
-type HubEnv = Record<string, string | undefined>;
-interface HubClientFromEnvOptions {
-  env?: HubEnv;
-  apiKey?: string;
-  authHeaders?: HubAuthHeaders;
-  fetch?: typeof fetch;
-}
-declare function resolveHubBaseUrl(env?: HubEnv): string;
-declare function resolveHubAuth(env?: HubEnv): string;
 declare class HubTransport {
+  #private;
   readonly baseUrl: string;
   readonly fetch: typeof fetch;
-  readonly apiKey?: string;
   readonly authHeaders?: HubAuthHeaders;
   constructor(options: HubClientOptions);
+  /** The API key this client authenticates with, when it has one. */
+  get apiKey(): string | undefined;
   protected request<TData>(path: string, init: RequestInit, options?: {
     auth?: "client" | "caller";
     validateData?: (data: unknown) => data is TData;
   }): Promise<TData>;
   protected buildHeaders(headers: HeadersInit | undefined, callerAuth?: boolean): Promise<Headers>;
 }
-declare class HubClient extends HubTransport {
-  readonly knowledge: HubKnowledgeClient;
-  readonly allowances: HubAllowancesClient;
-  readonly apps: HubAppsClient;
-  readonly connections: HubConnectionsClient;
-  readonly channels: HubChannelsClient;
-  readonly numbers: HubManagedNumbersClient;
-  readonly eventSubscriptions: HubEventSubscriptionsClient;
-  readonly permissions: HubPermissionsClient;
-  readonly tokens: HubTokensClient;
-  readonly tools: HubToolsClient;
-  readonly approvals: HubApprovalsClient;
-  readonly audit: HubAuditClient;
-  readonly githubApp: HubGithubAppClient;
-  readonly workflows: HubWorkflowsClient;
-  readonly lines: HubLinesClient;
-  constructor(options: HubClientOptions);
-  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
-  status(): Promise<HubStatusResponse>;
-  /**
-   * Open a streaming (Server-Sent Events) response and return its raw body.
-   * Shares auth-header building + `fetch` with {@link request}, but does NOT
-   * buffer or JSON-parse the body — the caller consumes the stream.
-   *
-   * A successful stream comes back as `text/event-stream`. Anything else is an
-   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
-   * page); it is surfaced the same way {@link request} surfaces errors — a
-   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
-   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
-   */
-  private stream;
-  /**
-   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
-   * the artifact's own content type, not JSON. Error responses on such routes
-   * are still the standard envelope, so a failure surfaces exactly like
-   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
-   * otherwise an `HUB_HTTP_<status>` transport error.
-   */
-  private requestBytes;
+/** Domain clients receive the existing envelope transport as one request function. */
+type HubRequest = <TData>(path: string, init: RequestInit) => Promise<TData>;
+type HubStreamRequest = (path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>;
+type HubArtifactRequest = (path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>;
+//#endregion
+//#region src/environment.d.ts
+declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
+declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
+declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
+type HubEnv = Record<string, string | undefined>;
+interface HubClientFromEnvOptions {
+  env?: HubEnv;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
 }
+declare function resolveHubBaseUrl(env?: HubEnv): string;
+declare function resolveHubAuth(env?: HubEnv): string;
+//#endregion
+//#region src/authorization.d.ts
 interface HubTokenListOptions {
   includeExpired?: boolean;
 }
 declare class HubTokensClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mint(options: {
     actionPath: string;
     connectionId?: string;
@@ -2215,7 +2160,7 @@ declare class HubTokensClient {
 }
 declare class HubPermissionsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(connectionId: string): Promise<HubPolicyListResponse>;
   set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse>;
   /** Reset an action to its default by deleting any stored override. */
@@ -2228,6 +2173,15 @@ declare class HubPermissionsClient {
    *  connection. Manual per-action decisions are left intact. */
   revertWrites(connectionId: string): Promise<HubRevertWritesResponse>;
 }
+declare class HubApprovalsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubApprovalListResponse>;
+  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+}
+//#endregion
+//#region src/tools.d.ts
 interface HubToolSearchOptions {
   provider?: string;
   /** Max tools to return. The server defaults to a relevance-ranked shortlist
@@ -2251,7 +2205,7 @@ interface HubToolInvokeOptions {
 }
 declare class HubToolsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
   sources(): Promise<HubToolSourcesResponse>;
   describe(path: string): Promise<HubToolsDescribeResponse>;
@@ -2263,6 +2217,60 @@ declare class HubToolsClient {
   invoke<TResult = unknown>(path: string, raw: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
   private buildExecInit;
 }
+//#endregion
+//#region src/inbound-webhooks.d.ts
+/** Provider setup uses the existing authenticated Hub transport and vault. */
+interface HubInboundWebhookCreateOptions {
+  /** Inkbox identity that owns all selected channels. */
+  identityId?: string;
+  mailboxId?: string;
+  phoneNumberId?: string;
+  imessage?: boolean;
+  /** Linq: explicit owned lines; omitted does not mean every account line. */
+  phoneNumbers?: string[];
+  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
+  phoneNumberIds?: string[];
+  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
+  signingSecret?: string;
+}
+interface HubInboundWebhookCreateResponse {
+  url: string;
+  /** True only when the provider subscription was created by the server. */
+  provisioned?: boolean;
+  /** Self-configured legacy providers can return a newly minted secret once. */
+  secret?: string;
+  inboundAddress?: string;
+  requiresProviderSetup?: boolean;
+}
+interface HubInboundWebhookStatus {
+  configured: boolean;
+  url?: string;
+  /** Configuration is not evidence of a real delivered message. */
+  deliveryVerified: false;
+  requiresProviderSetup?: boolean;
+}
+/** Live provider readback for one explicitly selected Linq WhatsApp number. */
+interface HubInboundPhoneNumberScope {
+  configured: true;
+  provisioned: true;
+  subscribed: true;
+  phoneNumberIds: string[];
+}
+declare class HubInboundWebhooksClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
+  get(connectionId: string): Promise<HubInboundWebhookStatus>;
+  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
+  /** Remove event subscriptions first. This does not silently rotate a live URL. */
+  delete(connectionId: string): Promise<{
+    removed: boolean;
+  }>;
+  private path;
+}
+//#endregion
+//#region src/connections.d.ts
 interface HubConnectionStartOptions {
   returnUrl?: string;
   cli?: boolean;
@@ -2270,24 +2278,10 @@ interface HubConnectionStartOptions {
   /** GitHub accepts the exact read:user, repo, read:org set. */
   requestedScopes?: readonly string[];
 }
-declare class HubChannelsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubChannelsResponse>;
-  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
-  delete(channelId: string): Promise<HubChannelDeleteResponse>;
-}
-declare class HubEventSubscriptionsClient {
-  private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubEventSubscriptionsResponse>;
-  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
-  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
-}
 declare class HubConnectionsClient {
   private readonly request;
   readonly inboundWebhook: HubInboundWebhooksClient;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(): Promise<HubConnectionsResponse>;
   /** Connector catalog: every provider the hub can expose, each flagged with
    *  `configured` (whether its OAuth app credentials are wired). Callers render
@@ -2305,16 +2299,27 @@ declare class HubConnectionsClient {
   revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
   health(connectionId: string): Promise<HubConnectionHealthResponse>;
 }
-declare class HubApprovalsClient {
+//#endregion
+//#region src/channels.d.ts
+declare class HubChannelsClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
-  list(): Promise<HubApprovalListResponse>;
-  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
-  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  constructor(request: HubRequest);
+  list(): Promise<HubChannelsResponse>;
+  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
+  delete(channelId: string): Promise<HubChannelDeleteResponse>;
+}
+declare class HubEventSubscriptionsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubEventSubscriptionsResponse>;
+  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
+  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
 }
+//#endregion
+//#region src/github-app.d.ts
 declare class HubGithubAppClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   mintInstallationToken(input: HubGithubAppMintInstallationTokenRequest): Promise<HubGithubAppMintInstallationTokenResponse>;
   /** Every installation the caller may act through — their own and any org's
    *  they were verified against. The management surface's read. */
@@ -2336,16 +2341,20 @@ declare class HubGithubAppClient {
     repo: string;
   }): Promise<HubGithubAppIsRepoInstalledResponse>;
 }
+//#endregion
+//#region src/audit.d.ts
 declare class HubAuditClient {
   private readonly request;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>);
+  constructor(request: HubRequest);
   list(options?: HubAuditListRequest): Promise<HubAuditResponse>;
 }
+//#endregion
+//#region src/workflows.d.ts
 declare class HubWorkflowsClient {
   private readonly request;
   private readonly stream?;
   private readonly download?;
-  constructor(request: <TData>(path: string, init: RequestInit) => Promise<TData>, stream?: ((path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>) | undefined, download?: ((path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>) | undefined);
+  constructor(request: HubRequest, stream?: HubStreamRequest | undefined, download?: HubArtifactRequest | undefined);
   list(): Promise<HubWorkflow[]>;
   /**
    * Owner-wide fleet overview: one row per workflow with its run tallies over
@@ -2393,8 +2402,9 @@ declare class HubWorkflowsClient {
    * `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
    * workflow that reads no trigger fields. Throws `HubSdkError`:
    * `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
-   * names them), `WORKFLOW_DISABLED` when the workflow is paused, `NOT_FOUND`
-   * for an unknown/foreign id. Pass `opts.signal` to abort a slow request.
+   * names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+   * still runs once; pausing only stops its triggers. Pass `opts.signal` to
+   * abort a slow request.
    */
   run(id: string, inputs?: HubWorkflowRunInputs, opts?: {
     signal?: AbortSignal;
@@ -2429,8 +2439,8 @@ declare class HubWorkflowsClient {
    * follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
    * other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
    * terminal-failed/cancelled (queued/running/waiting, or succeeded),
-   * `WORKFLOW_DISABLED` when the workflow has since been disabled, `NOT_FOUND`
-   * for an unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+   * `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+   * failure still retries. Pass `opts.signal` to abort a slow request.
    */
   retryRun(id: string, runId: string, opts?: {
     signal?: AbortSignal;
@@ -2650,6 +2660,48 @@ declare class HubWorkflowsClient {
   schema(): Promise<HubWorkflowSchemaResponse>;
 }
 //#endregion
+//#region src/client.d.ts
+declare class HubClient extends HubTransport {
+  readonly knowledge: HubKnowledgeClient;
+  readonly allowances: HubAllowancesClient;
+  readonly apps: HubAppsClient;
+  readonly connections: HubConnectionsClient;
+  readonly channels: HubChannelsClient;
+  readonly numbers: HubManagedNumbersClient;
+  readonly eventSubscriptions: HubEventSubscriptionsClient;
+  readonly permissions: HubPermissionsClient;
+  readonly tokens: HubTokensClient;
+  readonly tools: HubToolsClient;
+  readonly approvals: HubApprovalsClient;
+  readonly audit: HubAuditClient;
+  readonly githubApp: HubGithubAppClient;
+  readonly workflows: HubWorkflowsClient;
+  readonly lines: HubLinesClient;
+  constructor(options: HubClientOptions);
+  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
+  status(): Promise<HubStatusResponse>;
+  /**
+   * Open a streaming (Server-Sent Events) response and return its raw body.
+   * Shares auth-header building + `fetch` with {@link request}, but does NOT
+   * buffer or JSON-parse the body — the caller consumes the stream.
+   *
+   * A successful stream comes back as `text/event-stream`. Anything else is an
+   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+   * page); it is surfaced the same way {@link request} surfaces errors — a
+   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+   */
+  private stream;
+  /**
+   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+   * the artifact's own content type, not JSON. Error responses on such routes
+   * are still the standard envelope, so a failure surfaces exactly like
+   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+   * otherwise an `HUB_HTTP_<status>` transport error.
+   */
+  private requestBytes;
+}
+//#endregion
 //#region src/event-delivery.d.ts
 type HubEventSignatureFailure = "missing" | "malformed" | "stale" | "mismatch";
 type HubEventSignatureResult = {
@@ -2889,5 +2941,5 @@ declare class HubLineGrantsClient extends HubTransport {
 //#region src/redaction.d.ts
 declare function redactHubValue(value: unknown): unknown;
 //#endregion
-export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubAllowanceDecision, type HubAllowanceGrant, type HubAllowancePlan, type HubAllowancePlanInput, type HubAllowanceRole, type HubAllowanceSubject, type HubAllowanceSyncInput, type HubAllowanceSyncReceipt, type HubAllowanceTier, type HubAllowanceUsage, HubAllowancesClient, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApiKeyConnectionMetadata, type HubApp, HubAppBrokerClient, type HubAppBrokerExchange, type HubAppBrokerOptions, type HubAppBrokerToken, type HubAppComplianceClaim, type HubAppComplianceState, type HubAppCreateInput, type HubAppGrant, type HubAppGrantRevoked, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAppsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppDisconnectResponse, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListInstallationsResponse, type HubGithubAppListReposResponse, type HubGithubAppManagedInstallation, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubGithubAppSyncResponse, type HubGithubAppSyncedInstallation, type HubInboundPhoneNumberScope, type HubInboundWebhookCreateOptions, type HubInboundWebhookCreateResponse, type HubInboundWebhookStatus, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, type HubKnowledgeQueryResult, type HubKnowledgeRetrievalResult, type HubLineApplicationDispatchCurrentInput, type HubLineCheckinOptions, type HubLineContext, type HubLineGrant, type HubLineGrantApplicationSelection, type HubLineGrantAttachInput, type HubLineGrantAttachment, type HubLineGrantBinding, type HubLineGrantLine, type HubLineGrantMemberApplication, type HubLineGrantMessage, type HubLineGrantSelectApplicationInput, type HubLineGrantThread, HubLineGrantsClient, type HubLineImage, type HubLineMember, type HubLineMemberApplication, type HubLineMemberApplicationInput, type HubLineOwnerSendInput, type HubLineProviderDelivery, type HubLineReminderInput, type HubLineReminderReceipt, type HubLineReplyCode, type HubLineReplyCodeInput, type HubLineScheduledSendOptions, type HubLineSendInput, type HubLineSendReceipt, HubLinesClient, HubManagedNumbersClient, type HubManualRunInput, type HubNumberListQuery, type HubNumberOrder, type HubNumberOrderPage, type HubNumberQuote, type HubNumberReadiness, type HubNumberResolution, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthConnectionParameter, type HubOAuthStartRequest, type HubOAuthStartResponse, type HubOwnerAskSendInput, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowAgentStep, type HubWorkflowArtifact, type HubWorkflowArtifactDownload, type HubWorkflowArtifactRef, type HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, type HubWorkflowConnectionRequirement, type HubWorkflowDecision, type HubWorkflowDecisionOnTimeout, type HubWorkflowDecisionResolveResult, type HubWorkflowDecisionResolvedVia, type HubWorkflowDecisionStatus, type HubWorkflowDistillationCandidate, type HubWorkflowEdgeVerdicts, type HubWorkflowEventFilter, type HubWorkflowFailureCluster, type HubWorkflowFleetEntry, type HubWorkflowFleetInsights, type HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, type HubWorkflowHealth, type HubWorkflowHookEndpoint, type HubWorkflowHookToken, type HubWorkflowKvDeleteResponse, type HubWorkflowKvEntry, type HubWorkflowKvEntryMeta, type HubWorkflowKvListResponse, type HubWorkflowNodeHealth, type HubWorkflowOnErrorOutcome, type HubWorkflowPendingDecision, type HubWorkflowPendingDecisionsResponse, type HubWorkflowProposal, type HubWorkflowProposalInput, type HubWorkflowRevision, type HubWorkflowRevisionMeta, type HubWorkflowRevisionSource, type HubWorkflowRevisionStatus, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunRetried, type HubWorkflowRunStatus, type HubWorkflowRunStepsPage, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTemplate, type HubWorkflowTemplateCategory, type HubWorkflowTemplateInstantiateResult, type HubWorkflowTemplateParameter, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, KnowledgeAttachment, KnowledgeAttachmentAuthorization, KnowledgeAuthorization, KnowledgeCapabilities, KnowledgeCapability, KnowledgeEmbeddingSpace, KnowledgeReference, KnowledgeSourceCreate, KnowledgeSourceInput, KnowledgeSourceSummary, type VerifyHubEventSignatureInput, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature };
+export { type AuthenticateHubEventRequestInput, type DeriveHubEventCallbackSecretInput, HUB_API_KEY_ENV_VAR, HUB_CAPABILITY_TOKEN_ENV_VAR, HUB_URL_ENV_VAR, type HubAgentIterationSpan, type HubAgentRunDetail, type HubAllowanceDecision, type HubAllowanceGrant, type HubAllowancePlan, type HubAllowancePlanInput, type HubAllowanceRole, type HubAllowanceSubject, type HubAllowanceSyncInput, type HubAllowanceSyncReceipt, type HubAllowanceTier, type HubAllowanceUsage, HubAllowancesClient, type HubApiKeyConnectRequest, type HubApiKeyConnectResponse, type HubApiKeyConnectionMetadata, type HubApp, HubAppBrokerClient, type HubAppBrokerExchange, type HubAppBrokerOptions, type HubAppBrokerToken, type HubAppComplianceClaim, type HubAppComplianceState, type HubAppCreateInput, type HubAppGrant, type HubAppGrantRevoked, type HubApproval, type HubApprovalCapabilityToken, type HubApprovalDecisionResponse, type HubApprovalStatus, HubApprovalsClient, HubAppsClient, HubAuditClient, type HubAuditEvent, type HubAuditListRequest, type HubAuditResponse, type HubAuthHeaders, type HubCapabilityToken, type HubChannel, type HubChannelCreateResponse, type HubChannelDeleteResponse, HubChannelsClient, type HubChannelsResponse, HubClient, type HubClientFromEnvOptions, type HubClientOptions, type HubConnection, type HubConnectionDeleteRequest, type HubConnectionDeleteResponse, type HubConnectionHealthError, type HubConnectionHealthInfo, type HubConnectionHealthRequest, type HubConnectionHealthResponse, type HubConnectionHealthStatus, type HubConnectionStartOptions, HubConnectionsClient, type HubConnectionsResponse, type HubEmailChannel, type HubEmailChannelCreateRequest, type HubEnv, type HubEnvelope, type HubErrorBody, type HubErrorCode, type HubErrorEnvelope, type HubEventCondition, type HubEventConditionScalar, type HubEventDelivery, HubEventDeliveryError, type HubEventRequestFailureCode, type HubEventRequestResult, type HubEventSignatureFailure, type HubEventSignatureResult, type HubEventSubscription, type HubEventSubscriptionCallback, type HubEventSubscriptionCreateRequest, type HubEventSubscriptionCreateResponse, type HubEventSubscriptionDeleteResponse, type HubEventSubscriptionFilter, type HubEventSubscriptionSource, HubEventSubscriptionsClient, type HubEventSubscriptionsResponse, type HubExecRequest, type HubExecResponse, HubGithubAppClient, type HubGithubAppDisconnectResponse, type HubGithubAppInstallation, type HubGithubAppInstallationResponse, type HubGithubAppIsRepoInstalledRequest, type HubGithubAppIsRepoInstalledResponse, type HubGithubAppListInstallationsResponse, type HubGithubAppListReposResponse, type HubGithubAppManagedInstallation, type HubGithubAppMintInstallationTokenRequest, type HubGithubAppMintInstallationTokenResponse, type HubGithubAppSyncResponse, type HubGithubAppSyncedInstallation, type HubInboundPhoneNumberScope, type HubInboundWebhookCreateOptions, type HubInboundWebhookCreateResponse, type HubInboundWebhookStatus, HubInboundWebhooksClient, HubKnowledgeClient, HubKnowledgeManagementClient, type HubKnowledgeQueryResult, type HubKnowledgeRetrievalResult, type HubLineApplicationDispatchCurrentInput, type HubLineCheckinOptions, type HubLineContext, type HubLineGrant, type HubLineGrantApplicationSelection, type HubLineGrantAttachInput, type HubLineGrantAttachment, type HubLineGrantBinding, type HubLineGrantLine, type HubLineGrantMemberApplication, type HubLineGrantMessage, type HubLineGrantSelectApplicationInput, type HubLineGrantThread, HubLineGrantsClient, type HubLineImage, type HubLineMember, type HubLineMemberApplication, type HubLineMemberApplicationInput, type HubLineOwnerSendInput, type HubLineProviderDelivery, type HubLineReminderInput, type HubLineReminderReceipt, type HubLineReplyCode, type HubLineReplyCodeInput, type HubLineScheduledSendOptions, type HubLineSendInput, type HubLineSendReceipt, HubLinesClient, HubManagedNumbersClient, type HubManualRunInput, type HubNumberListQuery, type HubNumberOrder, type HubNumberOrderPage, type HubNumberQuote, type HubNumberReadiness, type HubNumberResolution, type HubOAuthCallbackErrorQuery, type HubOAuthCallbackQuery, type HubOAuthCallbackResponse, type HubOAuthCallbackSuccessQuery, type HubOAuthConnectionParameter, type HubOAuthStartRequest, type HubOAuthStartResponse, type HubOwnerAskSendInput, HubPermissionsClient, type HubPolicy, type HubPolicyDecision, type HubPolicyDeleteRequest, type HubPolicyDeleteResponse, type HubPolicyListRequest, type HubPolicyListResponse, type HubPolicyResponse, type HubPolicyUpdateRequest, type HubPrincipal, type HubPrincipalKind, type HubProvider, type HubProviderAuthKind, type HubProviderEvent, type HubProvidersResponse, HubSdkError, type HubStatusConnections, type HubStatusResponse, type HubSuccessEnvelope, type HubTokenListOptions, type HubTokenMintRequest, type HubTokenMintResponse, type HubTokenRevokeResponse, HubTokensClient, type HubTokensListResponse, type HubTool, type HubToolInvokeOptions, type HubToolRisk, type HubToolSearchOptions, type HubToolSource, type HubToolSourcesResponse, HubToolsClient, type HubToolsDescribeRequest, type HubToolsDescribeResponse, type HubToolsSearchRequest, type HubToolsSearchResponse, type HubUnimplementedErrorEnvelope, type HubWhatsappEmbeddedSignupCompleteRequest, type HubWhatsappEmbeddedSignupCompleteResponse, type HubWhatsappEmbeddedSignupStartRequest, type HubWhatsappEmbeddedSignupStartResponse, type HubWorkflow, type HubWorkflowAction, type HubWorkflowActionResult, type HubWorkflowAgentStep, type HubWorkflowArtifact, type HubWorkflowArtifactDownload, type HubWorkflowArtifactRef, type HubWorkflowArtifactsResponse, type HubWorkflowCondition, type HubWorkflowConditionOp, type HubWorkflowConditionScalar, type HubWorkflowConnectionRequirement, type HubWorkflowDecision, type HubWorkflowDecisionOnTimeout, type HubWorkflowDecisionResolveResult, type HubWorkflowDecisionResolvedVia, type HubWorkflowDecisionStatus, type HubWorkflowDistillationCandidate, type HubWorkflowEdgeVerdicts, type HubWorkflowEventFilter, type HubWorkflowFailureCluster, type HubWorkflowFleetEntry, type HubWorkflowFleetInsights, type HubWorkflowFleetWindow, type HubWorkflowGraphEdge, type HubWorkflowGraphJoinRule, type HubWorkflowGraphNode, type HubWorkflowGraphSpec, type HubWorkflowHealth, type HubWorkflowHookEndpoint, type HubWorkflowHookToken, type HubWorkflowKvDeleteResponse, type HubWorkflowKvEntry, type HubWorkflowKvEntryMeta, type HubWorkflowKvListResponse, type HubWorkflowNodeHealth, type HubWorkflowOnErrorOutcome, type HubWorkflowPendingDecision, type HubWorkflowPendingDecisionsResponse, type HubWorkflowProposal, type HubWorkflowProposalInput, type HubWorkflowRevision, type HubWorkflowRevisionMeta, type HubWorkflowRevisionSource, type HubWorkflowRevisionStatus, type HubWorkflowRun, type HubWorkflowRunCancelResult, type HubWorkflowRunDetail, type HubWorkflowRunEnqueued, type HubWorkflowRunInputs, type HubWorkflowRunRetried, type HubWorkflowRunStatus, type HubWorkflowRunStepsPage, type HubWorkflowRunStreamEvent, type HubWorkflowRunSummary, type HubWorkflowRunsPage, type HubWorkflowSchemaResponse, type HubWorkflowTemplate, type HubWorkflowTemplateCategory, type HubWorkflowTemplateInstantiateResult, type HubWorkflowTemplateParameter, type HubWorkflowTrigger, type HubWorkflowValidateResponse, type HubWorkflowValidationError, HubWorkflowsClient, KnowledgeAttachment, KnowledgeAttachmentAuthorization, KnowledgeAuthorization, KnowledgeCapabilities, KnowledgeCapability, KnowledgeEmbeddingSpace, KnowledgeReference, KnowledgeSourceCreate, KnowledgeSourceInput, KnowledgeSourceSummary, type VerifyHubEventSignatureInput, approveKnowledgeSource, authenticateHubEventRequest, deriveHubEventCallbackSecret, parseHubEventDelivery, redactHubValue, resolveHubAuth, resolveHubBaseUrl, verifyHubEventSignature, workflowConnectionRequirementKey };
 //# sourceMappingURL=index.d.ts.map