@tangle-network/hub-sdk 1.0.4 → 1.0.5

package/dist/client-BH3gTLjN.d.ts

@@ -0,0 +1,2571 @@
+//#region src/allowances.d.ts
+/**
+ * Allowances: a developer's per-member daily allowance on a meter, and the
+ * paywall decision past it. The platform counts every admitted turn and reads
+ * each payer's dollars from the ledger; the app keeps only its checkout and
+ * records a paying member with {@link HubAllowancesClient.grant}.
+ *
+ * Only the meter's owner may call these, signed in or with a root API key of
+ * their own. A delegated or resource-bound key, such as the key a hosted end
+ * user's sandbox runs on, is refused.
+ */
+type HubAllowanceTier = "free" | "paid" | "owner";
+type HubAllowanceRole = "owner" | "member";
+interface HubAllowancePlanInput {
+  free: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+  };
+  /** Null turns billing off: past the free allowance nothing lifts the limit. */
+  paid: {
+    turnsPerDay: number;
+    usdPerDay: number | null;
+    priceUsdMonthly: number;
+  } | null;
+  owner?: {
+    turnsPerDay: number;
+  };
+  /** Key resource type whose ledger spend counts against a payer's dollars. */
+  spendResourceType: string | null;
+}
+interface HubAllowancePlan extends HubAllowancePlanInput {
+  meter: string;
+  owner: {
+    turnsPerDay: number;
+  };
+  /** False while the meter runs on the default plan. */
+  configured: boolean;
+  updatedAt: string | null;
+}
+interface HubAllowanceSubject {
+  member: string;
+  role?: HubAllowanceRole;
+  /** The member whose keys pay for the turn, when that is someone else. */
+  payer?: string;
+  payerRole?: HubAllowanceRole;
+}
+interface HubAllowanceDecision {
+  /** `paywall`: paying lifts the limit. `allowance_reached`: nothing does today. */
+  decision: "admit" | "paywall" | "allowance_reached";
+  tier: HubAllowanceTier;
+  paywall: boolean;
+  turns: {
+    used: number;
+    limit: number;
+  };
+  usd: {
+    spent: number;
+    limit: number;
+    remaining: number;
+  } | null;
+  day: string;
+  resetsAt: string;
+  /**
+   * A paying payer's spend in the current paid period against what funds it:
+   * the plan price less Tangle's 10% fee, plus the free daily allowance for
+   * the period. A paid turn is refused once `remaining` is gone.
+   */
+  period?: {
+    spent: number;
+    funded: number;
+    remaining: number;
+    startsAt: string;
+    endsAt: string;
+  };
+  replay?: boolean;
+}
+interface HubAllowanceUsage {
+  day: string;
+  turns: number;
+  members: Array<{
+    member: string;
+    turns: number;
+    tier: HubAllowanceTier;
+    usdSpent: number | null;
+  }>;
+  lines: Array<{
+    line: string;
+    turns: number;
+  }>;
+}
+interface HubAllowanceSyncInput {
+  source: string;
+  revision: number;
+  expiresAt: string | null;
+  reference: string | null;
+}
+interface HubAllowanceSyncReceipt extends HubAllowanceSyncInput {
+  member: string;
+}
+interface HubAllowanceGrant {
+  member: string;
+  tier: "paid";
+  expiresAt: string;
+  reference: string | null;
+}
+declare class HubAllowancesClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  plan(meter: string): Promise<HubAllowancePlan>;
+  setPlan(meter: string, plan: HubAllowancePlanInput): Promise<HubAllowancePlan>;
+  /** Admit one turn or refuse it. Retrying the same `turnId` never counts twice. */
+  admit(meter: string, input: HubAllowanceSubject & {
+    turnId: string;
+    line?: string;
+    channel?: string;
+  }): Promise<HubAllowanceDecision>;
+  /** What the member's next turn would get, without counting anything. */
+  status(meter: string, subject: HubAllowanceSubject): Promise<HubAllowanceDecision>;
+  /** Move a member to the paid allowance until `expiresAt` (the paid period's end). */
+  grant(meter: string, member: string, input: {
+    expiresAt: string;
+    reference?: string | null;
+  }): Promise<HubAllowanceGrant>;
+  /** Synchronize a paid grant by durable product revision. Null expiry writes
+   * a retained revocation. A delayed older update is refused, never reactivated.
+   * There is no fallback to the unversioned grant endpoint on older servers. */
+  syncGrant(meter: string, member: string, input: HubAllowanceSyncInput): Promise<HubAllowanceSyncReceipt>;
+  revoke(meter: string, member: string): Promise<void>;
+  /** Turns per member and per line on one UTC day (default today). */
+  usage(meter: string, day?: string): Promise<HubAllowanceUsage>;
+  private path;
+  private memberPath;
+  private body;
+}
+//#endregion
+//#region src/apps.d.ts
+/** The compliance claim an owner latches through a BAA acceptance. Positive
+ * claims only: `{ hipaa: true }` or absent — `hipaa: false` is unspellable. */
+interface HubAppComplianceClaim {
+  hipaa: true;
+}
+/** Owner-facing compliance state: the latched claim and the acceptance behind it. */
+interface HubAppComplianceState {
+  compliance: HubAppComplianceClaim | null;
+  agreement: {
+    version: string;
+    url: string;
+  } | null;
+  acceptance: {
+    agreementVersion: string;
+    agreementUrl: string;
+    acceptedByUserId: string;
+    acceptedAt: string;
+  } | null;
+}
+/** App identity and customer permissions over the existing Platform transport.
+ * These operations do not authorize spending or expose upstream credentials. */
+interface HubApp {
+  id: string;
+  clientId: string;
+  oauthClientId: string | null;
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl: string | null;
+  accessPayer?: "user" | "app-owner";
+  /** Latched HIPAA declaration; absent or null means "no claim". */
+  compliance?: HubAppComplianceClaim | null;
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubAppCreateInput {
+  name: string;
+  redirectUris: string[];
+  allowedScopes: string[];
+  homepageUrl?: string;
+  /** The registered app owner funds eligibility; customer permissions remain separate. */
+  accessPayer?: "user" | "app-owner";
+  /** Associate an existing owned login client in the same transaction as creation. */
+  oauthClientId?: string;
+}
+interface HubAppGrant {
+  id: string;
+  appId: string;
+  userId: string;
+  connectionId: string;
+  scopes: string[];
+  status: "active" | "revoked";
+  createdAt: string;
+  updatedAt: string;
+  revokedAt: string | null;
+  /** Display metadata is additive; older deployments may omit it. */
+  appName?: string | null;
+  oauthClientId?: string | null;
+  providerId?: string | null;
+  accountDisplay?: string | null;
+  connectionDisplayName?: string | null;
+}
+interface HubAppGrantRevoked {
+  grantId: string;
+  status: "revoked";
+  revokedAt: string | null;
+  tokensRevoked: number;
+}
+declare class HubAppsClient {
+  private readonly request;
+  readonly grants: {
+    list: () => Promise<HubAppGrant[]>;
+    revoke: (grantId: string) => Promise<HubAppGrantRevoked>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  list(): Promise<HubApp[]>;
+  /** The secret is returned only by creation; keep it in your server vault. */
+  create(input: HubAppCreateInput): Promise<{
+    app: HubApp;
+    clientSecret: string;
+  }>;
+  /** Immutable association of two existing records with the same owner. */
+  linkOAuthClient(appId: string, clientId: string): Promise<{
+    appId: string;
+    oauthClientId: string;
+  }>;
+  revoke(appId: string): Promise<{
+    appId: string;
+    grantsRevoked: number;
+    tokensRevoked: number;
+  }>;
+  /** Current latched compliance state and the BAA acceptance behind it. */
+  getCompliance(appId: string): Promise<HubAppComplianceState>;
+  /**
+   * Latch HIPAA compliance for this app. The request MUST carry the exact
+   * `agreementVersion` the deployment currently offers — the acceptance is
+   * recorded before the claim exists, and the claim can never be cleared:
+   * `hipaa: false` on a latched app is a 409, on an unlatched app a no-op.
+   */
+  setCompliance(appId: string, input: {
+    hipaa: boolean;
+    agreementVersion?: string;
+  }): Promise<HubAppComplianceState>;
+}
+//#endregion
+//#region src/tool-types.d.ts
+interface HubToolSource {
+  sourceId: string;
+  providerId: string;
+  displayName: string;
+  toolCount: number;
+  connectionStatus: "connected" | "missing" | "unknown";
+  health: "healthy" | "unhealthy" | "rate_limited" | "unknown";
+  configured: boolean;
+}
+/** Per-tool catalog risk class. The first three mirror the platform's
+ *  `HubActionRisk`; `unknown` is surfaced honestly for tools the catalog can't
+ *  classify (substrate connectors). */
+type HubToolRisk = "read" | "write" | "destructive" | "unknown";
+interface HubTool {
+  path: string;
+  providerId?: string;
+  title?: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  connectionRequired?: boolean;
+  connectionStatus?: "connected" | "missing" | "unknown";
+  requiredConnectionProviderId?: string;
+  policyState?: "allow" | "ask" | "deny" | "unknown";
+  risk?: HubToolRisk;
+}
+interface HubToolSourcesResponse {
+  sources: HubToolSource[];
+}
+interface HubToolsSearchResponse {
+  tools: HubTool[];
+}
+interface HubToolsDescribeResponse {
+  tool: HubTool;
+}
+interface HubExecResponse<TResult = unknown> {
+  result: TResult;
+  /** True when the result was replayed from a previous call with the same
+   *  idempotency key, so the action did not run again. */
+  replayed?: boolean;
+}
+//#endregion
+//#region src/knowledge-management.d.ts
+interface KnowledgeReference {
+  sourceId: string;
+  generation: string;
+}
+/** Connection references only. Provider credentials never enter this contract. */
+interface KnowledgeEmbeddingSpace {
+  connectionId: string;
+  model: string;
+  dimensions: number;
+}
+type KnowledgeSourceInput = {
+  kind: "file";
+  name: string;
+  base64: string;
+  mediaType: string;
+} | {
+  kind: "git";
+  connectionId: string;
+  owner: string;
+  repo: string;
+  ref: string;
+  pathPrefix?: string;
+} | {
+  kind: "url";
+  url: string;
+} | {
+  kind: "s3";
+  connectionId: string;
+  bucket: string;
+  prefix: string;
+} | {
+  kind: "vector";
+  connectionId: string;
+  provider: "pinecone" | "qdrant" | "weaviate";
+  indexName: string;
+  namespace?: string;
+  embedding: KnowledgeEmbeddingSpace;
+  textField: string;
+  sourceUriField: string;
+};
+interface KnowledgeCapability {
+  supported: boolean;
+  reason?: string;
+}
+interface KnowledgeCapabilities {
+  delegation?: KnowledgeCapability & {
+    resource?: string;
+    scopes?: string[];
+  };
+  sources: Record<KnowledgeSourceInput["kind"], KnowledgeCapability>;
+  vectorProviders: Record<"pinecone" | "qdrant" | "weaviate", KnowledgeCapability>;
+  managedVector: KnowledgeCapability;
+  file: {
+    mediaTypes: string[];
+    maxBytes: number;
+    maxObjects: number;
+  };
+}
+interface KnowledgeSourceSummary {
+  /** Required query authorization, not proof that an owner policy currently permits it. */
+  retrieval?: {
+    kind: "lexical";
+  } | {
+    kind: "vector";
+    embeddingPolicy: {
+      connectionId: string;
+      actionPath: "openai.embeddings.create";
+      scope: "owner-connection-action";
+    };
+  };
+  id: string;
+  name: string;
+  kind: KnowledgeSourceInput["kind"];
+  status: "ready" | "refreshing" | "failed" | "awaiting-approval";
+  approval?: {
+    id: string;
+    path: string;
+    preview: {
+      provider: string;
+      connectionId: string;
+      collection: string;
+      sourceId: string;
+      requestId: string;
+      embedding: KnowledgeEmbeddingSpace;
+      chunkCount: number;
+      sourceCount: number;
+      dataSharing: string;
+    };
+  };
+  refreshRequestId?: string;
+  generation: string | null;
+  lastError: {
+    code: string;
+    message: string;
+  } | null;
+  updatedAt: string;
+}
+type KnowledgeAttachmentAuthorization = {
+  status: "active";
+} | {
+  status: "unavailable";
+  code: "APP_CONSENT_REVOKED" | "KEY_REVOKED" | "CONNECTION_UNAVAILABLE" | "ATTACHMENT_REVOKED" | "GENERATION_UNAVAILABLE" | "RUNTIME_AUTHORITY_REVOKED";
+};
+interface KnowledgeAttachment {
+  /** Snapshot of live grant/key/connection authority, separate from durable pin state. */
+  authorization?: KnowledgeAttachmentAuthorization;
+  id: string;
+  sourceId: string;
+  sandboxId: string;
+  generation: string;
+  status: "active" | "detached";
+}
+interface KnowledgeSourceCreate {
+  requestId: string;
+  name: string;
+  source: KnowledgeSourceInput;
+  target?: {
+    kind: "lexical";
+  } | {
+    kind: "managed-vector";
+    provider: "qdrant";
+    connectionId: string;
+    embedding: KnowledgeEmbeddingSpace;
+  };
+}
+/** Owner-only management. Runtime tools use HubKnowledgeClient.query instead. */
+interface KnowledgeAuthorization {
+  userId: string;
+  clientId: string;
+  resource: string;
+  scopes: Array<"knowledge:read" | "knowledge:write">;
+}
+declare class HubKnowledgeManagementClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  materialize(input: {
+    sandboxId: string;
+    references: KnowledgeReference[];
+  }): Promise<KnowledgeAttachment[]>;
+  authorization(): Promise<KnowledgeAuthorization>;
+  disconnectAuthorization(): Promise<{
+    revoked: true;
+  }>;
+  capabilities(): Promise<KnowledgeCapabilities>;
+  list(): Promise<KnowledgeSourceSummary[]>;
+  get(sourceId: string): Promise<KnowledgeSourceSummary>;
+  create(input: KnowledgeSourceCreate): Promise<KnowledgeSourceSummary>;
+  refresh(sourceId: string, input: {
+    requestId: string;
+    approvalToken?: string;
+  }): Promise<KnowledgeSourceSummary>;
+  attach(sourceId: string, input: {
+    sandboxId: string;
+    generation: string;
+    expectedGeneration?: string;
+  }): Promise<KnowledgeAttachment>;
+  attachments(sandboxId?: string): Promise<KnowledgeAttachment[]>;
+  detach(attachmentId: string): Promise<KnowledgeAttachment>;
+}
+//#endregion
+//#region src/knowledge.d.ts
+interface HubKnowledgeRetrievalResult {
+  attachmentId: string;
+  generation: string;
+  provenance: "ingested" | "record-supplied";
+  hits: Array<{
+    id: string;
+    title: string;
+    snippet: string;
+    score?: number;
+    citations?: Array<{
+      sourceId: string;
+      sourceUri: string;
+      revision?: string;
+    }>;
+  }>;
+  elapsedMs?: number;
+}
+interface HubKnowledgeQueryResult {
+  results: HubKnowledgeRetrievalResult[];
+  /** Individual unavailable sources do not hide evidence from healthy sources. */
+  failures: Array<{
+    attachmentId: string;
+    code: string;
+    message: string;
+  }>;
+  partial: boolean;
+}
+/** Runtime-only retrieval. The authenticated sandbox credential determines the
+ * scope on the server; neither a caller nor an agent can supply another scope. */
+declare class HubKnowledgeClient {
+  private readonly request;
+  readonly management: HubKnowledgeManagementClient;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  bindings(): Promise<{
+    references: KnowledgeReference[];
+  }>;
+  query(input: {
+    query: string;
+    limit?: number;
+    expectedReferences?: KnowledgeReference[];
+  }, options?: {
+    signal?: AbortSignal;
+  }): Promise<HubKnowledgeQueryResult>;
+}
+//#endregion
+//#region src/audit-types.d.ts
+interface HubAuditEvent {
+  id: string;
+  action: string;
+  targetUserId: string | null;
+  targetKeyId: string | null;
+  metadata: unknown;
+  createdAt: string;
+}
+interface HubAuditListRequest {
+  provider?: string;
+  action?: string;
+  status?: string;
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+}
+interface HubAuditResponse {
+  events: HubAuditEvent[];
+  nextCursor: string | null;
+}
+//#endregion
+//#region src/transport-types.d.ts
+type HubPrincipalKind = "user_session" | "api_key" | "sandbox_runtime";
+interface HubSuccessEnvelope<TData> {
+  success: true;
+  data: TData;
+}
+interface HubErrorEnvelope {
+  success: false;
+  error: HubErrorBody;
+}
+interface HubErrorBody {
+  code: HubErrorCode;
+  message: string;
+  details?: unknown;
+}
+type HubErrorCode = "HUB_UNAUTHENTICATED" | "HUB_FORBIDDEN" | "HUB_INVALID_INPUT" | "HUB_INVALID_STATE" | "HUB_PROVIDER_MISSING" | "HUB_CONNECTION_MISSING" | "HUB_CONNECTION_REVOKED" | "HUB_TOKEN_EXPIRED" | "HUB_TOKEN_REPLAYED" | "HUB_TOKEN_REVOKED" | "HUB_TOKEN_ACTION_MISMATCH" | "HUB_POLICY_DENIED" | "HUB_APPROVAL_REQUIRED" | "HUB_EXECUTOR_FAILURE" | "HUB_PROVIDER_FAILURE" | "HUB_PROVIDER_REJECTED" | "HUB_CONFIG_MISSING" | "HUB_CONFIG_INVALID" | "HUB_NOT_FOUND" | "HUB_NOT_IMPLEMENTED" | "HUB_CONFLICT" | "HUB_IDEMPOTENCY_CONFLICT" | "HUB_IDEMPOTENCY_IN_FLIGHT" | "VALIDATION_ERROR" | "WORKFLOW_INVALID" | "NOT_FOUND" | "UNAUTHORIZED" | "CONFLICT" | "MISSING_RUN_INPUTS" | "WORKFLOW_DISABLED" | "PAYLOAD_TOO_LARGE" | "WORKFLOW_RUN_TIMEOUT" | "SERVICE_DRAINING" | "WORKFLOW_STREAM_INTERRUPTED" | `HUB_HTTP_${number}`;
+interface HubStatusResponse {
+  contract: unknown;
+  principal: HubPrincipal;
+  connections: HubStatusConnections;
+}
+interface HubPrincipal {
+  kind: HubPrincipalKind;
+  userId: string;
+  apiKeyId?: string;
+  sandboxId?: string;
+  requestId?: string;
+}
+interface HubStatusConnections {
+  connectedProviderCount: number;
+  unhealthyProviderCount: number;
+}
+//#endregion
+//#region src/authorization-types.d.ts
+interface HubTokenMintResponse {
+  token: string;
+  tokenId: string;
+  expiresAt: string;
+}
+interface HubCapabilityToken {
+  id: string;
+  providerId: string;
+  connectionId: string;
+  connectionDisplay: string | null;
+  actionPath: string;
+  expiresAt: string;
+  status: "active" | "consumed" | "expired" | "revoked";
+  principalKind: HubPrincipalKind;
+  createdAt: string;
+}
+interface HubTokensListResponse {
+  tokens: HubCapabilityToken[];
+}
+interface HubTokenRevokeResponse {
+  tokenId: string;
+  status: HubCapabilityToken["status"];
+}
+type HubPolicyDecision = "allow" | "ask" | "deny";
+interface HubPolicyUpdateRequest {
+  connectionId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+}
+interface HubPolicyDeleteRequest {
+  connectionId: string;
+  actionPath: string;
+}
+interface HubPolicyDeleteResponse {
+  connectionId: string;
+  actionPath: string;
+  /** Whether a stored override existed and was removed (false = already default). */
+  deleted: boolean;
+}
+interface HubPolicy {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  decision: HubPolicyDecision;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubPolicyResponse {
+  policy: HubPolicy;
+}
+interface HubPolicyListResponse {
+  policies: HubPolicy[];
+}
+interface HubAllowWritesResponse {
+  connectionId: string;
+  providerId: string;
+  /** Write actions the connection's provider exposes. */
+  writeActions: number;
+  /** Rows newly created (excludes actions that already had a policy). */
+  granted: number;
+  actionPaths: string[];
+}
+interface HubRevertWritesResponse {
+  connectionId: string;
+  /** `allow_writes` rows deleted. */
+  reverted: number;
+}
+type HubApprovalStatus = "pending" | "approved" | "denied" | "expired" | "consumed";
+interface HubApproval {
+  id: string;
+  connectionId: string;
+  providerId: string;
+  actionPath: string;
+  inputHash: string;
+  requesterPrincipal: Record<string, unknown>;
+  status: HubApprovalStatus;
+  requestedAt: string;
+  expiresAt: string;
+  resolvedAt: string | null;
+}
+interface HubApprovalCapabilityToken {
+  tokenId: string;
+  token: string;
+  expiresAt: string;
+}
+interface HubApprovalDecisionResponse {
+  approval: HubApproval;
+  capabilityToken?: HubApprovalCapabilityToken;
+}
+interface HubApprovalListResponse {
+  approvals: HubApproval[];
+}
+//#endregion
+//#region src/channel-types.d.ts
+interface HubEmailChannel {
+  id: string;
+  kind: "email";
+  providerId: "email";
+  connectionId: string;
+  clientReference: string | null;
+  label: string | null;
+  address: string;
+  status: "active";
+  createdAt: string;
+  updatedAt: string;
+}
+type HubChannel = HubEmailChannel;
+interface HubChannelsResponse {
+  channels: HubChannel[];
+}
+interface HubEmailChannelCreateRequest {
+  /**
+   * Product-owned idempotency key. Retrying the same request returns the
+   * original mailbox instead of provisioning another address.
+   */
+  clientReference?: string;
+  label?: string;
+}
+interface HubChannelCreateResponse {
+  channel: HubChannel;
+  /** True only when this request created the channel. */
+  created: boolean;
+}
+interface HubChannelDeleteResponse {
+  removed: true;
+}
+type HubEventConditionScalar = string | number | boolean | null;
+type HubEventCondition = {
+  path: string;
+  op: "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+  value?: HubEventConditionScalar | HubEventConditionScalar[];
+} | {
+  all: HubEventCondition[];
+} | {
+  any: HubEventCondition[];
+} | {
+  not: HubEventCondition;
+};
+interface HubEventSubscriptionFilter {
+  action?: string;
+  repo?: string;
+  when?: HubEventCondition;
+}
+type HubEventSubscriptionSource = {
+  type: "channel";
+  channelId: string;
+} | {
+  type: "connection";
+  connectionId: string;
+};
+interface HubEventSubscriptionCallback {
+  url: string;
+  secret: string;
+}
+interface HubEventSubscriptionCreateRequest {
+  /**
+   * Product-owned idempotency key. Reusing it with the same source and filter
+   * returns the existing subscription; reusing it for different input fails.
+   */
+  clientReference: string;
+  label?: string;
+  source: HubEventSubscriptionSource;
+  event: string;
+  filter?: HubEventSubscriptionFilter;
+  callback: HubEventSubscriptionCallback;
+}
+interface HubEventSubscription {
+  id: string;
+  clientReference: string;
+  label: string | null;
+  source: HubEventSubscriptionSource;
+  providerId: string;
+  connectionId: string;
+  event: string;
+  filter: HubEventSubscriptionFilter;
+  workflowId: string;
+  status: "active" | "error";
+  lastError: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+interface HubEventSubscriptionsResponse {
+  subscriptions: HubEventSubscription[];
+}
+interface HubEventSubscriptionCreateResponse {
+  subscription: HubEventSubscription;
+  /** True only when this request created the subscription; false on idempotent reuse. */
+  created: boolean;
+}
+interface HubEventSubscriptionDeleteResponse {
+  removed: true;
+}
+interface HubProviderEvent {
+  provider: string;
+  connectionId: string;
+  type: string;
+  action?: string;
+  repo?: string;
+  deliveryId?: string;
+  payload: unknown;
+}
+interface HubEventDelivery {
+  subscriptionId: string;
+  workflowId: string;
+  runId: string;
+  source: {
+    kind: "channel" | "connection";
+    id: string;
+    provider: string;
+    event: string;
+  };
+  providerEvent: HubProviderEvent;
+  firedAt: string;
+}
+//#endregion
+//#region src/connection-types.d.ts
+interface HubConnection {
+  id: string;
+  providerId: string;
+  displayName: string;
+  accountDisplay: string | null;
+  providerAccountId: string | null;
+  scopes: string[];
+  status: "active" | "revoked" | "unhealthy" | "reconnect_required";
+  health: "unknown" | "healthy" | "unhealthy" | "rate_limited";
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+}
+interface HubConnectionsResponse {
+  connections: HubConnection[];
+}
+/** A connector's auth model. */
+type HubProviderAuthKind = "oauth2" | "api_key" | "none" | "custom";
+/** One non-secret value needed before an OAuth redirect can be built. Tenant-
+ * scoped providers use this for the account label in their OAuth hostname. */
+interface HubOAuthConnectionParameter {
+  key: string;
+  label: string;
+  description: string;
+  placeholder: string;
+  required: true;
+}
+interface HubProvider {
+  providerId: string;
+  title: string;
+  /** The connector's auth model. */
+  authKind: HubProviderAuthKind;
+  /** For api-key connectors, the manifest's free-text hint shown when
+   *  collecting the key (e.g. "Paste your Airtable personal access token");
+   *  null for OAuth/native providers that don't collect a key inline. */
+  authHint: string | null;
+  category: string;
+  scopes: string[];
+  /** Actions + trigger events combined (legacy census; prefer the split
+   *  counts below when present). */
+  capabilityCount: number;
+  /** Actions callable via `integration.invoke`. Absent on older servers, and
+   *  for native GitHub when the executor catalog is unavailable. */
+  actionCount?: number;
+  /** Trigger events the connector delivers (not invokable). Absent on older
+   *  servers. */
+  triggerCount?: number;
+  /** True for the native GitHub path; false for substrate-bundled connectors. */
+  native: boolean;
+  /** True when the provider's OAuth app credentials are wired, i.e. a connect
+   *  flow can actually start. UIs offer Connect only for configured providers. */
+  configured: boolean;
+  /** Values the user must supply before OAuth starts. Empty or absent means the
+   *  provider can redirect immediately. */
+  connectionParameters?: HubOAuthConnectionParameter[];
+  /**
+   * True when this deployment can receive this provider's inbound events.
+   * This is separate from `configured`: OAuth can be ready while the shared
+   * webhook secret or bot identity is still absent.
+   */
+  eventIngressConfigured?: boolean;
+}
+interface HubProvidersResponse {
+  providers: HubProvider[];
+  /** Count of substrate-bundled connector manifests behind this catalog. */
+  substrateBundled: number;
+}
+interface HubOAuthStartResponse {
+  provider: string;
+  redirectUrl: string;
+  state: string;
+  expiresAt: string;
+  scopes: string[];
+  cli: boolean;
+}
+interface HubWhatsappEmbeddedSignupStartRequest {
+  returnUrl?: string;
+}
+interface HubWhatsappEmbeddedSignupStartResponse {
+  provider: "whatsapp-business";
+  appId: string;
+  configId: string;
+  sdkVersion: string;
+  /** Embedded Signup flow the login configuration selects. "v4" takes empty
+   *  extras; "v2" needs featureType and sessionInfoVersion. Absent means "v2". */
+  signupVersion?: "v2" | "v4";
+  state: string;
+  expiresAt: string;
+  scopes: string[];
+}
+interface HubWhatsappEmbeddedSignupCompleteRequest {
+  code: string;
+  state: string;
+  wabaId: string;
+  phoneNumberId: string;
+  businessId?: string;
+  flowEvent?: string;
+}
+interface HubWhatsappEmbeddedSignupCompleteResponse {
+  connectionId: string;
+  provider: "whatsapp-business";
+  reconnected: boolean;
+  connection: HubConnection | null;
+}
+/** Connect a non-OAuth (api-key) connector by submitting the user's key. The
+ *  server validates the key with a live probe before persisting; `provider` is
+ *  carried in the path, `apiKey` in the body. */
+interface HubApiKeyConnectRequest {
+  provider: string;
+  apiKey: string;
+  /** Connector-owned setup values. Hub validates them before testing the key. */
+  metadata?: HubApiKeyConnectionMetadata;
+}
+type HubApiKeyConnectionMetadata = {
+  propertyId: string;
+  currency?: string;
+} | {
+  listings: Array<{
+    id: string;
+    pms: string;
+  }>;
+};
+/** Result of an api-key connect: the created (or reconnected) connection.
+ *  Synchronous — there is no redirect leg, unlike the OAuth flow. */
+interface HubApiKeyConnectResponse {
+  connection: HubConnection;
+  reconnected: boolean;
+}
+interface HubConnectionDeleteResponse {
+  connection: HubConnection;
+}
+type HubConnectionHealthStatus = "healthy" | "reconnect_required" | "unhealthy" | "rate_limited" | "unsupported";
+interface HubConnectionHealthError {
+  code: string;
+  message: string;
+}
+interface HubConnectionHealthInfo {
+  status: HubConnectionHealthStatus;
+  checkedAt: string;
+  error?: HubConnectionHealthError;
+}
+interface HubConnectionHealthResponse {
+  connection: HubConnection;
+  health: HubConnectionHealthInfo;
+}
+//#endregion
+//#region src/github-app-types.d.ts
+interface HubGithubAppMintInstallationTokenRequest {
+  /** HTTPS or SSH GitHub URL — alternative to installationId. */
+  repoUrl?: string;
+  /** Explicit installation id — alternative to repoUrl. */
+  installationId?: number;
+  /**
+   * Permission narrowing. The hub MAY refuse a permission broader than the
+   * grant authorized; absent, defaults to `{ contents: "read" }` (the
+   * conservative clone-only floor the autonomous-improvement loop needs).
+   */
+  permissions?: Record<string, "read" | "write" | "admin">;
+  /** Hint passed to GitHub. Server caps at the configured maximum. */
+  ttlSeconds?: number;
+}
+interface HubGithubAppMintInstallationTokenResponse {
+  token: string;
+  expiresAt: string;
+  installationId: number;
+  owner: string;
+  repo: string;
+}
+interface HubGithubAppInstallation {
+  installationId: number;
+  /** Org/user login the App is installed on (lowercased). */
+  accountLogin: string;
+  accountType: string | null;
+  /** "all" ⇒ every repo under the account; "selected" ⇒ only repoFullNames. */
+  repositorySelection: "all" | "selected";
+  /** Metadata omits names; use githubApp.listRepos(id) for a live caller-safe list. */
+  repoFullNames: string[];
+  suspended: boolean;
+}
+interface HubGithubAppInstallationResponse {
+  installation: HubGithubAppInstallation;
+}
+/** An installation as the management surface renders it: the registry record
+ *  plus where to manage it on GitHub (org and personal accounts have different
+ *  settings paths, and the id is not discoverable in GitHub's own UI). */
+interface HubGithubAppManagedInstallation extends HubGithubAppInstallation {
+  manageUrl: string;
+}
+interface HubGithubAppListInstallationsResponse {
+  installations: HubGithubAppManagedInstallation[];
+  /** GitHub's install URL for this deployment, or null when the App slug is
+   *  unconfigured — in which case there is no way to add another account and
+   *  the UI must say so rather than link nowhere. */
+  installUrl: string | null;
+  /** Whether this deployment can ask GitHub for installations it never
+   *  witnessed. Rests on the App CREDENTIAL, not the slug behind `installUrl` —
+   *  a deployment can have one without the other. */
+  syncAvailable?: boolean;
+}
+interface HubGithubAppDisconnectResponse {
+  installationId: number;
+  disconnected: boolean;
+}
+interface HubGithubAppSyncedInstallation {
+  installationId: number;
+  accountLogin: string;
+  accountType: string | null;
+  repositorySelection: "all" | "selected";
+  /** False when this run is what linked it — the newly reachable access. */
+  alreadyLinked: boolean;
+}
+/** Result of reconciling the caller's installations from GitHub. */
+interface HubGithubAppSyncResponse {
+  /** How many of the caller's GitHub accounts were examined. */
+  accountsChecked: number;
+  /** Installations the caller may act through once this returns. */
+  linked: HubGithubAppSyncedInstallation[];
+  /** An installation was found but not linked, and why. An account with no
+   *  installation is absent — that is the ordinary case, not a problem. */
+  skipped: Array<{
+    accountLogin: string;
+    reason: string;
+  }>;
+  /** Why the examined set is not everything, when it isn't. */
+  incomplete?: string;
+}
+interface HubGithubAppListReposResponse {
+  installationId: number;
+  /** Complete live intersection of App coverage and the caller's GitHub access. */
+  repoFullNames: string[];
+  /** True only when both upstream listings completed; failures return an error. */
+  complete: true;
+}
+interface HubGithubAppIsRepoInstalledResponse {
+  installed: boolean;
+  installationId: number | null;
+}
+//#endregion
+//#region src/workflow-graph-types.d.ts
+/** How a node's incoming edges release it (default `"all"` — omitted on the
+ *  wire for it, so specs compiled before join rules existed round-trip). */
+type HubWorkflowGraphJoinRule = "all" | "any" | "any_failed" | "all_done";
+type HubWorkflowConditionOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "contains" | "exists" | "truthy";
+type HubWorkflowConditionScalar = string | number | boolean | null;
+/** The predicate on a guarded edge (`needs: [{ id, when }]`), evaluated by the
+ *  runner against the steps context on the source node's completion. */
+type HubWorkflowCondition = {
+  path: string;
+  op: HubWorkflowConditionOp;
+  value?: HubWorkflowConditionScalar | HubWorkflowConditionScalar[];
+} | {
+  all: HubWorkflowCondition[];
+} | {
+  any: HubWorkflowCondition[];
+} | {
+  not: HubWorkflowCondition;
+};
+interface HubWorkflowGraphNode {
+  id: string;
+  index: number;
+  join?: HubWorkflowGraphJoinRule;
+}
+interface HubWorkflowGraphEdge {
+  from: string;
+  to: string;
+  /** Guard the runner evaluates on the source's completion; unguarded edges
+   *  carry no `when`. */
+  when?: HubWorkflowCondition;
+}
+/** JSON-serializable form of a validated graph (as stored on run/workflow rows). */
+interface HubWorkflowGraphSpec {
+  nodes: HubWorkflowGraphNode[];
+  edges: HubWorkflowGraphEdge[];
+  maxNodeVisits: number;
+}
+//#endregion
+//#region src/workflow-run-types.d.ts
+type HubWorkflowRunStatus = "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled";
+/** One agent iteration of an `agent.run`, as the single-run detail carries it
+ *  (JSON-clean ISO timestamps) — including the round's own output `text`. */
+interface HubAgentIterationSpan {
+  index: number;
+  name: string;
+  status: "succeeded" | "failed";
+  startedAt: string;
+  completedAt: string;
+  model?: string;
+  inputTokens?: number;
+  outputTokens?: number;
+  costUsd?: number;
+  error?: string;
+  text?: string;
+}
+/** An `agent.run`'s execution detail (single-run detail endpoint): per-iteration
+ *  spans plus aggregate usage, present on success AND failure. `partialText` is
+ *  failure-only — on success the final text is the action's `output`. */
+interface HubAgentRunDetail {
+  model?: string;
+  inputTokens?: number;
+  outputTokens?: number;
+  costUsd?: number;
+  partialText?: string;
+  iterations?: HubAgentIterationSpan[];
+}
+/** Per-action result inside a run. `output` on success, `error` on failure. */
+interface HubWorkflowActionResult {
+  index: number;
+  kind: string;
+  /** `running` is the provisional in-flight status the run-history list and
+   *  single-run detail endpoints return for an action of a run that is still
+   *  executing (reconciled to `failed` only once the run itself reaches a
+   *  terminal state); a consumer polling either endpoint can observe it.
+   *  `skipped` is an action whose `if` guard resolved false, so it never ran —
+   *  terminal and distinct from `failed` (it has no `output`, `error`, or cost). */
+  status: "succeeded" | "failed" | "running" | "skipped";
+  /**
+   * Action output on success. Present on the single-run detail endpoint;
+   * intentionally omitted from the paginated run-history list response (an
+   * output can be an arbitrarily large response body, and the list would
+   * otherwise carry unbounded payloads), so it is absent there.
+   */
+  output?: unknown;
+  error?: string;
+  costUsd?: number;
+  /** Graph-run identity: the topology node this action row belongs to. Present
+   *  when the id says something the row's position does not — an author's DAG
+   *  node id, and every cycle re-entry row (a node visited more than once
+   *  produces one row per visit). Absent on a linear run's rows, whose node id
+   *  IS their position: read it as `step-${index + 1}`. */
+  nodeId?: string;
+  /** Which visit of `nodeId` this row is (1-based). Present on cycle re-entry
+   *  rows only; a single-visit row omits it. */
+  visit?: number;
+  /** `script.run` only (single-run detail): the script's captured stdout
+   *  (size-capped), or an artifact ref carrying the full log by reference. */
+  logs?: unknown;
+  /** How an `onError` policy handled this action's failure so the run
+   *  continued (the action still reads `failed`). */
+  onError?: HubWorkflowOnErrorOutcome;
+  /** `agent.run` only (single-run detail): the agent's execution detail —
+   *  per-iteration spans (each with text), aggregate usage, partial text. */
+  agentRun?: HubAgentRunDetail;
+}
+/** A single workflow run, as returned by the run-history endpoint. */
+interface HubWorkflowRun {
+  id: string;
+  status: HubWorkflowRunStatus;
+  actionResults: HubWorkflowActionResult[];
+  /** Terminal run error (credit-exhausted, connection revoked, …); null on a clean run. */
+  error: string | null;
+  attempts: number;
+  /** Single-run detail only: the definition YAML captured at enqueue (null for
+   *  runs from before snapshots, or a workflow with no stored definition). */
+  definitionSnapshot?: string | null;
+  /** Single-run detail only: the trigger payload/context the run executed
+   *  against (capped server-side). Absent on the paginated list. */
+  triggerContext?: unknown;
+  createdAt: string;
+  startedAt: string | null;
+  completedAt: string | null;
+}
+/**
+ * A single run as returned by the single-run detail endpoint
+ * (`GET /v1/workflows/:id/runs/:runId`) and carried in the `snapshot` stream
+ * event. Unlike a run-history list item it always carries `workflowId` and the
+ * per-action `output` / `agentRun` detail (all size-capped server-side).
+ */
+interface HubWorkflowRunDetail extends HubWorkflowRun {
+  workflowId: string;
+  /** The detail endpoint always returns these (unlike the run-history list,
+   *  where they're absent) — narrowed to required here so a consumer of
+   *  `getRun` / a `snapshot` event reads them without re-checking presence. */
+  triggerContext: unknown;
+  definitionSnapshot: string | null;
+  /** The terminal failed/cancelled run this one retries (enqueued via
+   *  {@link HubWorkflowsClient.retryRun}); null on runs that are not retries. */
+  retriedFromRunId: string | null;
+  /** The compiled graph topology the run executed (resolved from the run's
+   *  definition snapshot, so a post-run edit can't mislabel it) — null for a
+   *  linear run. Present on the HTTP run-detail response. */
+  graph?: HubWorkflowGraphSpec | null;
+  /** Per-completion guard verdicts (keyed `"from->to"`), present only when the
+   *  run carries a graph journal — i.e. a parked (`waiting`) graph run. */
+  edgeVerdicts?: HubWorkflowEdgeVerdicts[];
+}
+/**
+ * The trigger fields a manual "Run now" supplies, as a flat `{ path: value }`
+ * map (e.g. `{ "pull_request.number": "123" }`). Keys are the `path`s of the
+ * workflow's {@link HubManualRunInput}s; the server nests them into a trigger
+ * context so the run resolves exactly as a real trigger delivery would.
+ */
+type HubWorkflowRunInputs = Record<string, string>;
+/** Response of a manual run enqueue (`POST /v1/workflows/:id/run`). */
+interface HubWorkflowRunEnqueued {
+  runId: string;
+}
+/**
+ * Result of cancelling a run (`POST /v1/workflows/:id/runs/:runId/cancel`).
+ *
+ * `cancelled` — a `queued` run was stopped synchronously in the store; it is
+ * already terminal. `cancelling` — a `running` run was signalled to abort; it
+ * settles `cancelled` a moment later as its in-flight action tears down. Observe
+ * the true terminal state via {@link HubWorkflowRunDetail} (`getRun`) or the run
+ * event stream (`watchRun`). A finished run throws `HubSdkError` with code
+ * `RUN_NOT_CANCELLABLE`; an unknown/foreign run throws `NOT_FOUND`.
+ */
+interface HubWorkflowRunCancelResult {
+  runId: string;
+  status: "cancelled" | "cancelling";
+  /** Only on a `cancelling` result: whether the abort reached a worker running
+   *  this run on the API instance that served the request. `false` → the run
+   *  just finished, or executes on another instance and will stop on its own;
+   *  watch/poll the run to confirm it settled `cancelled`. */
+  signalled?: boolean;
+}
+/**
+ * Response of a run retry (`POST /v1/workflows/:id/runs/:runId/retry`): the
+ * NEWLY enqueued run's id — a fresh run of the same workflow with the same
+ * trigger context — plus the terminal run it was retried from. A finished
+ * run in any other state throws `HubSdkError` with code `RUN_NOT_RETRYABLE`;
+ * an unknown/foreign run throws `NOT_FOUND`.
+ */
+interface HubWorkflowRunRetried {
+  runId: string;
+  retriedFromRunId: string;
+}
+/**
+ * A live event from a run's SSE stream (`GET /v1/workflows/:id/runs/:runId/events`),
+ * as surfaced by {@link HubWorkflowsClient.watchRun}. `snapshot` is the current
+ * persisted run detail sent first; the lifecycle/token events mirror the run as
+ * it executes; `ping` is a keepalive; `run.done` is terminal and closes the
+ * stream. Unknown server event types are dropped rather than surfaced, so new
+ * event kinds don't break older clients.
+ */
+type HubWorkflowRunStreamEvent = {
+  type: "snapshot";
+  run: HubWorkflowRunDetail;
+} | {
+  type: "action.started";
+  index: number;
+  kind: string;
+  at: string;
+} | {
+  type: "action.finished";
+  index: number;
+  kind: string;
+  status: "succeeded" | "failed" | "skipped";
+  costUsd?: number;
+  error?: string;
+  at: string;
+} | {
+  type: "iteration.started";
+  actionIndex: number;
+  iterationIndex: number;
+  model?: string;
+  at: string;
+} | {
+  type: "iteration.ended";
+  actionIndex: number;
+  iterationIndex: number;
+  status: "succeeded" | "failed";
+  outputPreview?: string;
+  inputTokens?: number;
+  outputTokens?: number;
+  costUsd?: number;
+  at: string;
+} | {
+  type: "token";
+  actionIndex: number;
+  delta: string;
+  at: string;
+} | {
+  type: "ping";
+} | {
+  type: "run.done";
+  status: "succeeded" | "failed" | "cancelled";
+  error?: string | null;
+  at?: string;
+} | {
+  type: "run.waiting";
+  decisionId: string;
+  at?: string;
+};
+/** Latest-run snapshot attached to each workflow on the list response. */
+interface HubWorkflowRunSummary {
+  id: string;
+  status: HubWorkflowRunStatus;
+  error: string | null;
+  createdAt: string;
+  completedAt: string | null;
+  /** Execution start; null while queued, absent from older responses. */
+  startedAt?: string | null;
+}
+/** One page of run history; `nextCursor` is null on the last page. */
+interface HubWorkflowRunsPage {
+  runs: HubWorkflowRun[];
+  nextCursor: string | null;
+}
+/** Trailing windows the fleet-insights endpoint accepts. */
+type HubWorkflowFleetWindow = "24h" | "7d" | "30d";
+/**
+ * One workflow's row in the fleet overview: its run tallies over the window.
+ * `lastRunStatus`/`lastRunAt` describe the newest run INSIDE the window (null
+ * when the workflow didn't run in it), and `successRate` is
+ * `succeeded / runsInWindow` — null, never a fabricated 0 or 1, when there is
+ * no denominator.
+ */
+interface HubWorkflowFleetEntry {
+  id: string;
+  name: string;
+  enabled: boolean;
+  runsInWindow: number;
+  succeeded: number;
+  failed: number;
+  /** Runs parked on a human `decision` step (status `waiting`). */
+  waiting: number;
+  successRate: number | null;
+  lastRunStatus: HubWorkflowRunStatus | null;
+  lastRunAt: string | null;
+}
+/** `GET /v1/workflows/insights/fleet` — the whole fleet, sorted failing-first. */
+interface HubWorkflowFleetInsights {
+  window: HubWorkflowFleetWindow;
+  /** ISO instant the window starts at (now minus the window length). */
+  windowStart: string;
+  workflows: HubWorkflowFleetEntry[];
+}
+/** One journal completion on the wire: the node that completed and the guard
+ *  verdict evaluated for each of its guarded outgoing edges, keyed by edgeKey
+ *  (`"from->to"`). Only GUARDED edges ever appear. */
+interface HubWorkflowEdgeVerdicts {
+  nodeId: string;
+  verdicts: Record<string, boolean>;
+}
+/** How an action's `onError` policy handled a failure so the run continued
+ *  (the action itself still reads `failed`). */
+interface HubWorkflowOnErrorOutcome {
+  policy: "continue" | "fallback";
+  /** The recovery leaf's result when the policy ran a `{ do }` fallback. */
+  fallback?: {
+    kind: string;
+    status: "succeeded" | "failed";
+    output?: unknown;
+    error?: string;
+    costUsd?: number;
+  };
+}
+/** One node's aggregate across the analyzed runs. */
+interface HubWorkflowNodeHealth {
+  /** The author's graph node id, or `step-N` for a linear run's nodes (and for
+   *  a node whose run cannot be mapped back to a definition). */
+  nodeId: string;
+  visits: number;
+  failures: number;
+  /** Null when no visit carried a cost row (never a fabricated 0). */
+  totalCostUsd: number | null;
+  /** Null when no visit recorded duration spans. */
+  avgDurationMs: number | null;
+}
+/** Failures grouped by a normalized error signature (ids/numbers/whitespace
+ *  stripped), most frequent first (top 5). */
+interface HubWorkflowFailureCluster {
+  signature: string;
+  count: number;
+  sampleRunIds: string[];
+}
+/** An agent.run node whose outputs are near-static across runs — a
+ *  CANDIDATE for distillation, reported with its measurements, never a
+ *  verdict. */
+interface HubWorkflowDistillationCandidate {
+  nodeId: string;
+  matchRatio: number;
+  samples: number;
+  avgCostUsd: number | null;
+}
+interface HubWorkflowHealth {
+  /** The requested window (the `runs` parameter). */
+  runsWindow: number;
+  /** Terminal runs that actually went into the stats. */
+  runsAnalyzed: number;
+  nodes: HubWorkflowNodeHealth[];
+  failureClusters: HubWorkflowFailureCluster[];
+  distillationCandidates: HubWorkflowDistillationCandidate[];
+}
+type HubWorkflowDecisionStatus = "pending" | "resolved" | "expired" | "cancelled";
+type HubWorkflowDecisionOnTimeout = "wait" | "fail" | "default";
+/** How the answer arrived: a UI click, a provider-channel event (e.g. a Slack
+ *  reaction), or the timeout policy. */
+type HubWorkflowDecisionResolvedVia = "in_app" | "channel" | "system";
+interface HubWorkflowDecision {
+  id: string;
+  runId: string;
+  workflowId: string;
+  actionIndex: number;
+  title: string;
+  prompt: string | null;
+  options: string[];
+  status: HubWorkflowDecisionStatus;
+  onTimeout: HubWorkflowDecisionOnTimeout;
+  defaultChoice: string | null;
+  choice: string | null;
+  note: string | null;
+  timedOut: boolean;
+  requestedAt: string;
+  expiresAt: string | null;
+  resolvedAt: string | null;
+  /** Null while pending, and on a row settled without an answer (expired /
+   *  cancelled). */
+  resolvedVia: HubWorkflowDecisionResolvedVia | null;
+  /** `channel` answers only: the provider whose event carried the answer and
+   *  the raw external actor id it came from. */
+  resolvedViaProvider: string | null;
+  resolvedByExternalActor: string | null;
+}
+/** A pending decision on the cross-workflow list, named by its workflow
+ *  (null when the workflow was deleted while the run was parked). */
+interface HubWorkflowPendingDecision extends HubWorkflowDecision {
+  workflowName: string | null;
+}
+interface HubWorkflowPendingDecisionsResponse {
+  decisions: HubWorkflowPendingDecision[];
+}
+/** Result of resolving a decision. `resumed` is false when the resolution
+ *  stuck but the run could not be resumed (already terminal/cancelled). */
+interface HubWorkflowDecisionResolveResult {
+  runId: string;
+  decisionId: string;
+  choice: string;
+  resumed: boolean;
+}
+/** One step of an agent round's execution timeline (reasoning, or a tool call
+ *  with args + result), as the step-page endpoint serves it. */
+type HubWorkflowAgentStep = {
+  kind: "reasoning";
+  text: string;
+} | {
+  kind: "tool"; /** Tool name, e.g. "read", "bash". */
+  tool: string;
+  status: "pending" | "running" | "completed" | "error"; /** Arguments the tool was called with (pretty JSON). */
+  input?: string; /** Result the tool returned on success (pretty JSON / text). */
+  output?: string; /** Error message when the tool failed. */
+  error?: string;
+};
+/** One page of a round's step archive. `nextCursor` is the last `stepIndex`
+ *  held — pass it as `after` for the next page; null on the last page. */
+interface HubWorkflowRunStepsPage {
+  steps: HubWorkflowAgentStep[];
+  nextCursor: number | null;
+}
+//#endregion
+//#region src/workflow-definition-types.d.ts
+interface HubWorkflowAction {
+  kind: string;
+  config: Record<string, unknown>;
+}
+/** Inbound-event matcher for a `provider_event` trigger. */
+interface HubWorkflowEventFilter {
+  event: string;
+  action?: string;
+  repo?: string;
+}
+interface HubWorkflowTrigger {
+  id: string;
+  kind: "provider_event" | "schedule" | "webhook";
+  enabled: boolean;
+  provider: string | null;
+  connectionId: string | null;
+  eventFilter: HubWorkflowEventFilter | null;
+  cron: string | null;
+  timezone: string | null;
+  nextFireAt: string | null;
+  lastFiredAt: string | null;
+  /** Schedule only: the ISO-8601 instant it stops firing; null when unbounded. */
+  until: string | null;
+}
+interface HubWorkflowValidationError {
+  path: string;
+  message: string;
+  /** Machine-readable reason where one is defined, e.g. `schedule_outlives_grant`. */
+  code?: string;
+}
+interface HubWorkflow {
+  id: string;
+  name: string;
+  description: string | null;
+  enabled: boolean;
+  /** Compiled engine actions (connection refs resolved to ids). */
+  actions: HubWorkflowAction[];
+  /** The durable YAML this workflow compiled from. */
+  definitionYaml: string | null;
+  validationErrors: HubWorkflowValidationError[];
+  /** Current head revision; null on pre-versioning rows until their next
+   *  update (they have no revision history to point at yet). */
+  headRev?: number | null;
+  /** Present on get/create/update detail responses; omitted on list. */
+  triggers?: HubWorkflowTrigger[];
+  /** Present on the detail response: the trigger fields a manual run must supply,
+   *  derived from the definition's `${trigger.*}` references (empty when none). */
+  manualRunInputs?: HubManualRunInput[];
+  /** Present on the get-detail response: the compiled graph topology (null
+   *  when the definition has no graph topology, or is chain-equivalent —
+   *  the legacy linear semantics). Omitted on the list projection. */
+  graph?: HubWorkflowGraphSpec | null;
+  /** Create response only, when the definition has a webhook trigger: the
+   *  hook delivery URL, plus the plaintext bearer token exactly once at mint
+   *  (absent when an active token already exists — rotate to re-reveal). */
+  hook?: HubWorkflowHookEndpoint;
+  /** Present on the list response (latest run, or null if never run); omitted on detail. */
+  lastRun?: HubWorkflowRunSummary | null;
+  createdAt: string;
+  updatedAt: string;
+}
+/** A trigger field a manual "Run now" must supply (derived from the
+ *  definition's `${trigger.*}` references). `required` is false only when every
+ *  read is wrapped in a `default(...)`. */
+interface HubManualRunInput {
+  path: string;
+  required: boolean;
+}
+type HubWorkflowValidateResponse = {
+  valid: true;
+  name: string;
+  actionCount: number;
+  triggerCount: number;
+} | {
+  valid: false;
+  errors: HubWorkflowValidationError[];
+};
+/** JSON Schema for the YAML workflow definition. */
+type HubWorkflowSchemaResponse = Record<string, unknown>;
+type HubWorkflowRevisionSource = "user" | "copilot" | "intelligence";
+/** Lifecycle state of a revision. The head rev only ever points at an
+ *  `applied` revision; `proposed` is a service-token-authored suggestion
+ *  awaiting an owner decision; `rejected` is a declined proposal (kept for
+ *  audit). */
+type HubWorkflowRevisionStatus = "applied" | "proposed" | "rejected";
+/** Revision list projection — attribution + note + status, WITHOUT the YAML body. */
+interface HubWorkflowRevisionMeta {
+  rev: number;
+  createdAt: string;
+  createdBy: string;
+  source: HubWorkflowRevisionSource;
+  note: string | null;
+  status: HubWorkflowRevisionStatus;
+}
+/** One revision WITH its YAML (and the actions compiled alongside it). */
+interface HubWorkflowRevision extends HubWorkflowRevisionMeta {
+  yaml: string;
+  actions: HubWorkflowAction[];
+}
+/** A proposal (proposed or rejected revision) WITH its evidence — what the
+ *  proposer derived the suggestion from (e.g. health stats), plus
+ *  `rejectionReason` once declined. */
+interface HubWorkflowProposal extends HubWorkflowRevisionMeta {
+  evidence: unknown;
+}
+type HubWorkflowTemplateCategory = "Code Review" | "Triage" | "Reports" | "Multi-agent";
+/** One author-time literal a gallery starter needs the user to supply. Every
+ *  declared parameter is required; `example` is a valid value that seeds the
+ *  form placeholder. */
+interface HubWorkflowTemplateParameter {
+  key: string;
+  label: string;
+  type: "string" | "integer";
+  help?: string;
+  example: string;
+  default?: string;
+  defaultFrom?: "native_evaluation";
+  required?: boolean;
+  advanced?: boolean;
+}
+interface HubWorkflowTemplate {
+  id: string;
+  name: string;
+  summary: string;
+  category: HubWorkflowTemplateCategory;
+  icon: string;
+  requiresSandbox: boolean;
+  /** Providers the template references (a "uses GitHub" hint), sorted. */
+  providers: string[];
+  parameters: HubWorkflowTemplateParameter[];
+  /** The template with parameter tokens rendered to their example values. */
+  previewYaml: string;
+  setupNotes?: string[];
+}
+/** A connection a definition needs, with where to connect it. */
+interface HubWorkflowConnectionRequirement {
+  provider: string;
+  connected: boolean;
+  kind: "integration" | "github_app";
+  /** Where to satisfy the requirement (App install flow for `github_app`,
+   *  integrations page otherwise); null when no target exists. */
+  connectUrl: string | null;
+  /** Another requirement in the same list that must be satisfied first — a
+   *  `github_app` install is claimed through the `github` connection, so it is
+   *  refused while that connection is missing. Null when nothing blocks this
+   *  requirement. The list is ordered prerequisite-first. */
+  prerequisite: {
+    provider: string;
+    kind: "integration" | "github_app";
+  } | null;
+}
+/** Stable identity shared by workflow connection requirements and prerequisite references. */
+declare function workflowConnectionRequirementKey(ref: Readonly<Pick<HubWorkflowConnectionRequirement, "provider" | "kind">>): string;
+/**
+ * Result of instantiating a template. `created: false` is NOT an error — an
+ * actionable continuation listing the connections to satisfy before retrying
+ * the same call. Invalid parameters or a compile failure throw `HubSdkError`
+ * (400) instead, matching the create route's contract.
+ */
+type HubWorkflowTemplateInstantiateResult = {
+  created: true;
+  workflow: HubWorkflow;
+} | {
+  created: false;
+  connectionRequirements: HubWorkflowConnectionRequirement[];
+};
+/** A workflow's webhook delivery endpoint. `token` is the plaintext bearer —
+ *  revealed only at mint/rotate time (only the hash is stored). */
+interface HubWorkflowHookEndpoint {
+  url: string;
+  token?: string;
+}
+//#endregion
+//#region src/workflow-storage-types.d.ts
+/** One KV entry with its metadata — the get/put/cas response shape. */
+interface HubWorkflowKvEntry {
+  key: string;
+  value: unknown;
+  version: number;
+  updatedAt: string;
+}
+/** Keyspace metadata row (never the value) — the list response's entry. */
+interface HubWorkflowKvEntryMeta {
+  key: string;
+  version: number;
+  updatedAt: string;
+}
+interface HubWorkflowKvListResponse {
+  entries: HubWorkflowKvEntryMeta[];
+}
+interface HubWorkflowKvDeleteResponse {
+  deleted: boolean;
+}
+/** The opaque ref a stored artifact is referred to by — the value a
+ *  script.run node returns as its step output. */
+interface HubWorkflowArtifactRef {
+  $artifact: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  preview: string | null;
+}
+/** Artifact metadata (never the bytes), oldest first on the list response. */
+interface HubWorkflowArtifact {
+  id: string;
+  runId: string;
+  workflowId: string;
+  /** The graph node (or `step-N` positional id on linear runs) whose action
+   *  emitted the artifact. */
+  nodeId: string;
+  name: string;
+  contentType: string;
+  byteSize: number;
+  /** First 2KiB of textual content; null for binary content types. */
+  preview: string | null;
+  createdAt: string;
+}
+interface HubWorkflowArtifactsResponse {
+  artifacts: HubWorkflowArtifact[];
+}
+/** Raw artifact bytes from the download route, with their stored content type. */
+interface HubWorkflowArtifactDownload {
+  bytes: Uint8Array;
+  contentType: string;
+}
+//#endregion
+//#region src/lines.d.ts
+interface HubLineMember {
+  id: string;
+  label: string | null;
+  role: string;
+  self?: boolean;
+  consent?: "enabled" | "required";
+}
+interface HubLineContext {
+  self: {
+    id: string;
+    label: string | null;
+    role: string;
+  };
+  line: {
+    id: string;
+    label: string | null;
+    transport: string;
+  };
+  members: HubLineMember[];
+  capabilities: Record<string, {
+    allowed: boolean;
+    reason?: string;
+  }>;
+  pendingReminders: Array<{
+    messageId: string;
+    wakeAt?: string;
+    prompt: string | null;
+  }>;
+  quotas: {
+    selfMessagesToday: number;
+    selfMessagesPerDay: number;
+    selfMessagesPending: number;
+    selfMessagesPendingLimit: number;
+  };
+}
+interface HubLineSendInput {
+  toMember: string;
+  text: string;
+  notBefore?: string;
+  onBehalfOf?: string;
+  idempotencyKey?: string;
+}
+/** An asset URL safe to share with the recipient and provider. Hub never fetches it.
+ * Meta WhatsApp API-key lines send it with `text` as the caption. Other transports refuse it.
+ * Use public HTTPS without a query, fragment or credentials. */
+interface HubLineImage {
+  url: string;
+}
+interface HubLineOwnerSendInput {
+  memberId: string;
+  text: string;
+  image?: HubLineImage;
+  notBefore?: string;
+  idempotencyKey: string;
+  /** Ask a coded question; the member's reply that starts with `code` returns here. */
+  reply?: HubLineReplyCodeInput;
+}
+interface HubLineReplyCodeInput {
+  /** A letter, then up to seven letters or digits, with at least one digit (`F7`). Hub compares it case-insensitively. */
+  code: string;
+  /** 60 to 604800; the window opens when the send first becomes eligible. */
+  ttlSeconds: number;
+  /**
+   * 1 to 20 distinct texted choices, each 1-32 of `a-z 0-9 _ -` after lower-casing.
+   * An answer must then be `<code> <option>[ <note>]`; any other coded text keeps the question open.
+   */
+  options?: string[];
+}
+/** The coded question's state on an owner send receipt. */
+interface HubLineReplyCode {
+  /** Upper case. */
+  code: string;
+  expiresAt: string;
+  /** Authoritative closure fence; absent on older Hub, never infer it from local time. */
+  closed?: boolean;
+  /** The first coded answer; `text` is null after content retention ends. */
+  answer: {
+    messageId: string;
+    text: string | null;
+    receivedAt: string; /** The named option, lower case; null when the send listed no options. */
+    option: string | null; /** Words after the option; null when there were none or retention ended. */
+    note: string | null;
+  } | null;
+}
+interface HubLineReminderInput {
+  text: string;
+  notBefore: string;
+  idempotencyKey: string;
+}
+interface HubLineApplicationDispatchCurrentInput {
+  attachmentId: string;
+  memberId: string;
+  memberRevision: string;
+  senderAddress: string;
+  textSha256: string;
+  binding: string;
+  dispatchFence: string;
+  dispatchDeadline: string;
+}
+interface HubLineMemberApplication {
+  id: string;
+  lineId: string;
+  attachmentId: string;
+  memberId: string;
+  subjectId: string;
+  status: "active" | "revoked";
+  application: {
+    url: string;
+    binding: string;
+  };
+  /** Hub's name for the app at this callback; present on reads. */
+  app?: {
+    name: string;
+  };
+  createdAt: string;
+  revokedAt: string | null;
+}
+interface HubLineMemberApplicationInput {
+  expectedSelectionId: string | null;
+  expectedMemberRevision: string;
+  subjectId: string;
+  application: {
+    url: string;
+    binding: string;
+    secret: string;
+  };
+}
+interface HubLineProviderDelivery {
+  provider: "meta_whatsapp";
+  messageId: string;
+  acceptedAt: string;
+  sentAt: string | null;
+  deliveredAt: string | null;
+  readAt: string | null;
+  failedAt: string | null;
+  failureCode: number | null;
+}
+interface HubLineSendReceipt {
+  /** Absent on older Hub. Replied/accepted never implies delivered. */
+  delivery?: HubLineProviderDelivery | null;
+  message: {
+    id: string;
+    status: string;
+    text: string | null;
+    image?: HubLineImage;
+  };
+  eligibleAt: string | null;
+  expiresAt: string;
+  /** Null when the send asked no coded question; absent from Hub before reply codes. */
+  reply?: HubLineReplyCode | null;
+}
+interface HubLineReminderReceipt {
+  state: "queued" | "skipped";
+  lineId: string;
+  messageId?: string;
+  sessionId?: string;
+  completion?: string;
+  reason?: string;
+}
+interface HubLineScheduledSendOptions {
+  lineId: string;
+  memberId: string;
+  text: string;
+  timezone: string;
+  name?: string;
+  notBefore?: string;
+  /**
+   * RFC 3339 instant the schedule stops at. Required when the calling key
+   * expires, and no later than that expiry: a schedule never outlives the
+   * key that wrote it.
+   */
+  until?: string;
+}
+interface HubLineCheckinOptions {
+  lineId: string;
+  member: string;
+  timezone: string;
+  prompt: string;
+  name?: string;
+  /** RFC 3339 instant the schedule stops at; see {@link HubLineScheduledSendOptions.until}. */
+  until?: string;
+}
+/** Line calls share HubClient authentication and envelope handling. */
+declare class HubLinesClient {
+  private readonly request;
+  private readonly createWorkflow;
+  private readonly requestApplicationDispatchCurrent?;
+  readonly members: {
+    list: (lineId: string) => Promise<HubLineMember[]>;
+  };
+  readonly memberApplications: {
+    get: (lineId: string, memberId: string) => Promise<{
+      memberRevision: string;
+      selection: HubLineMemberApplication | null;
+    }>;
+    select: (lineId: string, memberId: string, input: HubLineMemberApplicationInput) => Promise<HubLineMemberApplication>;
+    clear: (lineId: string, memberId: string, input: {
+      expectedSelectionId: string;
+      expectedMemberRevision: string;
+    }) => Promise<void>;
+  };
+  readonly checkins: {
+    schedule: (cron: string, options: HubLineCheckinOptions) => Promise<HubWorkflow>;
+  };
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>, createWorkflow: (yaml: string) => Promise<HubWorkflow>, requestApplicationDispatchCurrent?: ((path: string, init: RequestInit, callbackBearer: string) => Promise<{
+    current: boolean;
+  }>) | undefined);
+  scheduleSend(cron: string, options: HubLineScheduledSendOptions): Promise<HubWorkflow>;
+  context(): Promise<HubLineContext>;
+  send(lineId: string, input: HubLineSendInput | HubLineOwnerSendInput): Promise<HubLineSendReceipt>;
+  /** Read an owner send's receipt, including its coded answer. Queued is not delivered. */
+  sentMessage(lineId: string, messageId: string): Promise<HubLineSendReceipt>;
+  remind(lineId: string, input: HubLineReminderInput): Promise<HubLineReminderReceipt>;
+  applicationDispatchCurrent(lineId: string, messageId: string, input: HubLineApplicationDispatchCurrentInput, callbackBearer: string): Promise<boolean>;
+}
+//#endregion
+//#region src/managed-numbers.d.ts
+interface HubNumberReadiness {
+  configured: boolean;
+  provider: "inkbox";
+  transports: Array<"sms" | "imessage">;
+  billing: "prepaid_activation";
+  automaticRentalBilling: false;
+  deliveryVerified: false;
+}
+interface HubNumberQuote {
+  transport: "sms" | "imessage";
+  activationCents: number;
+  currency: "usd";
+  termsVersion: string;
+  terms: string;
+  expiresAt: number;
+  /** The binding the quote was issued for. Absent from older servers. */
+  clientReference?: string;
+  /** Opaque. Pass it back to `create`; never decode it. */
+  token: string;
+}
+/** One page of the owner's orders, newest first. */
+interface HubNumberOrderPage {
+  orders: HubNumberOrder[];
+  /** Present while more orders exist. Older servers omit it and return one
+   * bounded page, so an absent cursor never proves an order does not exist. */
+  nextCursor?: string | null;
+}
+interface HubNumberListQuery {
+  /** Only orders requested for this binding, including closed ones. */
+  clientReference?: string;
+  cursor?: string;
+  /** 1 to 100; the server default is 100. */
+  limit?: number;
+}
+/** An operator's terminal decision on an order stuck in `needs_review`.
+ * Read-only for a creator: the resolution is made through the platform's
+ * admin surface, never through this client. */
+interface HubNumberResolution {
+  action: "release" | "settle" | "abandon";
+  operator: string;
+  reason: string;
+  at: number;
+  /** Present while the operator's action is still running. The decision is
+   * not final and the order can still return to review. */
+  pending?: true;
+  /** Present when a `settle` handed a live, unfinished order back to
+   * provisioning, so the order is working again rather than closed. */
+  requeued?: true;
+}
+interface HubNumberOrder {
+  id: string;
+  clientReference: string;
+  transport: "sms" | "imessage";
+  status: "pending" | "provider_pending" | "needs_review" | "ready_for_setup" | "cancelled";
+  phase: "identity" | "number" | "credential" | "connection" | "complete";
+  address: string | null;
+  connectionId: string | null;
+  identityId: string | null;
+  providerNumberId: string | null;
+  billingStatus: "unreserved" | "reserved" | "settled" | "released";
+  cancellation: "none" | "requested" | "needs_review" | "released" | "abandoned";
+  errorCode: string | null;
+  nextAttemptAt: number | null;
+  resolution: HubNumberResolution | null;
+  deliveryVerified: false;
+  activationCents: number;
+  currency: "usd";
+  terms: string;
+}
+/** Administrative number operations through Hub's authenticated transport.
+ * A mutation is one attempt; an uncertain create reuses its quote and reference. */
+declare class HubManagedNumbersClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  readiness(): Promise<HubNumberReadiness>;
+  /** One page of orders. Scope by `clientReference` to ask about one binding,
+   * and follow `nextCursor` for the rest; a page is never ownership evidence. */
+  list(query?: HubNumberListQuery): Promise<HubNumberOrderPage>;
+  get(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  quote(input: {
+    transport: "sms" | "imessage";
+    clientReference: string;
+  }): Promise<{
+    quote: HubNumberQuote;
+  }>;
+  /** `clientReference` and `transport`, when given, must match the signed
+   * quote or Hub refuses the purchase with a conflict. */
+  create(input: {
+    quoteToken: string;
+    consent: true;
+    state?: string;
+    clientReference?: string;
+    transport?: "sms" | "imessage";
+  }): Promise<{
+    order: HubNumberOrder;
+  }>;
+  /** Fences references so no order can take them again. Call it as the last
+   * step before retiring the resource they name: a purchase that races the
+   * retirement is then refused (`409 number_reference_fenced`) instead of
+   * binding a line to a resource that is gone. Refused with
+   * `409 number_reference_held` while a live order holds one of them; cancel
+   * it first. A cancelled order no longer holds its reference, so the fence
+   * succeeds as soon as `cancel` returns, whether or not its release is still
+   * pending. Repeating a fence is harmless. */
+  fence(input: {
+    clientReferences: string[];
+  }): Promise<{
+    clientReferences: string[];
+  }>;
+  advance(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  cancel(id: string): Promise<{
+    order: HubNumberOrder;
+  }>;
+  private path;
+  private post;
+}
+//#endregion
+//#region src/transport.d.ts
+type HubAuthHeaders = () => HeadersInit | Promise<HeadersInit>;
+interface HubClientOptions {
+  baseUrl: string;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
+}
+declare class HubSdkError extends Error {
+  readonly code: HubErrorBody["code"];
+  readonly details?: unknown;
+  readonly status?: number;
+  constructor(error: HubErrorBody, options?: {
+    status?: number;
+  });
+}
+declare class HubTransport {
+  #private;
+  readonly baseUrl: string;
+  readonly fetch: typeof fetch;
+  readonly authHeaders?: HubAuthHeaders;
+  constructor(options: HubClientOptions);
+  /** The API key this client authenticates with, when it has one. */
+  get apiKey(): string | undefined;
+  protected request<TData>(path: string, init: RequestInit, options?: {
+    auth?: "client" | "caller";
+    validateData?: (data: unknown) => data is TData;
+  }): Promise<TData>;
+  protected buildHeaders(headers: HeadersInit | undefined, callerAuth?: boolean): Promise<Headers>;
+}
+/** Domain clients receive the existing envelope transport as one request function. */
+type HubRequest = <TData>(path: string, init: RequestInit) => Promise<TData>;
+type HubStreamRequest = (path: string, init: RequestInit) => Promise<ReadableStream<Uint8Array>>;
+type HubArtifactRequest = (path: string, init: RequestInit) => Promise<HubWorkflowArtifactDownload>;
+/** Whether an error is the hub's "this credential is not accepted" answer. */
+declare function isHubUnauthenticated(error: unknown): boolean;
+//#endregion
+//#region src/environment.d.ts
+declare const HUB_URL_ENV_VAR: "TANGLE_HUB_URL";
+declare const HUB_API_KEY_ENV_VAR: "TANGLE_API_KEY";
+declare const HUB_CAPABILITY_TOKEN_ENV_VAR: "TANGLE_HUB_CAPABILITY_TOKEN";
+type HubEnv = Record<string, string | undefined>;
+interface HubClientFromEnvOptions {
+  env?: HubEnv;
+  apiKey?: string;
+  authHeaders?: HubAuthHeaders;
+  fetch?: typeof fetch;
+}
+declare function resolveHubBaseUrl(env?: HubEnv): string;
+declare function resolveHubAuth(env?: HubEnv): string;
+//#endregion
+//#region src/authorization.d.ts
+interface HubTokenListOptions {
+  includeExpired?: boolean;
+}
+declare class HubTokensClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  mint(options: {
+    actionPath: string;
+    connectionId?: string;
+    provider?: string;
+    ttlSeconds?: number;
+  }): Promise<HubTokenMintResponse>;
+  list(options?: HubTokenListOptions): Promise<HubTokensListResponse>;
+  revoke(tokenId: string): Promise<HubTokenRevokeResponse>;
+}
+declare class HubPermissionsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(connectionId: string): Promise<HubPolicyListResponse>;
+  set(input: HubPolicyUpdateRequest): Promise<HubPolicyResponse>;
+  /** Reset an action to its default by deleting any stored override. */
+  delete(input: HubPolicyDeleteRequest): Promise<HubPolicyDeleteResponse>;
+  /** Bulk-allow every write action of a connection's provider. Reads are
+   *  already allowed for sandbox agents; destructive actions stay `ask`.
+   *  Idempotent: actions with an existing policy are left untouched. */
+  allowWrites(connectionId: string): Promise<HubAllowWritesResponse>;
+  /** Inverse of `allowWrites`: delete only the rows it created for this
+   *  connection. Manual per-action decisions are left intact. */
+  revertWrites(connectionId: string): Promise<HubRevertWritesResponse>;
+}
+declare class HubApprovalsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubApprovalListResponse>;
+  approve(approvalId: string): Promise<HubApprovalDecisionResponse>;
+  deny(approvalId: string): Promise<HubApprovalDecisionResponse>;
+}
+//#endregion
+//#region src/tools.d.ts
+interface HubToolSearchOptions {
+  provider?: string;
+  /** Max tools to return. The server defaults to a relevance-ranked shortlist
+   *  (20); pass a higher value (bounded server-side) to enumerate a provider's
+   *  full action list, e.g. for a catalog/browse UI. The cap bounds the MERGED
+   *  response across sources — with no `provider` set, a low limit can exclude
+   *  some providers' tools, so scope by `provider` when you need one connector's
+   *  complete list. */
+  limit?: number;
+}
+interface HubToolInvokeOptions {
+  connectionId?: string;
+  approve?: boolean;
+  /** Caller-minted key for this invoke. On the direct exec arm the platform
+   *  ledger replays the first call's result for a retry that carries the same
+   *  key, and refuses a key bound to a different request. The approval and
+   *  capability-token retries re-send the key, and the connector receives it
+   *  for provider-native dedupe. Capability-token execution stays at-most-once
+   *  per token: it refuses a replay instead of replaying a stored result. */
+  idempotencyKey?: string;
+}
+declare class HubToolsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  search(query: string, options?: HubToolSearchOptions): Promise<HubToolsSearchResponse>;
+  sources(): Promise<HubToolSourcesResponse>;
+  describe(path: string): Promise<HubToolsDescribeResponse>;
+  /**
+   * Run one hub tool. `raw` is the tool input: the SDK forwards it verbatim as
+   * the request body's `input`, and the server validates it against the tool's
+   * own schema, so the client never gives it a shape.
+   */
+  invoke<TResult = unknown>(path: string, raw: unknown, options?: HubToolInvokeOptions): Promise<HubExecResponse<TResult>>;
+  private buildExecInit;
+}
+//#endregion
+//#region src/inbound-webhooks.d.ts
+/** Provider setup uses the existing authenticated Hub transport and vault. */
+interface HubInboundWebhookCreateOptions {
+  /** Inkbox identity that owns all selected channels. */
+  identityId?: string;
+  mailboxId?: string;
+  phoneNumberId?: string;
+  imessage?: boolean;
+  /** Linq: explicit owned lines; omitted does not mean every account line. */
+  phoneNumbers?: string[];
+  /** Linq WhatsApp: explicit opaque IDs from numbers.list, not E.164 phone strings. */
+  phoneNumberIds?: string[];
+  /** Contiguity Console secret, or an existing Inkbox identity signing key. */
+  signingSecret?: string;
+}
+interface HubInboundWebhookCreateResponse {
+  url: string;
+  /** True only when the provider subscription was created by the server. */
+  provisioned?: boolean;
+  /** Self-configured legacy providers can return a newly minted secret once. */
+  secret?: string;
+  inboundAddress?: string;
+  requiresProviderSetup?: boolean;
+}
+interface HubInboundWebhookStatus {
+  configured: boolean;
+  url?: string;
+  /** Configuration is not evidence of a real delivered message. */
+  deliveryVerified: false;
+  requiresProviderSetup?: boolean;
+}
+/** Live provider readback for one explicitly selected Linq WhatsApp number. */
+interface HubInboundPhoneNumberScope {
+  configured: true;
+  provisioned: true;
+  subscribed: true;
+  phoneNumberIds: string[];
+}
+declare class HubInboundWebhooksClient {
+  private readonly request;
+  constructor(request: <T>(path: string, init: RequestInit) => Promise<T>);
+  create(connectionId: string, options?: HubInboundWebhookCreateOptions): Promise<HubInboundWebhookCreateResponse>;
+  get(connectionId: string): Promise<HubInboundWebhookStatus>;
+  /** Add one owned Linq WhatsApp number without rotating the webhook secret. */
+  ensurePhoneNumber(connectionId: string, phoneNumberId: string): Promise<HubInboundPhoneNumberScope>;
+  /** Remove event subscriptions first. This does not silently rotate a live URL. */
+  delete(connectionId: string): Promise<{
+    removed: boolean;
+  }>;
+  private path;
+}
+//#endregion
+//#region src/connections.d.ts
+interface HubConnectionStartOptions {
+  returnUrl?: string;
+  cli?: boolean;
+  connectionParameters?: Record<string, string>;
+  /** GitHub accepts the exact read:user, repo, read:org set. */
+  requestedScopes?: readonly string[];
+}
+declare class HubConnectionsClient {
+  private readonly request;
+  readonly inboundWebhook: HubInboundWebhooksClient;
+  constructor(request: HubRequest);
+  list(): Promise<HubConnectionsResponse>;
+  /** Connector catalog: every provider the hub can expose, each flagged with
+   *  `configured` (whether its OAuth app credentials are wired). Callers render
+   *  this alongside `list()` to offer Connect for not-yet-connected providers. */
+  providers(): Promise<HubProvidersResponse>;
+  start(provider: string, options?: HubConnectionStartOptions): Promise<HubOAuthStartResponse>;
+  startWhatsappEmbeddedSignup(options?: HubWhatsappEmbeddedSignupStartRequest): Promise<HubWhatsappEmbeddedSignupStartResponse>;
+  completeWhatsappEmbeddedSignup(input: HubWhatsappEmbeddedSignupCompleteRequest): Promise<HubWhatsappEmbeddedSignupCompleteResponse>;
+  /** Connect a non-OAuth (api-key) connector by submitting the user's key.
+   *  The server validates the key with a live probe before persisting and
+   *  returns the created (or reconnected) connection — there is no redirect,
+   *  unlike `start`. Cloudbeds requires propertyId metadata and PriceLabs
+   *  requires listing ID/PMS pairs; other providers have no metadata. */
+  connectApiKey(provider: string, apiKey: string, metadata?: HubApiKeyConnectRequest["metadata"]): Promise<HubApiKeyConnectResponse>;
+  revoke(connectionId: string): Promise<HubConnectionDeleteResponse>;
+  health(connectionId: string): Promise<HubConnectionHealthResponse>;
+}
+//#endregion
+//#region src/channels.d.ts
+declare class HubChannelsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubChannelsResponse>;
+  createEmail(input?: HubEmailChannelCreateRequest): Promise<HubChannelCreateResponse>;
+  delete(channelId: string): Promise<HubChannelDeleteResponse>;
+}
+declare class HubEventSubscriptionsClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(): Promise<HubEventSubscriptionsResponse>;
+  create(input: HubEventSubscriptionCreateRequest): Promise<HubEventSubscriptionCreateResponse>;
+  delete(subscriptionId: string): Promise<HubEventSubscriptionDeleteResponse>;
+}
+//#endregion
+//#region src/github-app.d.ts
+declare class HubGithubAppClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  mintInstallationToken(input: HubGithubAppMintInstallationTokenRequest): Promise<HubGithubAppMintInstallationTokenResponse>;
+  /** Every installation the caller may act through — their own and any org's
+   *  they were verified against. The management surface's read. */
+  listInstallations(): Promise<HubGithubAppListInstallationsResponse>;
+  /**
+   * Find installations `listInstallations` cannot show: the hub only registers
+   * what the setup redirect witnessed, so an org install approved out of band —
+   * or created by another member — is invisible until this asks GitHub for it.
+   * Links whatever the caller can prove access to; never uninstalls anything.
+   */
+  syncInstallations(): Promise<HubGithubAppSyncResponse>;
+  /** Give up THIS caller's access. Not an uninstall — the installation is
+   *  account-level and other members may still be using it. */
+  disconnectInstallation(installationId: number): Promise<HubGithubAppDisconnectResponse>;
+  getInstallation(installationId: number): Promise<HubGithubAppInstallationResponse>;
+  listRepos(installationId: number): Promise<HubGithubAppListReposResponse>;
+  isRepoInstalled(input: {
+    owner: string;
+    repo: string;
+  }): Promise<HubGithubAppIsRepoInstalledResponse>;
+}
+//#endregion
+//#region src/audit.d.ts
+declare class HubAuditClient {
+  private readonly request;
+  constructor(request: HubRequest);
+  list(options?: HubAuditListRequest): Promise<HubAuditResponse>;
+}
+//#endregion
+//#region src/workflows-kv.d.ts
+/** The workflow's durable keyspace, shared by all its runs. */
+declare class WorkflowKvResource {
+  protected readonly request: HubRequest;
+  constructor(request: HubRequest);
+  /**
+   * The workflow's whole keyspace as metadata (key, version, updatedAt — never
+   * values), key-ordered. Bounded by the server's per-workflow key cap.
+   */
+  listKv(id: string): Promise<HubWorkflowKvListResponse>;
+  /** One KV entry (value + version); `HubSdkError(NOT_FOUND)` when absent. */
+  getKv(id: string, key: string): Promise<HubWorkflowKvEntry>;
+  /**
+   * Upsert a key; returns the entry with its NEW version (increments on every
+   * write). Throws `HubSdkError(KV_VALUE_TOO_LARGE)` past the 64KiB value cap
+   * or `KV_KEY_LIMIT` past the per-workflow key cap. `raw` is the caller's
+   * value, stored and read back verbatim, so the client never gives it a shape.
+   */
+  putKv(id: string, key: string, raw: unknown): Promise<HubWorkflowKvEntry>;
+  /**
+   * Compare-and-swap: the write lands only when the stored version still
+   * equals `expectedVersion`; otherwise `HubSdkError(KV_VERSION_CONFLICT)`
+   * (409) — re-read and retry. Creation is {@link putKv}'s job. `raw` is the
+   * caller's value, stored and read back verbatim, so the client never gives it
+   * a shape.
+   */
+  casKv(id: string, key: string, expectedVersion: number, raw: unknown): Promise<HubWorkflowKvEntry>;
+  /** Delete a key; idempotent — `deleted` reports whether a row was removed. */
+  deleteKv(id: string, key: string): Promise<HubWorkflowKvDeleteResponse>;
+}
+//#endregion
+//#region src/workflows.d.ts
+declare class HubWorkflowsClient extends WorkflowKvResource {
+  private readonly stream?;
+  private readonly download?;
+  constructor(request: HubRequest, stream?: HubStreamRequest | undefined, download?: HubArtifactRequest | undefined);
+  list(): Promise<HubWorkflow[]>;
+  /**
+   * Owner-wide fleet overview: one row per workflow with its run tallies over
+   * a trailing window (default 7d), sorted failing-first. Answers "how are ALL
+   * my workflows doing" in one call — the per-workflow insights endpoint is
+   * the drill-down, not a way to build this row set client-side.
+   */
+  fleetInsights(opts?: {
+    window?: HubWorkflowFleetWindow;
+  }): Promise<HubWorkflowFleetInsights>;
+  get(id: string): Promise<HubWorkflow>;
+  create(yaml: string): Promise<HubWorkflow>;
+  /**
+   * Replace the workflow's definition from YAML (recompiled server-side,
+   * triggers reconciled). Every landed update appends a revision;
+   * `opts.note` rides onto that revision row (e.g. "why this change"), visible
+   * in {@link listRevisions}. Throws `HubSdkError`: `WORKFLOW_INVALID` when the
+   * YAML doesn't compile or its connections aren't met, `CONFLICT` on a
+   * concurrent modification, `NOT_FOUND` for an unknown/foreign id.
+   */
+  update(id: string, yaml: string, opts?: {
+    note?: string;
+  }): Promise<HubWorkflow>;
+  delete(id: string): Promise<void>;
+  /**
+   * Enable or disable a workflow without editing its YAML. Works even when the
+   * workflow's connection was revoked (a disabled workflow can't be recompiled
+   * via `update`, but it can still be paused/resumed here).
+   */
+  setEnabled(id: string, enabled: boolean): Promise<HubWorkflow>;
+  /**
+   * One page of run history, newest first. Pass the previous page's
+   * `nextCursor` to fetch the next; a null `nextCursor` means the last page.
+   */
+  listRuns(id: string, opts?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<HubWorkflowRunsPage>;
+  /**
+   * Enqueue an immediate ("Run now") run and return its `runId`. The run goes
+   * through the identical execution path a trigger delivery uses.
+   *
+   * `inputs` supplies the trigger fields the workflow reads (its
+   * {@link HubWorkflow.manualRunInputs}), as a flat `{ path: value }` map — e.g.
+   * `{ "pull_request.number": "123" }`. Omit it for a one-click run of a
+   * workflow that reads no trigger fields. Throws `HubSdkError`:
+   * `MISSING_RUN_INPUTS` when a required field is absent (`details.missing`
+   * names them), `NOT_FOUND` for an unknown/foreign id. A paused workflow
+   * still runs once; pausing only stops its triggers. Pass `opts.signal` to
+   * abort a slow request.
+   */
+  run(id: string, inputs?: HubWorkflowRunInputs, opts?: {
+    signal?: AbortSignal;
+  }): Promise<HubWorkflowRunEnqueued>;
+  /**
+   * A single run's full detail: per-action `output` + `agentRun` execution
+   * detail (size-capped server-side) and the trigger context — the deep "why
+   * did this run do what it did" view. `NOT_FOUND` when the run is unknown or
+   * does not belong to both the caller and this workflow.
+   */
+  getRun(id: string, runId: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<HubWorkflowRunDetail>;
+  /**
+   * Stop a queued or in-flight run. A `queued` run is cancelled synchronously
+   * and comes back `{ status: "cancelled" }` (already terminal); a `running` run
+   * is signalled to abort and comes back `{ status: "cancelling", signalled }` —
+   * it settles `cancelled` a moment later as its current action tears down, which
+   * a {@link watchRun}/{@link getRun} observes. Throws `HubSdkError`:
+   * `RUN_NOT_CANCELLABLE` when the run already finished, `NOT_FOUND` for an
+   * unknown/foreign run id. Pass `opts.signal` to abort a slow request.
+   */
+  cancel(id: string, runId: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<HubWorkflowRunCancelResult>;
+  /**
+   * Re-run a terminal failed/cancelled run: enqueues a FRESH run of the same
+   * workflow with the SAME trigger context the original ran against, linked
+   * back to it via `retriedFromRunId`. The original row is never mutated —
+   * execution is at-most-once, so a retry is always a new run, never a
+   * requeue. The response carries the NEW run id (and the run it retried);
+   * follow it with {@link getRun}/{@link watchRun}/{@link waitForRun} like any
+   * other run. Throws `HubSdkError`: `RUN_NOT_RETRYABLE` when the run is not
+   * terminal-failed/cancelled (queued/running/waiting, or succeeded),
+   * `NOT_FOUND` for an unknown/foreign run id; a workflow paused since the
+   * failure still retries. Pass `opts.signal` to abort a slow request.
+   */
+  retryRun(id: string, runId: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<HubWorkflowRunRetried>;
+  /**
+   * Stream a run's live progress as an async iterable of typed events. The
+   * first event is always a `snapshot` of the current persisted state; then
+   * `action.*` / `iteration.*` / `token` ticks arrive as the run executes;
+   * `ping` is a keepalive; a terminal `run.done` ends the iteration. If the run
+   * is already finished when the stream opens, it yields the snapshot then
+   * `run.done` and completes.
+   *
+   * Live ticks require the worker executing the run to share the API process;
+   * across instances only `snapshot` + `run.done` (from the server's terminal
+   * poll) arrive — the persisted record, read via {@link getRun}, stays the
+   * source of truth. Pass `signal` to cancel; iterating to `run.done` (or
+   * breaking early) releases the connection.
+   *
+   * A stream that ends before `run.done` or `run.waiting` (the Platform is
+   * restarting or handing over) is reopened after a second, as is one refused
+   * with `SERVICE_DRAINING`; the reopened stream starts with a fresh
+   * `snapshot`. After 30 reopens in a row that deliver nothing it throws
+   * `HubSdkError(WORKFLOW_STREAM_INTERRUPTED)`.
+   */
+  watchRun(id: string, runId: string, opts?: {
+    signal?: AbortSignal;
+  }): AsyncGenerator<HubWorkflowRunStreamEvent>;
+  /** One connection's events, then how it ended. */
+  private watchRunOnce;
+  /**
+   * Poll {@link getRun} until the run reaches a terminal state (`succeeded` or
+   * `failed`) and return its detail. The scripting primitive behind "run and
+   * print the result": pairs with {@link run} for a one-call trigger-and-wait.
+   *
+   * Returns as soon as the run leaves the active set (`queued` / `running`) —
+   * i.e. on `succeeded`, `failed`, or any future non-active status — so a new
+   * terminal state can never hang the wait. Polls every `pollIntervalMs`
+   * (default 2000). With `timeoutMs` set, throws
+   * `HubSdkError(WORKFLOW_RUN_TIMEOUT)` — carrying the last observed status on
+   * `details.status` — only once the deadline has actually passed; the last
+   * wait is clamped to the remaining time so a `timeoutMs` shorter than the
+   * poll interval still waits the full requested window rather than giving up a
+   * poll early. Pass `signal` to cancel the wait between polls.
+   */
+  waitForRun(id: string, runId: string, opts?: {
+    pollIntervalMs?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+  }): Promise<HubWorkflowRunDetail>;
+  /**
+   * The workflow's definition history, newest rev first — metadata only (rev,
+   * attribution, note); fetch the YAML per-rev with {@link getRevision}. Empty
+   * for a pre-versioning workflow until its next update.
+   */
+  listRevisions(id: string): Promise<HubWorkflowRevisionMeta[]>;
+  /**
+   * One revision WITH its YAML (and the actions compiled alongside it), for
+   * diff/inspect views. Throws `HubSdkError(REVISION_NOT_FOUND)` for an
+   * unknown rev, `NOT_FOUND` for an unknown/foreign workflow.
+   */
+  getRevision(id: string, rev: number): Promise<HubWorkflowRevision>;
+  /**
+   * Restore a prior rev's YAML as a NEW head revision (history is append-only)
+   * through the same compile path as {@link update}, so the restored definition
+   * is re-validated against today's connections/models. Throws `HubSdkError`:
+   * `REVISION_NOT_FOUND` for an unknown rev, `WORKFLOW_INVALID` when the old
+   * YAML no longer compiles, `CONFLICT` on a concurrent modification.
+   */
+  rollback(id: string, rev: number): Promise<HubWorkflow>;
+  /**
+   * Deterministic health stats over the workflow's last N terminal runs
+   * (default 20, max 100): per-node visits/failures/cost/duration, failure
+   * clusters by normalized error signature, and distillation CANDIDATES
+   * (agent.run nodes with near-static outputs — labeled with their
+   * measurements, never as verdicts). No model in this path.
+   */
+  health(id: string, opts?: {
+    runs?: number;
+  }): Promise<HubWorkflowHealth>;
+  /**
+   * One agent round's execution timeline, paged. `action` is the action's
+   * `${steps[N]}` position and `iteration` the round's position in that
+   * action's `iterations` — both exactly as the run detail serializes them.
+   * Pass the previous page's `nextCursor` as `after` for the next page; a null
+   * `nextCursor` means the round is fully read.
+   */
+  listRunSteps(id: string, runId: string, input: {
+    action: number;
+    iteration: number;
+    after?: number;
+    limit?: number;
+  }): Promise<HubWorkflowRunStepsPage>;
+  /**
+   * Store one artifact for a run (raw bytes) and return the opaque ref — the
+   * value a script.run node returns as its step output. `contentType` defaults
+   * to `application/octet-stream`; `nodeId` attributes the write to a graph
+   * node (owner credential only — a run-scoped token binds its own node).
+   * Throws `HubSdkError(ARTIFACT_TOO_LARGE)` past the server cap.
+   */
+  uploadArtifact(id: string, runId: string, input: {
+    name: string;
+    bytes: Uint8Array;
+    contentType?: string;
+    nodeId?: string;
+  }): Promise<HubWorkflowArtifactRef>;
+  /** Metadata for every artifact of the run (never the bytes), oldest first. */
+  listArtifacts(id: string, runId: string): Promise<HubWorkflowArtifactsResponse>;
+  /**
+   * The artifact's raw bytes with their stored content type — the route every
+   * `downloadUrl` attached to an `$artifact` ref in a run detail points at.
+   */
+  downloadArtifact(id: string, runId: string, artifactId: string): Promise<HubWorkflowArtifactDownload>;
+  /** The curated starter gallery runnable on THIS deployment: metadata,
+   *  parameters, referenced providers, and a concrete `previewYaml` per card. */
+  listTemplates(): Promise<HubWorkflowTemplate[]>;
+  /**
+   * One-click create from a gallery template: substitutes `parameters` into
+   * the template server-side, then runs the SAME create path as
+   * {@link create}. A `{ created: false }` result is NOT an error — an
+   * actionable continuation listing the connections to satisfy before
+   * retrying. Invalid parameters or a compile failure throw `HubSdkError`
+   * (400); an unknown template id throws `NOT_FOUND`.
+   */
+  instantiateTemplate(templateId: string, parameters?: Record<string, string>): Promise<HubWorkflowTemplateInstantiateResult>;
+  /**
+   * The caller's open decisions across all workflows — the always-available
+   * "pending approvals" surface. Each entry carries its workflow's name (null
+   * when the workflow was deleted while the run was parked).
+   */
+  listPendingDecisions(): Promise<HubWorkflowPendingDecisionsResponse>;
+  /**
+   * The pending decision a run is parked on. Throws `HubSdkError(NOT_FOUND)`
+   * when the run is unknown/foreign or holds no pending decision.
+   */
+  getRunDecision(id: string, runId: string): Promise<HubWorkflowDecision>;
+  /**
+   * Answer the decision a run is parked on and resume it from the next action.
+   * `decisionId` is REQUIRED: a run can resolve one decision and re-park on the
+   * next, so an answer addressed only by run could silently land on a question
+   * the caller never saw — a mismatch throws `HubSdkError(DECISION_SUPERSEDED)`.
+   * Other typed failures: `INVALID_CHOICE` (400), `DECISION_ALREADY_RESOLVED` /
+   * `DECISION_EXPIRED` (409), `DECISION_NOT_FOUND` (404), `RUN_NOT_WAITING`
+   * (409 — answered, timed out, or cancelled first).
+   */
+  resolveRunDecision(id: string, runId: string, input: {
+    decisionId: string;
+    choice: string;
+    note?: string;
+  }): Promise<HubWorkflowDecisionResolveResult>;
+  /**
+   * Dry-run a YAML definition against the platform compiler without saving it.
+   *
+   * `opts.structural` selects the CI mode: the platform skips its owner-scoped
+   * connection/skill/profile resolution, so the verdict depends only on the
+   * definition and the deployment's capabilities — identical no matter which
+   * providers the calling account has connected. Use it in pipelines that
+   * assert "this YAML is well-formed"; leave it off in an editor, where naming
+   * the unconnected providers is the point.
+   */
+  validate(yaml: string, opts?: {
+    structural?: boolean;
+  }): Promise<HubWorkflowValidateResponse>;
+  schema(): Promise<HubWorkflowSchemaResponse>;
+}
+//#endregion
+//#region src/client.d.ts
+declare class HubClient extends HubTransport {
+  readonly knowledge: HubKnowledgeClient;
+  readonly allowances: HubAllowancesClient;
+  readonly apps: HubAppsClient;
+  readonly connections: HubConnectionsClient;
+  readonly channels: HubChannelsClient;
+  readonly numbers: HubManagedNumbersClient;
+  readonly eventSubscriptions: HubEventSubscriptionsClient;
+  readonly permissions: HubPermissionsClient;
+  readonly tokens: HubTokensClient;
+  readonly tools: HubToolsClient;
+  readonly approvals: HubApprovalsClient;
+  readonly audit: HubAuditClient;
+  readonly githubApp: HubGithubAppClient;
+  readonly workflows: HubWorkflowsClient;
+  readonly lines: HubLinesClient;
+  constructor(options: HubClientOptions);
+  static fromEnv(options?: HubClientFromEnvOptions): HubClient;
+  status(): Promise<HubStatusResponse>;
+  /**
+   * Open a streaming (Server-Sent Events) response and return its raw body.
+   * Shares auth-header building + `fetch` with {@link request}, but does NOT
+   * buffer or JSON-parse the body — the caller consumes the stream.
+   *
+   * A successful stream comes back as `text/event-stream`. Anything else is an
+   * error envelope (404/429/401 JSON) or a transport failure (gateway/HTML
+   * page); it is surfaced the same way {@link request} surfaces errors — a
+   * typed `HubSdkError` from a `{success:false}` envelope, otherwise an
+   * `HUB_HTTP_<status>` transport error — rather than handed back as bogus SSE.
+   */
+  private stream;
+  /**
+   * Fetch raw (non-envelope) bytes — the artifact download route, whose 200 is
+   * the artifact's own content type, not JSON. Error responses on such routes
+   * are still the standard envelope, so a failure surfaces exactly like
+   * {@link request}: a typed `HubSdkError` from a `{success:false}` body,
+   * otherwise an `HUB_HTTP_<status>` transport error.
+   */
+  private requestBytes;
+}
+//#endregion
+export { HubLineScheduledSendOptions as $, HubEventDelivery as $n, HubTool as $r, HubWorkflowRunDetail as $t, HubSdkError as A, HubConnectionDeleteResponse as An, HubPrincipal as Ar, workflowConnectionRequirementKey as At, HubLineApplicationDispatchCurrentInput as B, HubProvidersResponse as Bn, HubKnowledgeRetrievalResult as Br, HubWorkflowDistillationCandidate as Bt, HUB_URL_ENV_VAR as C, HubGithubAppMintInstallationTokenResponse as Cn, HubRevertWritesResponse as Cr, HubWorkflowTemplate as Ct, resolveHubBaseUrl as D, HubApiKeyConnectResponse as Dn, HubErrorBody as Dr, HubWorkflowTrigger as Dt, resolveHubAuth as E, HubApiKeyConnectRequest as En, HubTokensListResponse as Er, HubWorkflowTemplateParameter as Et, HubNumberOrder as F, HubConnectionsResponse as Fn, HubAuditEvent as Fr, HubWorkflowDecision as Ft, HubLineMemberApplication as G, HubChannel as Gn, KnowledgeCapabilities as Gr, HubWorkflowFleetWindow as Gt, HubLineContext as H, HubWhatsappEmbeddedSignupCompleteResponse as Hn, KnowledgeAttachment as Hr, HubWorkflowFailureCluster as Ht, HubNumberOrderPage as I, HubOAuthConnectionParameter as In, HubAuditListRequest as Ir, HubWorkflowDecisionOnTimeout as It, HubLineProviderDelivery as J, HubChannelsResponse as Jn, KnowledgeReference as Jr, HubWorkflowOnErrorOutcome as Jt, HubLineMemberApplicationInput as K, HubChannelCreateResponse as Kn, KnowledgeCapability as Kr, HubWorkflowHealth as Kt, HubNumberQuote as L, HubOAuthStartResponse as Ln, HubAuditResponse as Lr, HubWorkflowDecisionResolveResult as Lt, isHubUnauthenticated as M, HubConnectionHealthInfo as Mn, HubStatusConnections as Mr, HubAgentRunDetail as Mt, HubManagedNumbersClient as N, HubConnectionHealthResponse as Nn, HubStatusResponse as Nr, HubWorkflowActionResult as Nt, HubAuthHeaders as O, HubApiKeyConnectionMetadata as On, HubErrorCode as Or, HubWorkflowValidateResponse as Ot, HubNumberListQuery as P, HubConnectionHealthStatus as Pn, HubSuccessEnvelope as Pr, HubWorkflowAgentStep as Pt, HubLineReplyCodeInput as Q, HubEventConditionScalar as Qn, HubExecResponse as Qr, HubWorkflowRunCancelResult as Qt, HubNumberReadiness as R, HubProvider as Rn, HubKnowledgeClient as Rr, HubWorkflowDecisionResolvedVia as Rt, HUB_CAPABILITY_TOKEN_ENV_VAR as S, HubAllowancesClient as Si, HubGithubAppMintInstallationTokenRequest as Sn, HubPolicyUpdateRequest as Sr, HubWorkflowSchemaResponse as St, HubEnv as T, HubGithubAppSyncedInstallation as Tn, HubTokenRevokeResponse as Tr, HubWorkflowTemplateInstantiateResult as Tt, HubLineImage as U, HubWhatsappEmbeddedSignupStartRequest as Un, KnowledgeAttachmentAuthorization as Ur, HubWorkflowFleetEntry as Ut, HubLineCheckinOptions as V, HubWhatsappEmbeddedSignupCompleteRequest as Vn, HubKnowledgeManagementClient as Vr, HubWorkflowEdgeVerdicts as Vt, HubLineMember as W, HubWhatsappEmbeddedSignupStartResponse as Wn, KnowledgeAuthorization as Wr, HubWorkflowFleetInsights as Wt, HubLineReminderReceipt as X, HubEmailChannelCreateRequest as Xn, KnowledgeSourceInput as Xr, HubWorkflowPendingDecisionsResponse as Xt, HubLineReminderInput as Y, HubEmailChannel as Yn, KnowledgeSourceCreate as Yr, HubWorkflowPendingDecision as Yt, HubLineReplyCode as Z, HubEventCondition as Zn, KnowledgeSourceSummary as Zr, HubWorkflowRun as Zt, HubApprovalsClient as _, HubAllowanceSubject as _i, HubGithubAppInstallationResponse as _n, HubPolicyDecision as _r, HubWorkflowProposal as _t, HubChannelsClient as a, HubApp as ai, HubWorkflowRunStreamEvent as an, HubEventSubscriptionFilter as ar, HubWorkflowArtifactRef as at, HubTokensClient as b, HubAllowanceTier as bi, HubGithubAppListReposResponse as bn, HubPolicyListResponse as br, HubWorkflowRevisionSource as bt, HubConnectionsClient as c, HubAppCreateInput as ci, HubWorkflowCondition as cn, HubProviderEvent as cr, HubWorkflowKvEntry as ct, HubInboundWebhookCreateResponse as d, HubAppsClient as di, HubWorkflowGraphEdge as dn, HubApprovalCapabilityToken as dr, HubManualRunInput as dt, HubToolRisk as ei, HubWorkflowRunEnqueued as en, HubEventSubscription as er, HubLineSendInput as et, HubInboundWebhookStatus as f, HubAllowanceDecision as fi, HubWorkflowGraphJoinRule as fn, HubApprovalDecisionResponse as fr, HubWorkflow as ft, HubToolsClient as g, HubAllowanceRole as gi, HubGithubAppInstallation as gn, HubPolicy as gr, HubWorkflowHookEndpoint as gt, HubToolSearchOptions as h, HubAllowancePlanInput as hi, HubGithubAppDisconnectResponse as hn, HubCapabilityToken as hr, HubWorkflowEventFilter as ht, HubGithubAppClient as i, HubToolsSearchResponse as ii, HubWorkflowRunStepsPage as in, HubEventSubscriptionDeleteResponse as ir, HubWorkflowArtifactDownload as it, HubTransport as j, HubConnectionHealthError as jn, HubPrincipalKind as jr, HubAgentIterationSpan as jt, HubClientOptions as k, HubConnection as kn, HubErrorEnvelope as kr, HubWorkflowValidationError as kt, HubInboundPhoneNumberScope as l, HubAppGrant as li, HubWorkflowConditionOp as ln, HubAllowWritesResponse as lr, HubWorkflowKvEntryMeta as lt, HubToolInvokeOptions as m, HubAllowancePlan as mi, HubWorkflowGraphSpec as mn, HubApprovalStatus as mr, HubWorkflowConnectionRequirement as mt, HubWorkflowsClient as n, HubToolSourcesResponse as ni, HubWorkflowRunRetried as nn, HubEventSubscriptionCreateRequest as nr, HubLinesClient as nt, HubEventSubscriptionsClient as o, HubAppComplianceClaim as oi, HubWorkflowRunSummary as on, HubEventSubscriptionSource as or, HubWorkflowArtifactsResponse as ot, HubInboundWebhooksClient as p, HubAllowanceGrant as pi, HubWorkflowGraphNode as pn, HubApprovalListResponse as pr, HubWorkflowAction as pt, HubLineOwnerSendInput as q, HubChannelDeleteResponse as qn, KnowledgeEmbeddingSpace as qr, HubWorkflowNodeHealth as qt, HubAuditClient as r, HubToolsDescribeResponse as ri, HubWorkflowRunStatus as rn, HubEventSubscriptionCreateResponse as rr, HubWorkflowArtifact as rt, HubConnectionStartOptions as s, HubAppComplianceState as si, HubWorkflowRunsPage as sn, HubEventSubscriptionsResponse as sr, HubWorkflowKvDeleteResponse as st, HubClient as t, HubToolSource as ti, HubWorkflowRunInputs as tn, HubEventSubscriptionCallback as tr, HubLineSendReceipt as tt, HubInboundWebhookCreateOptions as u, HubAppGrantRevoked as ui, HubWorkflowConditionScalar as un, HubApproval as ur, HubWorkflowKvListResponse as ut, HubPermissionsClient as v, HubAllowanceSyncInput as vi, HubGithubAppIsRepoInstalledResponse as vn, HubPolicyDeleteRequest as vr, HubWorkflowRevision as vt, HubClientFromEnvOptions as w, HubGithubAppSyncResponse as wn, HubTokenMintResponse as wr, HubWorkflowTemplateCategory as wt, HUB_API_KEY_ENV_VAR as x, HubAllowanceUsage as xi, HubGithubAppManagedInstallation as xn, HubPolicyResponse as xr, HubWorkflowRevisionStatus as xt, HubTokenListOptions as y, HubAllowanceSyncReceipt as yi, HubGithubAppListInstallationsResponse as yn, HubPolicyDeleteResponse as yr, HubWorkflowRevisionMeta as yt, HubNumberResolution as z, HubProviderAuthKind as zn, HubKnowledgeQueryResult as zr, HubWorkflowDecisionStatus as zt };
+//# sourceMappingURL=client-BH3gTLjN.d.ts.map