Proposes

export const integration = defineIntegration({
  // ...
  proposes: {
    // 'account' | 'user' | 'source'
    // Asserts that no handler reads a personal grant or session client
    credentialModel: 'account',

    tools: {
      list_recent_payments: {
        effect: 'read',
        sensitivity: 'financial',
      },
      refund_payment: {
        effect: 'write',
        sensitivity: 'financial',
      },
    },
  },
});

credentialModel: 'account' | 'user' | 'source';

scope: 'user' | 'team';

tools: {
  tool_name: {
    effect: 'read' | 'write',           // Does it modify state?
    sensitivity: 'public' | 'internal' | 'pii' | 'financial',
  },
}

// ❌ Undeclared — workflows cannot call these tools
tools: [
  { name: 'list_payments', async run(ctx, args) { /* … */ } },
]

// ✅ Declared — eligible once a reviewer confirms it
proposes: {
  credentialModel: 'account',
  tools: {
    list_payments: { effect: 'read', sensitivity: 'financial' },
  },
}