@contractspec/lib.contracts-integrations 2.0.0

package/dist/node/index.js

@@ -0,0 +1,3675 @@
+// src/integrations/spec.ts
+import { SpecContractRegistry } from "@contractspec/lib.contracts-spec/registry";
+var integrationKey = (meta) => `${meta.key}.v${meta.version}`;
+
+class IntegrationSpecRegistry extends SpecContractRegistry {
+  constructor(items) {
+    super("integration", items);
+  }
+  getByCategory(category) {
+    return this.list().filter((spec) => spec.meta.category === category);
+  }
+}
+function makeIntegrationSpecKey(meta) {
+  return integrationKey(meta);
+}
+var defineIntegration = (spec) => spec;
+// src/integrations/providers/stripe.ts
+import { StabilityEnum } from "@contractspec/lib.contracts-spec/ownership";
+var stripeIntegrationSpec = defineIntegration({
+  meta: {
+    key: "payments.stripe",
+    version: "1.0.0",
+    category: "payments",
+    title: "Stripe Payments",
+    description: "Stripe integration for payment processing, charges, and payouts.",
+    domain: "payments",
+    owners: ["platform.payments"],
+    tags: ["payments", "psp"],
+    stability: StabilityEnum.Stable
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "payments.psp", version: "1.0.0" }],
+    requires: [
+      {
+        key: "platform.webhooks",
+        optional: true,
+        reason: "Recommended for reliable event ingestion"
+      }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        accountId: {
+          type: "string",
+          description: "Connected account ID when using Stripe Connect (BYOK)."
+        },
+        region: {
+          type: "string",
+          description: "Optional Stripe region or data residency hint."
+        }
+      }
+    },
+    example: {
+      accountId: "acct_123",
+      region: "us-east-1"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey", "webhookSecret"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Stripe secret API key (sk_live_... or sk_test_...)."
+        },
+        webhookSecret: {
+          type: "string",
+          description: "Signing secret for webhook verification."
+        }
+      }
+    },
+    example: {
+      apiKey: "sk_live_***",
+      webhookSecret: "whsec_***"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://stripe.com/docs/api",
+  constraints: {
+    rateLimit: {
+      rpm: 1000,
+      rph: 20000
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create a restricted Stripe API key with write access to Charges and provide a webhook signing secret.",
+    requiredScopes: ["charges:write", "customers:read"]
+  }
+});
+function registerStripeIntegration(registry) {
+  return registry.register(stripeIntegrationSpec);
+}
+
+// src/integrations/providers/postmark.ts
+import { StabilityEnum as StabilityEnum2 } from "@contractspec/lib.contracts-spec/ownership";
+var postmarkIntegrationSpec = defineIntegration({
+  meta: {
+    key: "email.postmark",
+    version: "1.0.0",
+    category: "email",
+    title: "Postmark Transactional Email",
+    description: "Postmark integration for transactional email delivery.",
+    domain: "communications",
+    owners: ["platform.messaging"],
+    tags: ["email", "transactional"],
+    stability: StabilityEnum2.Stable
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "email.transactional", version: "1.0.0" }],
+    requires: [
+      {
+        key: "platform.webhooks",
+        optional: true,
+        reason: "Optional for inbound bounce handling"
+      }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        messageStream: {
+          type: "string",
+          description: "Optional message stream identifier (e.g., transactional)."
+        },
+        fromEmail: {
+          type: "string",
+          description: "Default From address used for outbound messages."
+        }
+      }
+    },
+    example: {
+      messageStream: "outbound",
+      fromEmail: "notifications@example.com"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["serverToken"],
+      properties: {
+        serverToken: {
+          type: "string",
+          description: "Server token for the Postmark account."
+        }
+      }
+    },
+    example: {
+      serverToken: "server-***"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 3000
+  },
+  docsUrl: "https://postmarkapp.com/developer",
+  constraints: {
+    rateLimit: {
+      rpm: 500
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create a Postmark server token with outbound send permissions and configure allowed from addresses."
+  }
+});
+function registerPostmarkIntegration(registry) {
+  return registry.register(postmarkIntegrationSpec);
+}
+
+// src/integrations/providers/qdrant.ts
+import { StabilityEnum as StabilityEnum3 } from "@contractspec/lib.contracts-spec/ownership";
+var qdrantIntegrationSpec = defineIntegration({
+  meta: {
+    key: "vectordb.qdrant",
+    version: "1.0.0",
+    category: "vector-db",
+    title: "Qdrant Vector Database",
+    description: "Qdrant integration for vector search and embeddings storage.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["vector-db", "search"],
+    stability: StabilityEnum3.Experimental
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [
+      { key: "vector-db.search", version: "1.0.0" },
+      { key: "vector-db.storage", version: "1.0.0" }
+    ],
+    requires: [
+      {
+        key: "ai.embeddings",
+        optional: true,
+        reason: "Required if vectors are generated via hosted embedding services"
+      }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        apiUrl: {
+          type: "string",
+          description: "Base URL for the Qdrant instance (e.g., https://qdrant.example.com)."
+        },
+        collectionPrefix: {
+          type: "string",
+          description: "Prefix applied to all collection names for this tenant."
+        }
+      }
+    },
+    example: {
+      apiUrl: "https://qdrant.example.com",
+      collectionPrefix: "tenant_"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "API key or token when authentication is enabled."
+        }
+      }
+    },
+    example: {
+      apiKey: "qdrant-api-key"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://qdrant.tech/documentation/quick-start/",
+  constraints: {
+    quotas: {
+      collections: 100,
+      pointsPerCollection: 1e6
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Provide the HTTPS endpoint of your Qdrant cluster and generate an API key with read/write access to the collections that will be managed."
+  }
+});
+function registerQdrantIntegration(registry) {
+  return registry.register(qdrantIntegrationSpec);
+}
+
+// src/integrations/providers/supabase-vector.ts
+import { StabilityEnum as StabilityEnum4 } from "@contractspec/lib.contracts-spec/ownership";
+var supabaseVectorIntegrationSpec = defineIntegration({
+  meta: {
+    key: "vectordb.supabase",
+    version: "1.0.0",
+    category: "vector-db",
+    title: "Supabase Vector Database (pgvector)",
+    description: "Supabase integration for embedding storage and vector similarity search using pgvector.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["vector-db", "supabase", "pgvector"],
+    stability: StabilityEnum4.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [
+      { key: "vector-db.search", version: "1.0.0" },
+      { key: "vector-db.storage", version: "1.0.0" }
+    ],
+    requires: [
+      {
+        key: "ai.embeddings",
+        optional: true,
+        reason: "Required when vectors are generated by a hosted embedding provider."
+      }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        schema: {
+          type: "string",
+          description: "Schema name containing the pgvector table (default: public)."
+        },
+        table: {
+          type: "string",
+          description: "Table used to store vectors and metadata (default: contractspec_vectors)."
+        },
+        createTableIfMissing: {
+          type: "boolean",
+          description: "Automatically create pgvector extension and table when first writing vectors."
+        },
+        distanceMetric: {
+          type: "string",
+          enum: ["cosine", "l2", "inner_product"],
+          description: "Distance metric used for nearest-neighbor search."
+        }
+      }
+    },
+    example: {
+      schema: "public",
+      table: "contractspec_vectors",
+      createTableIfMissing: true,
+      distanceMetric: "cosine"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["databaseUrl"],
+      properties: {
+        databaseUrl: {
+          type: "string",
+          description: "Supabase Postgres connection string with privileges to read/write vector rows."
+        }
+      }
+    },
+    example: {
+      databaseUrl: "postgresql://postgres.[project-ref]:password@aws-0-region.pooler.supabase.com:6543/postgres"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://supabase.com/docs/guides/ai/vector-columns",
+  byokSetup: {
+    setupInstructions: "Create or reuse a Supabase project, enable pgvector, and provide a Postgres connection string with read/write access to the target vector table."
+  }
+});
+function registerSupabaseVectorIntegration(registry) {
+  return registry.register(supabaseVectorIntegrationSpec);
+}
+
+// src/integrations/providers/supabase-postgres.ts
+import { StabilityEnum as StabilityEnum5 } from "@contractspec/lib.contracts-spec/ownership";
+var supabasePostgresIntegrationSpec = defineIntegration({
+  meta: {
+    key: "database.supabase",
+    version: "1.0.0",
+    category: "database",
+    title: "Supabase Postgres",
+    description: "Supabase Postgres integration for SQL query execution and transactional workloads.",
+    domain: "infrastructure",
+    owners: ["platform.infrastructure"],
+    tags: ["database", "postgres", "supabase"],
+    stability: StabilityEnum5.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "database.sql", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        maxConnections: {
+          type: "number",
+          description: "Optional connection pool size when opening a Postgres client to Supabase."
+        },
+        sslMode: {
+          type: "string",
+          enum: ["require", "allow", "prefer"],
+          description: "TLS mode used by the Postgres client."
+        }
+      }
+    },
+    example: {
+      maxConnections: 10,
+      sslMode: "require"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["databaseUrl"],
+      properties: {
+        databaseUrl: {
+          type: "string",
+          description: "Supabase Postgres connection string (transaction or session pooler endpoint)."
+        }
+      }
+    },
+    example: {
+      databaseUrl: "postgresql://postgres.[project-ref]:password@aws-0-region.pooler.supabase.com:6543/postgres"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://supabase.com/docs/guides/database/connecting-to-postgres",
+  byokSetup: {
+    setupInstructions: "Create or reuse a Supabase project and provide a Postgres connection string with permissions aligned to your workload."
+  }
+});
+function registerSupabasePostgresIntegration(registry) {
+  return registry.register(supabasePostgresIntegrationSpec);
+}
+
+// src/integrations/providers/mistral.ts
+import { StabilityEnum as StabilityEnum6 } from "@contractspec/lib.contracts-spec/ownership";
+var mistralIntegrationSpec = defineIntegration({
+  meta: {
+    key: "ai-llm.mistral",
+    version: "1.0.0",
+    category: "ai-llm",
+    title: "Mistral Large Language Model",
+    description: "Mistral integration providing chat completions and embedding generation.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["ai", "llm", "embeddings"],
+    stability: StabilityEnum6.Experimental
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [
+      { key: "ai.chat", version: "1.0.0" },
+      { key: "ai.embeddings", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        model: {
+          type: "string",
+          description: "Default chat completion model (e.g., mistral-large-latest)."
+        },
+        embeddingModel: {
+          type: "string",
+          description: "Embedding model identifier."
+        }
+      }
+    },
+    example: {
+      model: "mistral-large-latest",
+      embeddingModel: "mistral-embed"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Mistral API key with access to chat and embeddings endpoints."
+        }
+      }
+    },
+    example: {
+      apiKey: "mistral-***"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://docs.mistral.ai/platform/endpoints",
+  constraints: {
+    rateLimit: {
+      rpm: 600
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Generate an API key within the Mistral console and ensure the selected models are enabled for the account."
+  }
+});
+function registerMistralIntegration(registry) {
+  return registry.register(mistralIntegrationSpec);
+}
+
+// src/integrations/providers/elevenlabs.ts
+import { StabilityEnum as StabilityEnum7 } from "@contractspec/lib.contracts-spec/ownership";
+var elevenLabsIntegrationSpec = defineIntegration({
+  meta: {
+    key: "ai-voice.elevenlabs",
+    version: "1.0.0",
+    category: "ai-voice",
+    title: "ElevenLabs Text-to-Speech",
+    description: "ElevenLabs integration for neural voice synthesis and voice catalog access.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["voice", "tts"],
+    stability: StabilityEnum7.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "ai.voice.synthesis", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        defaultVoiceId: {
+          type: "string",
+          description: "Optional default voice identifier for synthesis requests."
+        }
+      }
+    },
+    example: {
+      defaultVoiceId: "pNInz6obpgDQGcFmaJgB"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "ElevenLabs API key with text-to-speech permissions."
+        }
+      }
+    },
+    example: {
+      apiKey: "eleven-***"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://elevenlabs.io/docs/api-reference/text-to-speech",
+  constraints: {
+    rateLimit: {
+      rpm: 120
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create an ElevenLabs API key and ensure the desired voices are accessible to the key scope."
+  }
+});
+function registerElevenLabsIntegration(registry) {
+  return registry.register(elevenLabsIntegrationSpec);
+}
+
+// src/integrations/providers/gradium.ts
+import { StabilityEnum as StabilityEnum8 } from "@contractspec/lib.contracts-spec/ownership";
+var gradiumIntegrationSpec = defineIntegration({
+  meta: {
+    key: "ai-voice.gradium",
+    version: "1.0.0",
+    category: "ai-voice",
+    title: "Gradium Text-to-Speech",
+    description: "Gradium integration for low-latency voice synthesis and voice catalog access.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["voice", "tts", "realtime"],
+    stability: StabilityEnum8.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [{ key: "ai.voice.synthesis", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        defaultVoiceId: {
+          type: "string",
+          description: "Optional default voice identifier used for synthesis."
+        },
+        region: {
+          type: "string",
+          enum: ["eu", "us"],
+          description: "Gradium region used by the SDK (eu or us)."
+        },
+        baseUrl: {
+          type: "string",
+          description: "Optional API base URL override for private routing or proxies."
+        },
+        timeoutMs: {
+          type: "number",
+          description: "Optional request timeout in milliseconds."
+        },
+        outputFormat: {
+          type: "string",
+          enum: [
+            "wav",
+            "pcm",
+            "opus",
+            "ulaw_8000",
+            "alaw_8000",
+            "pcm_16000",
+            "pcm_24000"
+          ],
+          description: "Optional default output format used when no format is specified."
+        }
+      }
+    },
+    example: {
+      defaultVoiceId: "YTpq7expH9539ERJ",
+      region: "eu",
+      timeoutMs: 15000,
+      outputFormat: "wav"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Gradium API key with TTS access."
+        }
+      }
+    },
+    example: {
+      apiKey: "gd_***"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://gradium.ai/api_docs.html",
+  byokSetup: {
+    setupInstructions: "Create a Gradium API key, select the target region, and store credentials in your tenant secret provider."
+  }
+});
+function registerGradiumIntegration(registry) {
+  return registry.register(gradiumIntegrationSpec);
+}
+
+// src/integrations/providers/fal.ts
+import { StabilityEnum as StabilityEnum9 } from "@contractspec/lib.contracts-spec/ownership";
+var falIntegrationSpec = defineIntegration({
+  meta: {
+    key: "ai-voice.fal",
+    version: "1.0.0",
+    category: "ai-voice",
+    title: "Fal Chatterbox Text-to-Speech",
+    description: "Fal integration for voice synthesis using Chatterbox text-to-speech models.",
+    domain: "ai",
+    owners: ["platform.ai"],
+    tags: ["voice", "tts", "chatterbox"],
+    stability: StabilityEnum9.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [{ key: "ai.voice.synthesis", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        modelId: {
+          type: "string",
+          description: "Fal model endpoint identifier (e.g. fal-ai/chatterbox/text-to-speech)."
+        },
+        defaultVoiceUrl: {
+          type: "string",
+          description: "Optional reference audio URL used as default voice conditioning input."
+        },
+        defaultExaggeration: {
+          type: "number",
+          minimum: 0,
+          maximum: 1,
+          description: "Optional default exaggeration value for speech output."
+        },
+        defaultTemperature: {
+          type: "number",
+          minimum: 0.05,
+          maximum: 2,
+          description: "Optional default temperature for synthesis requests."
+        },
+        defaultCfg: {
+          type: "number",
+          minimum: 0.1,
+          maximum: 1,
+          description: "Optional default cfg value for synthesis requests."
+        },
+        pollIntervalMs: {
+          type: "number",
+          description: "Optional queue polling interval in milliseconds."
+        }
+      }
+    },
+    example: {
+      modelId: "fal-ai/chatterbox/text-to-speech",
+      defaultVoiceUrl: "https://storage.googleapis.com/chatterbox-demo-samples/prompts/male_rickmorty.mp3",
+      defaultExaggeration: 0.25,
+      defaultTemperature: 0.7,
+      defaultCfg: 0.5,
+      pollIntervalMs: 1000
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Fal API key (FAL_KEY)."
+        }
+      }
+    },
+    example: {
+      apiKey: "key-id:key-secret"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 7000
+  },
+  docsUrl: "https://fal.ai/models/fal-ai/chatterbox/text-to-speech/api",
+  byokSetup: {
+    setupInstructions: "Create a Fal API key and configure the desired voice model endpoint before connecting tenants."
+  }
+});
+function registerFalIntegration(registry) {
+  return registry.register(falIntegrationSpec);
+}
+
+// src/integrations/providers/gmail.ts
+import { StabilityEnum as StabilityEnum10 } from "@contractspec/lib.contracts-spec/ownership";
+var gmailIntegrationSpec = defineIntegration({
+  meta: {
+    key: "email.gmail",
+    version: "1.0.0",
+    category: "email",
+    title: "Google Gmail API",
+    description: "Gmail integration supporting inbound thread ingestion and outbound transactional email.",
+    domain: "communications",
+    owners: ["platform.messaging"],
+    tags: ["email", "gmail"],
+    stability: StabilityEnum10.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [
+      { key: "email.inbound", version: "1.0.0" },
+      { key: "email.outbound", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        labelIds: {
+          type: "array",
+          items: { type: "string" },
+          description: "Optional list of label IDs to scope inbound sync."
+        },
+        includeSpamTrash: {
+          type: "boolean",
+          description: "Whether to include spam or trash messages during sync."
+        }
+      }
+    },
+    example: {
+      labelIds: ["INBOX"],
+      includeSpamTrash: false
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["clientId", "clientSecret", "refreshToken"],
+      properties: {
+        clientId: {
+          type: "string",
+          description: "OAuth client ID for the Google Cloud project."
+        },
+        clientSecret: {
+          type: "string",
+          description: "OAuth client secret for the Google Cloud project."
+        },
+        refreshToken: {
+          type: "string",
+          description: "OAuth refresh token for delegated Gmail access."
+        },
+        redirectUri: {
+          type: "string",
+          description: "Optional redirect URI used when issuing the refresh token."
+        }
+      }
+    },
+    example: {
+      clientId: "xxx.apps.googleusercontent.com",
+      clientSecret: "secret",
+      refreshToken: "refresh-token"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://developers.google.com/gmail/api",
+  constraints: {
+    rateLimit: {
+      rpm: 600
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create an OAuth consent screen and credentials within Google Cloud Console, then authorize the Gmail scopes and store the resulting refresh token."
+  }
+});
+function registerGmailIntegration(registry) {
+  return registry.register(gmailIntegrationSpec);
+}
+
+// src/integrations/providers/google-calendar.ts
+import { StabilityEnum as StabilityEnum11 } from "@contractspec/lib.contracts-spec/ownership";
+var googleCalendarIntegrationSpec = defineIntegration({
+  meta: {
+    key: "calendar.google",
+    version: "1.0.0",
+    category: "calendar",
+    title: "Google Calendar API",
+    description: "Google Calendar integration for event creation, updates, and scheduling automations.",
+    domain: "productivity",
+    owners: ["platform.messaging"],
+    tags: ["calendar", "google"],
+    stability: StabilityEnum11.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "calendar.events", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        calendarId: {
+          type: "string",
+          description: "Default calendar identifier (defaults to primary)."
+        }
+      }
+    },
+    example: {
+      calendarId: "primary"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["clientEmail", "privateKey"],
+      properties: {
+        clientEmail: {
+          type: "string",
+          description: "Service account client email."
+        },
+        privateKey: {
+          type: "string",
+          description: "Service account private key."
+        },
+        projectId: {
+          type: "string",
+          description: "Google Cloud project ID."
+        }
+      }
+    },
+    example: {
+      clientEmail: "svc-calendar@example.iam.gserviceaccount.com",
+      privateKey: "-----BEGIN PRIVATE KEY-----...",
+      projectId: "calendar-project"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://developers.google.com/calendar/api",
+  constraints: {},
+  byokSetup: {
+    setupInstructions: "Create a Google service account with Calendar access and share the target calendars with the service account email."
+  }
+});
+function registerGoogleCalendarIntegration(registry) {
+  return registry.register(googleCalendarIntegrationSpec);
+}
+
+// src/integrations/providers/twilio-sms.ts
+import { StabilityEnum as StabilityEnum12 } from "@contractspec/lib.contracts-spec/ownership";
+var twilioSmsIntegrationSpec = defineIntegration({
+  meta: {
+    key: "sms.twilio",
+    version: "1.0.0",
+    category: "sms",
+    title: "Twilio Messaging",
+    description: "Twilio SMS integration for transactional and notification messaging.",
+    domain: "communications",
+    owners: ["platform.messaging"],
+    tags: ["sms", "messaging"],
+    stability: StabilityEnum12.Stable
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "sms.outbound", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        fromNumber: {
+          type: "string",
+          description: "Default Twilio phone number used as sender."
+        }
+      }
+    },
+    example: {
+      fromNumber: "+15551234567"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["accountSid", "authToken"],
+      properties: {
+        accountSid: {
+          type: "string",
+          description: "Twilio Account SID."
+        },
+        authToken: {
+          type: "string",
+          description: "Twilio Auth Token."
+        }
+      }
+    },
+    example: {
+      accountSid: "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+      authToken: "auth-token"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 3000
+  },
+  docsUrl: "https://www.twilio.com/docs/sms/api",
+  constraints: {
+    rateLimit: {
+      rpm: 200
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Provide a Twilio account SID, auth token, and verify the outbound sending numbers used by the integration."
+  }
+});
+function registerTwilioSmsIntegration(registry) {
+  return registry.register(twilioSmsIntegrationSpec);
+}
+
+// src/integrations/providers/gcs-storage.ts
+import { StabilityEnum as StabilityEnum13 } from "@contractspec/lib.contracts-spec/ownership";
+var gcsStorageIntegrationSpec = defineIntegration({
+  meta: {
+    key: "storage.gcs",
+    version: "1.0.0",
+    category: "storage",
+    title: "Google Cloud Storage Buckets",
+    description: "Google Cloud Storage integration for object storage and retrieval.",
+    domain: "infrastructure",
+    owners: ["platform.infrastructure"],
+    tags: ["storage", "gcs", "google-cloud"],
+    stability: StabilityEnum13.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "storage.objects", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      required: ["bucket"],
+      properties: {
+        bucket: {
+          type: "string",
+          description: "Primary bucket name used for storing objects."
+        },
+        prefix: {
+          type: "string",
+          description: "Optional prefix applied to object keys."
+        }
+      }
+    },
+    example: {
+      bucket: "pfo-tenant-assets",
+      prefix: "documents/"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        type: {
+          type: "string",
+          description: "Service account type field from Google credentials JSON (if provided)."
+        },
+        client_email: { type: "string" },
+        private_key: { type: "string" },
+        project_id: { type: "string" }
+      }
+    },
+    example: {
+      type: "service_account",
+      client_email: "svc-account@example.iam.gserviceaccount.com",
+      private_key: "-----BEGIN PRIVATE KEY-----...",
+      project_id: "example-project"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://cloud.google.com/storage/docs/apis",
+  constraints: {
+    quotas: {
+      storageGb: 5120
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create a Google Cloud service account with Storage Object Admin role and upload the JSON credentials to the secret store."
+  }
+});
+function registerGcsStorageIntegration(registry) {
+  return registry.register(gcsStorageIntegrationSpec);
+}
+
+// src/integrations/providers/powens.ts
+import { StabilityEnum as StabilityEnum14 } from "@contractspec/lib.contracts-spec/ownership";
+var powensIntegrationSpec = defineIntegration({
+  meta: {
+    key: "openbanking.powens",
+    version: "1.0.0",
+    category: "open-banking",
+    title: "Powens Open Banking (Read)",
+    description: "Read-only Open Banking integration powered by Powens, exposing accounts, transactions, and balances.",
+    domain: "finance",
+    owners: ["platform.finance"],
+    tags: ["open-banking", "powens", "finance"],
+    stability: StabilityEnum14.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [
+      { key: "openbanking.accounts.read", version: "1.0.0" },
+      { key: "openbanking.transactions.read", version: "1.0.0" },
+      { key: "openbanking.balances.read", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      required: ["environment"],
+      properties: {
+        environment: {
+          type: "string",
+          enum: ["sandbox", "production"],
+          description: "Powens environment to target. Sandbox uses Powens test API base URL, production uses live endpoints."
+        },
+        baseUrl: {
+          type: "string",
+          description: "Optional override for the Powens API base URL. Defaults to Powens environment defaults."
+        },
+        region: {
+          type: "string",
+          description: "Optional Powens region identifier when targeting a specific data residency cluster."
+        },
+        pollingIntervalMs: {
+          type: "number",
+          description: "Optional custom polling interval in milliseconds for background sync jobs (defaults to platform standard)."
+        }
+      }
+    },
+    example: {
+      environment: "sandbox",
+      baseUrl: "https://api-sandbox.powens.com/v2",
+      region: "eu-west-1",
+      pollingIntervalMs: 300000
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["clientId", "clientSecret"],
+      properties: {
+        clientId: {
+          type: "string",
+          description: "Powens OAuth client identifier obtained from the Powens Console (BYOK project)."
+        },
+        clientSecret: {
+          type: "string",
+          description: "Powens OAuth client secret used to exchange for access tokens."
+        },
+        apiKey: {
+          type: "string",
+          description: "Optional Powens API key (if the tenant project exposes a dedicated API token)."
+        },
+        webhookSecret: {
+          type: "string",
+          description: "Optional webhook signing secret used to verify Powens webhook payloads."
+        }
+      }
+    },
+    example: {
+      clientId: "powens-client-id",
+      clientSecret: "powens-client-secret",
+      apiKey: "powens-api-key",
+      webhookSecret: "powens-webhook-secret"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 8000
+  },
+  docsUrl: "https://docs.powens.com/",
+  constraints: {
+    rateLimit: {
+      rph: 1e4,
+      rpm: 600
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Create a Powens BYOK project, generate OAuth credentials, and optionally configure webhook delivery for account/transaction updates.",
+    requiredScopes: ["accounts:read", "transactions:read", "balances:read"]
+  }
+});
+function registerPowensIntegration(registry) {
+  return registry.register(powensIntegrationSpec);
+}
+
+// src/integrations/providers/posthog.ts
+import { StabilityEnum as StabilityEnum15 } from "@contractspec/lib.contracts-spec/ownership";
+var posthogIntegrationSpec = defineIntegration({
+  meta: {
+    key: "analytics.posthog",
+    version: "1.1.0",
+    category: "analytics",
+    title: "PostHog",
+    description: "PostHog integration for product analytics, feature flags, HogQL queries, and LLM analytics with evaluations.",
+    domain: "analytics",
+    owners: ["@platform.integrations"],
+    tags: ["analytics", "posthog", "llm", "ai"],
+    stability: StabilityEnum15.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [
+      { key: "analytics.events", version: "1.0.0" },
+      { key: "analytics.feature-flags", version: "1.0.0" },
+      { key: "analytics.query", version: "1.0.0" },
+      { key: "analytics.events.read", version: "1.0.0" },
+      { key: "analytics.persons", version: "1.0.0" },
+      { key: "analytics.insights", version: "1.0.0" },
+      { key: "analytics.cohorts", version: "1.0.0" },
+      { key: "analytics.annotations", version: "1.0.0" },
+      { key: "analytics.llm-tracing", version: "1.0.0" },
+      { key: "analytics.llm-evaluations", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        host: {
+          type: "string",
+          description: "PostHog host (e.g., https://app.posthog.com or self-hosted URL)."
+        },
+        projectId: {
+          type: "string",
+          description: "PostHog project ID for API queries."
+        },
+        mcpUrl: {
+          type: "string",
+          description: "Optional MCP endpoint URL for PostHog tools."
+        }
+      }
+    },
+    example: {
+      host: "https://app.posthog.com",
+      projectId: "12345"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["personalApiKey"],
+      properties: {
+        personalApiKey: {
+          type: "string",
+          description: "PostHog personal API key (required for API reads/writes)."
+        },
+        projectApiKey: {
+          type: "string",
+          description: "PostHog project API key (required for capture/ingest events)."
+        }
+      }
+    },
+    example: {
+      personalApiKey: "phx_personal_api_key",
+      projectApiKey: "phc_project_api_key"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 5000
+  },
+  docsUrl: "https://posthog.com/docs",
+  byokSetup: {
+    setupInstructions: "Generate a PostHog personal API key for read/write operations and a project API key for event capture."
+  }
+});
+function registerPosthogIntegration(registry) {
+  return registry.register(posthogIntegrationSpec);
+}
+
+// src/integrations/providers/posthog-llm-telemetry.ts
+import { StabilityEnum as StabilityEnum16 } from "@contractspec/lib.contracts-spec/ownership";
+var posthogLLMTelemetrySpec = {
+  meta: {
+    key: "analytics.posthog.llm",
+    version: "1.0.0",
+    title: "PostHog LLM Analytics Telemetry",
+    description: "Telemetry events for PostHog LLM Analytics: generation tracing, token usage, and evaluation-ready metadata.",
+    domain: "analytics",
+    owners: ["@platform.integrations"],
+    tags: ["analytics", "posthog", "llm", "ai", "telemetry"],
+    stability: StabilityEnum16.Beta
+  },
+  events: [
+    {
+      key: "posthog.llm.generation",
+      version: "1.0.0",
+      semantics: {
+        who: "AI agent or LLM consumer",
+        what: "Captures an LLM generation call with full observability metadata",
+        why: "Enable LLM performance monitoring, cost tracking, and automated quality evaluations via PostHog"
+      },
+      properties: {
+        $ai_model: {
+          type: "string",
+          required: true,
+          description: "The LLM model identifier (e.g., gpt-4o, claude-sonnet-4-20250514)"
+        },
+        $ai_provider: {
+          type: "string",
+          required: true,
+          description: "The LLM provider (e.g., openai, anthropic, contractspec)"
+        },
+        $ai_latency: {
+          type: "number",
+          required: false,
+          description: "LLM call latency in seconds"
+        },
+        $ai_input_tokens: {
+          type: "number",
+          required: false,
+          description: "Number of input/prompt tokens consumed"
+        },
+        $ai_output_tokens: {
+          type: "number",
+          required: false,
+          description: "Number of output/completion tokens generated"
+        },
+        $ai_total_cost_usd: {
+          type: "number",
+          required: false,
+          description: "Total cost in USD (input + output)"
+        },
+        $ai_is_error: {
+          type: "boolean",
+          required: false,
+          description: "Whether the generation resulted in an error"
+        },
+        $ai_trace_id: {
+          type: "string",
+          required: false,
+          description: "Trace ID for grouping related generations"
+        },
+        $ai_stream: {
+          type: "boolean",
+          required: false,
+          description: "Whether the response was streamed"
+        },
+        $ai_time_to_first_token: {
+          type: "number",
+          required: false,
+          description: "Time to first token in seconds (streaming only)"
+        },
+        $ai_tools: {
+          type: "json",
+          required: false,
+          description: "Tools/functions available to the LLM"
+        },
+        $ai_input: {
+          type: "json",
+          required: false,
+          pii: true,
+          redact: true,
+          description: "Messages sent to the LLM (may contain PII)"
+        },
+        $ai_output_choices: {
+          type: "json",
+          required: false,
+          pii: true,
+          redact: true,
+          description: "Response choices from the LLM (may contain PII)"
+        },
+        contractspec_operation: {
+          type: "string",
+          required: false,
+          description: "ContractSpec operation name"
+        },
+        contractspec_version: {
+          type: "string",
+          required: false,
+          description: "ContractSpec operation version"
+        },
+        contractspec_agent_id: {
+          type: "string",
+          required: false,
+          description: "ContractSpec agent identifier"
+        },
+        contractspec_finish_reason: {
+          type: "string",
+          required: false,
+          description: "AI SDK finish reason (stop, tool-calls, error, etc.)"
+        },
+        contractspec_tool_count: {
+          type: "number",
+          required: false,
+          description: "Number of tool calls made in this step"
+        }
+      },
+      privacy: "internal",
+      tags: ["llm", "generation", "posthog"]
+    }
+  ],
+  config: {
+    defaultRetentionDays: 90,
+    defaultSamplingRate: 1,
+    providers: [
+      {
+        type: "posthog",
+        config: {
+          eventName: "$ai_generation",
+          enableEvaluations: true,
+          evaluationTemplates: [
+            "relevance",
+            "helpfulness",
+            "jailbreak",
+            "hallucination",
+            "toxicity"
+          ]
+        }
+      }
+    ]
+  }
+};
+var POSTHOG_LLM_PII_FIELDS = [
+  "$ai_input",
+  "$ai_output_choices"
+];
+var POSTHOG_LLM_TELEMETRY_EVENTS = {
+  generation: "$ai_generation",
+  span: "$ai_span",
+  evaluation: "$ai_evaluation"
+};
+var POSTHOG_EVALUATION_TEMPLATES = {
+  relevance: "relevance",
+  helpfulness: "helpfulness",
+  jailbreak: "jailbreak",
+  hallucination: "hallucination",
+  toxicity: "toxicity"
+};
+function redactPostHogLLMTelemetryPayload(payload) {
+  const redacted = { ...payload };
+  for (const field of POSTHOG_LLM_PII_FIELDS) {
+    if (field in redacted) {
+      redacted[field] = "[REDACTED]";
+    }
+  }
+  return redacted;
+}
+
+// src/integrations/providers/linear.ts
+import { StabilityEnum as StabilityEnum17 } from "@contractspec/lib.contracts-spec/ownership";
+var linearIntegrationSpec = defineIntegration({
+  meta: {
+    key: "project-management.linear",
+    version: "1.0.0",
+    category: "project-management",
+    title: "Linear",
+    description: "Linear integration for issue tracking and project management workflows.",
+    domain: "productivity",
+    owners: ["@platform.integrations"],
+    tags: ["project-management", "linear"],
+    stability: StabilityEnum17.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "project-management.work-items", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      required: ["teamId"],
+      properties: {
+        teamId: {
+          type: "string",
+          description: "Linear team ID that owns created issues."
+        },
+        projectId: {
+          type: "string",
+          description: "Optional default project ID for new issues."
+        },
+        stateId: {
+          type: "string",
+          description: "Optional default workflow state ID."
+        },
+        assigneeId: {
+          type: "string",
+          description: "Optional default assignee ID."
+        },
+        labelIds: {
+          type: "array",
+          items: { type: "string" },
+          description: "Optional label IDs applied to each issue."
+        },
+        tagLabelMap: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          description: "Optional mapping of tags to Linear label IDs (tag -> labelId)."
+        }
+      }
+    },
+    example: {
+      teamId: "team_123",
+      projectId: "proj_456",
+      labelIds: ["label_1", "label_2"]
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Linear API key (personal or service token)."
+        }
+      }
+    },
+    example: {
+      apiKey: "lin_api_key"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://developers.linear.app",
+  constraints: {},
+  byokSetup: {
+    setupInstructions: "Create a Linear API key with issue:write permission and store it as a secret."
+  }
+});
+function registerLinearIntegration(registry) {
+  return registry.register(linearIntegrationSpec);
+}
+
+// src/integrations/providers/jira.ts
+import { StabilityEnum as StabilityEnum18 } from "@contractspec/lib.contracts-spec/ownership";
+var jiraIntegrationSpec = defineIntegration({
+  meta: {
+    key: "project-management.jira",
+    version: "1.0.0",
+    category: "project-management",
+    title: "Jira Cloud",
+    description: "Jira Cloud integration for creating and tracking work items.",
+    domain: "productivity",
+    owners: ["@platform.integrations"],
+    tags: ["project-management", "jira"],
+    stability: StabilityEnum18.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "project-management.work-items", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      required: ["siteUrl"],
+      properties: {
+        siteUrl: {
+          type: "string",
+          description: "Jira Cloud site URL (e.g., https://acme.atlassian.net)."
+        },
+        projectKey: {
+          type: "string",
+          description: "Default Jira project key for new issues."
+        },
+        issueType: {
+          type: "string",
+          description: "Default Jira issue type (e.g., Task, Story)."
+        },
+        defaultLabels: {
+          type: "array",
+          items: { type: "string" },
+          description: "Labels applied to each issue by default."
+        },
+        issueTypeMap: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          description: "Optional mapping from work item types to Jira issue types."
+        }
+      }
+    },
+    example: {
+      siteUrl: "https://acme.atlassian.net",
+      projectKey: "PM",
+      issueType: "Task"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["email", "apiToken"],
+      properties: {
+        email: {
+          type: "string",
+          description: "Jira account email used for API token auth."
+        },
+        apiToken: {
+          type: "string",
+          description: "Jira Cloud API token for the account."
+        }
+      }
+    },
+    example: {
+      email: "user@acme.com",
+      apiToken: "jira_api_token"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://developer.atlassian.com/cloud/jira/platform/rest/v3/intro/",
+  constraints: {},
+  byokSetup: {
+    setupInstructions: "Create a Jira API token and store it with the associated account email."
+  }
+});
+function registerJiraIntegration(registry) {
+  return registry.register(jiraIntegrationSpec);
+}
+
+// src/integrations/providers/notion.ts
+import { StabilityEnum as StabilityEnum19 } from "@contractspec/lib.contracts-spec/ownership";
+var notionIntegrationSpec = defineIntegration({
+  meta: {
+    key: "project-management.notion",
+    version: "1.0.0",
+    category: "project-management",
+    title: "Notion",
+    description: "Notion integration for creating shared project summaries and task entries.",
+    domain: "productivity",
+    owners: ["@platform.integrations"],
+    tags: ["project-management", "notion"],
+    stability: StabilityEnum19.Beta
+  },
+  supportedModes: ["managed", "byok"],
+  capabilities: {
+    provides: [{ key: "project-management.work-items", version: "1.0.0" }]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        databaseId: {
+          type: "string",
+          description: "Optional Notion database ID to store tasks."
+        },
+        summaryParentPageId: {
+          type: "string",
+          description: "Optional parent page ID for summary pages."
+        },
+        titleProperty: {
+          type: "string",
+          description: 'Database title property name (defaults to "Name").'
+        },
+        statusProperty: {
+          type: "string",
+          description: "Database status/select property name."
+        },
+        priorityProperty: {
+          type: "string",
+          description: "Database priority/select property name."
+        },
+        tagsProperty: {
+          type: "string",
+          description: "Database multi-select tags property name."
+        },
+        dueDateProperty: {
+          type: "string",
+          description: "Database date property name for due dates."
+        },
+        descriptionProperty: {
+          type: "string",
+          description: "Database rich-text property for descriptions."
+        }
+      }
+    },
+    example: {
+      databaseId: "xxxxxxxxxxxxxxxx",
+      summaryParentPageId: "yyyyyyyyyyyyyyyy",
+      titleProperty: "Name",
+      statusProperty: "Status"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Notion integration secret token."
+        }
+      }
+    },
+    example: {
+      apiKey: "secret_notion_token"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 4000
+  },
+  docsUrl: "https://developers.notion.com",
+  constraints: {},
+  byokSetup: {
+    setupInstructions: "Create a Notion internal integration, share the target database/page with it, and store the secret token."
+  }
+});
+function registerNotionIntegration(registry) {
+  return registry.register(notionIntegrationSpec);
+}
+
+// src/integrations/providers/granola.ts
+import { StabilityEnum as StabilityEnum20 } from "@contractspec/lib.contracts-spec/ownership";
+var granolaIntegrationSpec = defineIntegration({
+  meta: {
+    key: "meeting-recorder.granola",
+    version: "1.0.0",
+    category: "meeting-recorder",
+    title: "Granola Meeting Notes",
+    description: "Granola meeting notes and transcripts via Enterprise API or MCP transport.",
+    domain: "productivity",
+    owners: ["platform.integrations"],
+    tags: ["meeting-recorder", "granola", "transcripts"],
+    stability: StabilityEnum20.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [
+      { key: "meeting-recorder.meetings.read", version: "1.0.0" },
+      { key: "meeting-recorder.transcripts.read", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        baseUrl: {
+          type: "string",
+          description: "Optional override for the Granola API base URL. Defaults to https://public-api.granola.ai for API transport."
+        },
+        transport: {
+          type: "string",
+          enum: ["api", "mcp"],
+          description: "Transport mode for Granola integration. Use api for Enterprise API or mcp for broader MCP access."
+        },
+        mcpUrl: {
+          type: "string",
+          description: "Optional override for Granola MCP URL. Defaults to https://mcp.granola.ai/mcp."
+        },
+        mcpHeaders: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          description: "Optional static headers for MCP gateway/proxy setups."
+        },
+        pageSize: {
+          type: "number",
+          description: "Page size for listing notes (maximum 30 per Granola API)."
+        }
+      }
+    },
+    example: {
+      transport: "mcp",
+      mcpUrl: "https://mcp.granola.ai/mcp",
+      pageSize: 10
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Granola API key used as a Bearer token for Enterprise API requests (transport=api)."
+        },
+        mcpAccessToken: {
+          type: "string",
+          description: "Optional bearer token for MCP proxy/gateway auth (transport=mcp)."
+        }
+      }
+    },
+    example: {
+      mcpAccessToken: "granola-mcp-***"
+    }
+  },
+  healthCheck: {
+    method: "list",
+    timeoutMs: 8000
+  },
+  docsUrl: "https://docs.granola.ai/help-center/sharing/integrations/mcp",
+  byokSetup: {
+    setupInstructions: "Use Granola MCP for browser OAuth access, or configure an Enterprise API key for REST transport."
+  }
+});
+function registerGranolaIntegration(registry) {
+  return registry.register(granolaIntegrationSpec);
+}
+
+// src/integrations/providers/tldv.ts
+import { StabilityEnum as StabilityEnum21 } from "@contractspec/lib.contracts-spec/ownership";
+var tldvIntegrationSpec = defineIntegration({
+  meta: {
+    key: "meeting-recorder.tldv",
+    version: "1.0.0",
+    category: "meeting-recorder",
+    title: "tl;dv Meeting Recorder",
+    description: "tl;dv Public API for meeting recordings, transcripts, and webhook events.",
+    domain: "productivity",
+    owners: ["platform.integrations"],
+    tags: ["meeting-recorder", "tldv", "transcripts"],
+    stability: StabilityEnum21.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [
+      { key: "meeting-recorder.meetings.read", version: "1.0.0" },
+      { key: "meeting-recorder.transcripts.read", version: "1.0.0" },
+      { key: "meeting-recorder.webhooks", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        baseUrl: {
+          type: "string",
+          description: "Optional override for the tl;dv API base URL. Defaults to https://pasta.tldv.io/v1alpha1."
+        },
+        webhookUrl: {
+          type: "string",
+          description: "Webhook destination URL configured in tl;dv settings (MeetingReady/TranscriptReady)."
+        },
+        webhookEvents: {
+          type: "array",
+          items: { type: "string" },
+          description: "Webhook triggers to enable (MeetingReady, TranscriptReady)."
+        },
+        webhookScope: {
+          type: "string",
+          description: "Webhook scope to configure (user, team, or organization)."
+        }
+      }
+    },
+    example: {
+      baseUrl: "https://pasta.tldv.io/v1alpha1",
+      webhookUrl: "https://example.com/webhooks/tldv",
+      webhookEvents: ["MeetingReady", "TranscriptReady"],
+      webhookScope: "team"
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "tl;dv API key used in the x-api-key header for API requests."
+        },
+        webhookSecret: {
+          type: "string",
+          description: "Optional shared secret for webhook verification if configured in your environment."
+        }
+      }
+    },
+    example: {
+      apiKey: "tldv-***",
+      webhookSecret: "tldv-webhook-secret"
+    }
+  },
+  healthCheck: {
+    method: "ping",
+    timeoutMs: 6000
+  },
+  docsUrl: "https://doc.tldv.io/index.html",
+  byokSetup: {
+    setupInstructions: "Generate a tl;dv API key and optionally configure MeetingReady/TranscriptReady webhooks."
+  }
+});
+function registerTldvIntegration(registry) {
+  return registry.register(tldvIntegrationSpec);
+}
+
+// src/integrations/providers/fireflies.ts
+import { StabilityEnum as StabilityEnum22 } from "@contractspec/lib.contracts-spec/ownership";
+var firefliesIntegrationSpec = defineIntegration({
+  meta: {
+    key: "meeting-recorder.fireflies",
+    version: "1.0.0",
+    category: "meeting-recorder",
+    title: "Fireflies.ai Meeting Recorder",
+    description: "Fireflies GraphQL API for meeting transcripts, metadata, and webhook events.",
+    domain: "productivity",
+    owners: ["platform.integrations"],
+    tags: ["meeting-recorder", "fireflies", "transcripts"],
+    stability: StabilityEnum22.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [
+      { key: "meeting-recorder.meetings.read", version: "1.0.0" },
+      { key: "meeting-recorder.transcripts.read", version: "1.0.0" },
+      { key: "meeting-recorder.webhooks", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        baseUrl: {
+          type: "string",
+          description: "Optional override for the Fireflies GraphQL endpoint. Defaults to https://api.fireflies.ai/graphql."
+        },
+        webhookUrl: {
+          type: "string",
+          description: "Webhook destination URL configured in Fireflies developer settings."
+        },
+        webhookEvents: {
+          type: "array",
+          items: { type: "string" },
+          description: "Webhook events to subscribe to (e.g., Transcription completed)."
+        },
+        transcriptsPageSize: {
+          type: "number",
+          description: "Number of transcripts to request per GraphQL query."
+        }
+      }
+    },
+    example: {
+      baseUrl: "https://api.fireflies.ai/graphql",
+      webhookUrl: "https://example.com/webhooks/fireflies",
+      webhookEvents: ["Transcription completed"],
+      transcriptsPageSize: 25
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Fireflies API key for GraphQL requests."
+        },
+        webhookSecret: {
+          type: "string",
+          description: "Optional webhook secret used to verify x-hub-signature HMAC payloads."
+        }
+      }
+    },
+    example: {
+      apiKey: "fireflies-***",
+      webhookSecret: "fireflies-webhook-secret"
+    }
+  },
+  healthCheck: {
+    method: "custom",
+    timeoutMs: 6000
+  },
+  docsUrl: "https://docs.fireflies.ai/getting-started/introduction",
+  byokSetup: {
+    setupInstructions: "Create a Fireflies API key and optionally configure webhook settings in Developer Settings."
+  }
+});
+function registerFirefliesIntegration(registry) {
+  return registry.register(firefliesIntegrationSpec);
+}
+
+// src/integrations/providers/fathom.ts
+import { StabilityEnum as StabilityEnum23 } from "@contractspec/lib.contracts-spec/ownership";
+var fathomIntegrationSpec = defineIntegration({
+  meta: {
+    key: "meeting-recorder.fathom",
+    version: "1.0.0",
+    category: "meeting-recorder",
+    title: "Fathom Meeting Recorder",
+    description: "Fathom External API for meetings, transcripts, and webhook events.",
+    domain: "productivity",
+    owners: ["platform.integrations"],
+    tags: ["meeting-recorder", "fathom", "transcripts"],
+    stability: StabilityEnum23.Experimental
+  },
+  supportedModes: ["byok"],
+  capabilities: {
+    provides: [
+      { key: "meeting-recorder.meetings.read", version: "1.0.0" },
+      { key: "meeting-recorder.transcripts.read", version: "1.0.0" },
+      { key: "meeting-recorder.webhooks", version: "1.0.0" }
+    ]
+  },
+  configSchema: {
+    schema: {
+      type: "object",
+      properties: {
+        baseUrl: {
+          type: "string",
+          description: "Optional override for the Fathom API base URL. Defaults to https://api.fathom.ai/external/v1."
+        },
+        webhookUrl: {
+          type: "string",
+          description: "Webhook destination URL used when registering Fathom webhooks."
+        },
+        includeTranscript: {
+          type: "boolean",
+          description: "Include transcript data in Fathom webhook payloads."
+        },
+        includeSummary: {
+          type: "boolean",
+          description: "Include summary data in Fathom webhook payloads."
+        },
+        includeActionItems: {
+          type: "boolean",
+          description: "Include action items in Fathom webhook payloads."
+        },
+        includeCrmMatches: {
+          type: "boolean",
+          description: "Include CRM matches in Fathom webhook payloads."
+        },
+        triggeredFor: {
+          type: "array",
+          items: { type: "string" },
+          description: "Recording scopes to trigger webhooks for (e.g., my_recordings)."
+        }
+      }
+    },
+    example: {
+      baseUrl: "https://api.fathom.ai/external/v1",
+      webhookUrl: "https://example.com/webhooks/fathom",
+      includeTranscript: true,
+      includeSummary: true,
+      includeActionItems: false,
+      includeCrmMatches: false,
+      triggeredFor: ["my_recordings"]
+    }
+  },
+  secretSchema: {
+    schema: {
+      type: "object",
+      required: ["apiKey"],
+      properties: {
+        apiKey: {
+          type: "string",
+          description: "Fathom API key used in the X-Api-Key header."
+        },
+        webhookSecret: {
+          type: "string",
+          description: "Optional webhook secret used to verify Fathom webhook signatures."
+        }
+      }
+    },
+    example: {
+      apiKey: "fathom-***",
+      webhookSecret: "whsec_***"
+    }
+  },
+  healthCheck: {
+    method: "list",
+    timeoutMs: 8000
+  },
+  docsUrl: "https://developers.fathom.ai/",
+  constraints: {
+    rateLimit: {
+      rpm: 60
+    }
+  },
+  byokSetup: {
+    setupInstructions: "Generate an API key in Fathom settings and optionally configure webhooks for meeting content readiness."
+  }
+});
+function registerFathomIntegration(registry) {
+  return registry.register(fathomIntegrationSpec);
+}
+// src/integrations/providers/registry.ts
+function createDefaultIntegrationSpecRegistry() {
+  const registry = new IntegrationSpecRegistry;
+  registerStripeIntegration(registry);
+  registerPostmarkIntegration(registry);
+  registerQdrantIntegration(registry);
+  registerSupabaseVectorIntegration(registry);
+  registerSupabasePostgresIntegration(registry);
+  registerMistralIntegration(registry);
+  registerElevenLabsIntegration(registry);
+  registerGradiumIntegration(registry);
+  registerFalIntegration(registry);
+  registerGmailIntegration(registry);
+  registerGoogleCalendarIntegration(registry);
+  registerPosthogIntegration(registry);
+  registerTwilioSmsIntegration(registry);
+  registerGcsStorageIntegration(registry);
+  registerPowensIntegration(registry);
+  registerLinearIntegration(registry);
+  registerJiraIntegration(registry);
+  registerNotionIntegration(registry);
+  registerGranolaIntegration(registry);
+  registerTldvIntegration(registry);
+  registerFirefliesIntegration(registry);
+  registerFathomIntegration(registry);
+  return registry;
+}
+// src/integrations/openbanking/models.ts
+import { ScalarTypeEnum, SchemaModel } from "@contractspec/lib.schema";
+var BankAccountRecord = new SchemaModel({
+  name: "BankAccountRecord",
+  description: "Canonical representation of a bank account synced from an open banking provider.",
+  fields: {
+    id: { type: ScalarTypeEnum.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    userId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    externalId: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    institutionId: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    institutionName: {
+      type: ScalarTypeEnum.NonEmptyString(),
+      isOptional: false
+    },
+    institutionLogoUrl: { type: ScalarTypeEnum.URL(), isOptional: true },
+    iban: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },
+    bic: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },
+    accountType: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    currency: { type: ScalarTypeEnum.Currency(), isOptional: false },
+    displayName: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    accountNumberMasked: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    productCode: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },
+    balance: { type: ScalarTypeEnum.Float_unsecure(), isOptional: true },
+    availableBalance: {
+      type: ScalarTypeEnum.Float_unsecure(),
+      isOptional: true
+    },
+    lastSyncedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    updatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    metadata: { type: ScalarTypeEnum.JSONObject(), isOptional: true }
+  }
+});
+var BankTransactionRecord = new SchemaModel({
+  name: "BankTransactionRecord",
+  description: "Canonical transaction entry mapped from Powens into the open banking ledger.",
+  fields: {
+    id: { type: ScalarTypeEnum.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    externalId: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    amount: { type: ScalarTypeEnum.Float_unsecure(), isOptional: false },
+    currency: { type: ScalarTypeEnum.Currency(), isOptional: false },
+    date: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    bookingDate: { type: ScalarTypeEnum.DateTime(), isOptional: true },
+    valueDate: { type: ScalarTypeEnum.DateTime(), isOptional: true },
+    description: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },
+    counterpartyName: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    counterpartyAccount: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    merchantCategoryCode: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    rawCategory: { type: ScalarTypeEnum.String_unsecure(), isOptional: true },
+    standardizedCategory: {
+      type: ScalarTypeEnum.String_unsecure(),
+      isOptional: true
+    },
+    transactionType: {
+      type: ScalarTypeEnum.NonEmptyString(),
+      isOptional: false
+    },
+    status: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    runningBalance: { type: ScalarTypeEnum.Float_unsecure(), isOptional: true },
+    metadata: { type: ScalarTypeEnum.JSONObject(), isOptional: true },
+    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    updatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false }
+  }
+});
+var AccountBalanceRecord = new SchemaModel({
+  name: "AccountBalanceRecord",
+  description: "Canonical balance snapshot computed from Powens balance payloads.",
+  fields: {
+    id: { type: ScalarTypeEnum.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum.ID(), isOptional: false },
+    balanceType: { type: ScalarTypeEnum.NonEmptyString(), isOptional: false },
+    currentBalance: {
+      type: ScalarTypeEnum.Float_unsecure(),
+      isOptional: false
+    },
+    availableBalance: {
+      type: ScalarTypeEnum.Float_unsecure(),
+      isOptional: true
+    },
+    currency: { type: ScalarTypeEnum.Currency(), isOptional: false },
+    lastUpdatedAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    createdAt: { type: ScalarTypeEnum.DateTime(), isOptional: false },
+    metadata: { type: ScalarTypeEnum.JSONObject(), isOptional: true }
+  }
+});
+
+// src/integrations/openbanking/telemetry.ts
+var OPENBANKING_PII_FIELDS = [
+  "iban",
+  "bic",
+  "accountNumberMasked",
+  "accountNumber",
+  "counterpartyName",
+  "counterpartyAccount",
+  "description",
+  "merchantName",
+  "merchantCategoryCode",
+  "reference"
+];
+var OPENBANKING_TELEMETRY_EVENTS = {
+  accountsSynced: "openbanking.accounts.synced",
+  accountsSyncFailed: "openbanking.accounts.sync_failed",
+  transactionsSynced: "openbanking.transactions.synced",
+  transactionsSyncFailed: "openbanking.transactions.sync_failed",
+  balancesRefreshed: "openbanking.balances.refreshed",
+  balancesRefreshFailed: "openbanking.balances.refresh_failed",
+  overviewGenerated: "openbanking.overview.generated"
+};
+function redactOpenBankingTelemetryPayload(payload) {
+  const redacted = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (OPENBANKING_PII_FIELDS.includes(key)) {
+      redacted[key] = maskValue(value);
+    } else if (Array.isArray(value)) {
+      redacted[key] = value.map((item) => typeof item === "object" && item !== null ? redactOpenBankingTelemetryPayload(item) : item);
+    } else if (typeof value === "object" && value !== null) {
+      redacted[key] = redactOpenBankingTelemetryPayload(value);
+    } else {
+      redacted[key] = value;
+    }
+  }
+  return redacted;
+}
+function maskValue(value) {
+  if (value == null)
+    return "";
+  const str = String(value);
+  if (str.length <= 4)
+    return "*".repeat(str.length);
+  return `${"*".repeat(Math.max(str.length - 4, 0))}${str.slice(-4)}`;
+}
+
+// src/integrations/openbanking/contracts/accounts.ts
+import { ScalarTypeEnum as ScalarTypeEnum2, SchemaModel as SchemaModel2 } from "@contractspec/lib.schema";
+import {
+  defineCommand,
+  defineQuery
+} from "@contractspec/lib.contracts-spec/operations";
+var OpenBankingListAccountsInput = new SchemaModel2({
+  name: "OpenBankingListAccountsInput",
+  description: "Parameters for listing bank accounts through the open banking provider.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    userId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum2.ID(), isOptional: true },
+    includeBalances: { type: ScalarTypeEnum2.Boolean(), isOptional: true },
+    institutionId: { type: ScalarTypeEnum2.String_unsecure(), isOptional: true },
+    cursor: { type: ScalarTypeEnum2.String_unsecure(), isOptional: true },
+    pageSize: { type: ScalarTypeEnum2.Int_unsecure(), isOptional: true }
+  }
+});
+var OpenBankingListAccountsOutput = new SchemaModel2({
+  name: "OpenBankingListAccountsOutput",
+  description: "Paginated list of bank accounts available to the tenant and user.",
+  fields: {
+    accounts: {
+      type: BankAccountRecord,
+      isOptional: false,
+      isArray: true
+    },
+    nextCursor: { type: ScalarTypeEnum2.String_unsecure(), isOptional: true },
+    hasMore: { type: ScalarTypeEnum2.Boolean(), isOptional: true }
+  }
+});
+var OpenBankingGetAccountInput = new SchemaModel2({
+  name: "OpenBankingGetAccountInput",
+  description: "Parameters for retrieving a specific bank account.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    includeBalances: { type: ScalarTypeEnum2.Boolean(), isOptional: true },
+    includeLatestTransactions: {
+      type: ScalarTypeEnum2.Boolean(),
+      isOptional: true
+    }
+  }
+});
+var OpenBankingSyncAccountsInput = new SchemaModel2({
+  name: "OpenBankingSyncAccountsInput",
+  description: "Command payload to trigger an account synchronisation against the open banking provider.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    userId: { type: ScalarTypeEnum2.ID(), isOptional: true },
+    connectionId: { type: ScalarTypeEnum2.ID(), isOptional: false },
+    accountIds: {
+      type: ScalarTypeEnum2.ID(),
+      isArray: true,
+      isOptional: true
+    },
+    forceFullRefresh: { type: ScalarTypeEnum2.Boolean(), isOptional: true },
+    triggerWorkflows: { type: ScalarTypeEnum2.Boolean(), isOptional: true }
+  }
+});
+var OpenBankingSyncAccountsOutput = new SchemaModel2({
+  name: "OpenBankingSyncAccountsOutput",
+  description: "Result of a bank account synchronisation run.",
+  fields: {
+    synced: { type: ScalarTypeEnum2.Int_unsecure(), isOptional: false },
+    failed: { type: ScalarTypeEnum2.Int_unsecure(), isOptional: false },
+    errors: {
+      type: ScalarTypeEnum2.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    },
+    nextSyncSuggestedAt: {
+      type: ScalarTypeEnum2.DateTime(),
+      isOptional: true
+    }
+  }
+});
+var OpenBankingListAccounts = defineQuery({
+  meta: {
+    key: "openbanking.accounts.list",
+    version: "1.0.0",
+    description: "List bank accounts available to a tenant/user via Powens Open Banking.",
+    goal: "Provide downstream workflows with the set of accounts accessible via the configured open banking connection.",
+    context: "Used by Pocket Family Office dashboards and sync workflows to enumerate bank accounts prior to syncing balances or transactions.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "accounts"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingListAccountsInput,
+    output: OpenBankingListAccountsOutput
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var OpenBankingGetAccount = defineQuery({
+  meta: {
+    key: "openbanking.accounts.get",
+    version: "1.0.0",
+    description: "Retrieve the canonical bank account record for the given account identifier.",
+    goal: "Allow user-facing experiences and automations to display up-to-date account metadata.",
+    context: "Invoked by UI surfaces and workflow automation steps that require detailed metadata for a specific bank account.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "accounts"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingGetAccountInput,
+    output: BankAccountRecord
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var OpenBankingSyncAccounts = defineCommand({
+  meta: {
+    key: "openbanking.accounts.sync",
+    version: "1.0.0",
+    description: "Initiate a synchronisation run to refresh bank account metadata from Powens.",
+    goal: "Keep canonical bank account records aligned with the external open banking provider.",
+    context: "Triggered by scheduled workflows or manual operator actions to reconcile account metadata prior to transaction/balance syncs.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "accounts"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingSyncAccountsInput,
+    output: OpenBankingSyncAccountsOutput
+  },
+  policy: {
+    auth: "admin"
+  },
+  telemetry: {
+    success: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.accountsSynced },
+      properties: ({ input, output }) => {
+        const payload = input;
+        const result = output;
+        return {
+          tenantId: payload?.tenantId,
+          connectionId: payload?.connectionId,
+          synced: result?.synced,
+          failed: result?.failed
+        };
+      }
+    },
+    failure: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.accountsSyncFailed },
+      properties: ({ input, error }) => {
+        const payload = input;
+        return {
+          tenantId: payload?.tenantId,
+          connectionId: payload?.connectionId,
+          error: error instanceof Error ? error.message : String(error ?? "unknown")
+        };
+      }
+    }
+  }
+});
+var openBankingAccountContracts = {
+  OpenBankingListAccounts,
+  OpenBankingGetAccount,
+  OpenBankingSyncAccounts
+};
+function registerOpenBankingAccountContracts(registry2) {
+  return registry2.register(OpenBankingListAccounts).register(OpenBankingGetAccount).register(OpenBankingSyncAccounts);
+}
+
+// src/integrations/openbanking/contracts/transactions.ts
+import { ScalarTypeEnum as ScalarTypeEnum3, SchemaModel as SchemaModel3 } from "@contractspec/lib.schema";
+import {
+  defineCommand as defineCommand2,
+  defineQuery as defineQuery2
+} from "@contractspec/lib.contracts-spec/operations";
+var OpenBankingListTransactionsInput = new SchemaModel3({
+  name: "OpenBankingListTransactionsInput",
+  description: "Parameters for listing bank transactions from the canonical ledger.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    from: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    to: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    cursor: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    pageSize: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: true },
+    direction: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    minimumAmount: { type: ScalarTypeEnum3.Float_unsecure(), isOptional: true },
+    maximumAmount: { type: ScalarTypeEnum3.Float_unsecure(), isOptional: true },
+    category: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true }
+  }
+});
+var OpenBankingListTransactionsOutput = new SchemaModel3({
+  name: "OpenBankingListTransactionsOutput",
+  description: "Paginated list of transactions for a bank account.",
+  fields: {
+    transactions: {
+      type: BankTransactionRecord,
+      isOptional: false,
+      isArray: true
+    },
+    nextCursor: { type: ScalarTypeEnum3.String_unsecure(), isOptional: true },
+    hasMore: { type: ScalarTypeEnum3.Boolean(), isOptional: true }
+  }
+});
+var OpenBankingSyncTransactionsInput = new SchemaModel3({
+  name: "OpenBankingSyncTransactionsInput",
+  description: "Command payload to synchronise transactions from the open banking provider into the canonical ledger.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum3.ID(), isOptional: false },
+    from: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    to: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    connectionId: { type: ScalarTypeEnum3.ID(), isOptional: true },
+    includePending: { type: ScalarTypeEnum3.Boolean(), isOptional: true },
+    backfillDays: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: true }
+  }
+});
+var OpenBankingSyncTransactionsOutput = new SchemaModel3({
+  name: "OpenBankingSyncTransactionsOutput",
+  description: "Result of a transaction synchronisation run.",
+  fields: {
+    synced: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: false },
+    failed: { type: ScalarTypeEnum3.Int_unsecure(), isOptional: false },
+    earliestSyncedAt: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    latestSyncedAt: { type: ScalarTypeEnum3.DateTime(), isOptional: true },
+    nextSinceToken: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isOptional: true
+    },
+    errors: {
+      type: ScalarTypeEnum3.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    }
+  }
+});
+var OpenBankingListTransactions = defineQuery2({
+  meta: {
+    key: "openbanking.transactions.list",
+    version: "1.0.0",
+    description: "List bank transactions that have been normalised into the canonical ledger.",
+    goal: "Allow downstream analytics and UI surfaces to page through canonical bank transactions.",
+    context: "Used by Pocket Family Office dashboards, reconciliation workflows, and analytics data views.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "transactions"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingListTransactionsInput,
+    output: OpenBankingListTransactionsOutput
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var OpenBankingSyncTransactions = defineCommand2({
+  meta: {
+    key: "openbanking.transactions.sync",
+    version: "1.0.0",
+    description: "Synchronise transactions for a bank account by calling the configured open banking provider.",
+    goal: "Ensure the canonical transaction ledger stays aligned with the external provider.",
+    context: "Triggered by scheduled workflows or on-demand actions when activity is expected on an account.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "transactions"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingSyncTransactionsInput,
+    output: OpenBankingSyncTransactionsOutput
+  },
+  policy: {
+    auth: "admin"
+  },
+  telemetry: {
+    success: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.transactionsSynced },
+      properties: ({ input, output }) => {
+        const payload = input;
+        const result = output;
+        return {
+          tenantId: payload?.tenantId,
+          accountId: payload?.accountId,
+          synced: result?.synced,
+          failed: result?.failed,
+          earliestSyncedAt: result?.earliestSyncedAt,
+          latestSyncedAt: result?.latestSyncedAt
+        };
+      }
+    },
+    failure: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.transactionsSyncFailed },
+      properties: ({ input, error }) => {
+        const payload = input;
+        return {
+          tenantId: payload?.tenantId,
+          accountId: payload?.accountId,
+          error: error instanceof Error ? error.message : String(error ?? "unknown")
+        };
+      }
+    }
+  }
+});
+var openBankingTransactionContracts = {
+  OpenBankingListTransactions,
+  OpenBankingSyncTransactions
+};
+function registerOpenBankingTransactionContracts(registry2) {
+  return registry2.register(OpenBankingListTransactions).register(OpenBankingSyncTransactions);
+}
+
+// src/integrations/openbanking/contracts/balances.ts
+import { ScalarTypeEnum as ScalarTypeEnum4, SchemaModel as SchemaModel4 } from "@contractspec/lib.schema";
+import {
+  defineCommand as defineCommand3,
+  defineQuery as defineQuery3
+} from "@contractspec/lib.contracts-spec/operations";
+var OpenBankingGetBalancesInput = new SchemaModel4({
+  name: "OpenBankingGetBalancesInput",
+  description: "Parameters for retrieving bank account balances from the canonical ledger.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum4.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum4.ID(), isOptional: false },
+    balanceTypes: {
+      type: ScalarTypeEnum4.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    }
+  }
+});
+var OpenBankingGetBalancesOutput = new SchemaModel4({
+  name: "OpenBankingGetBalancesOutput",
+  description: "Canonical balances for a bank account.",
+  fields: {
+    balances: {
+      type: AccountBalanceRecord,
+      isOptional: false,
+      isArray: true
+    },
+    asOf: { type: ScalarTypeEnum4.DateTime(), isOptional: true }
+  }
+});
+var OpenBankingRefreshBalancesInput = new SchemaModel4({
+  name: "OpenBankingRefreshBalancesInput",
+  description: "Command payload to refresh balances for a bank account via the open banking provider.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum4.ID(), isOptional: false },
+    accountId: { type: ScalarTypeEnum4.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum4.ID(), isOptional: true },
+    balanceTypes: {
+      type: ScalarTypeEnum4.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    },
+    forceRefresh: { type: ScalarTypeEnum4.Boolean(), isOptional: true }
+  }
+});
+var OpenBankingRefreshBalancesOutput = new SchemaModel4({
+  name: "OpenBankingRefreshBalancesOutput",
+  description: "Result of a balance refresh against the open banking provider.",
+  fields: {
+    balances: {
+      type: AccountBalanceRecord,
+      isOptional: false,
+      isArray: true
+    },
+    refreshedAt: { type: ScalarTypeEnum4.DateTime(), isOptional: false },
+    errors: {
+      type: ScalarTypeEnum4.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    }
+  }
+});
+var OpenBankingGetBalances = defineQuery3({
+  meta: {
+    key: "openbanking.balances.get",
+    version: "1.0.0",
+    description: "Retrieve the latest cached balances for a bank account.",
+    goal: "Expose current and available balances required by dashboards and analytics.",
+    context: "Used by Pocket Family Office UI surfaces and automation steps that require balance totals prior to generating summaries.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "balances"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingGetBalancesInput,
+    output: OpenBankingGetBalancesOutput
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var OpenBankingRefreshBalances = defineCommand3({
+  meta: {
+    key: "openbanking.balances.refresh",
+    version: "1.0.0",
+    description: "Refresh balances for a bank account via the configured open banking provider.",
+    goal: "Ensure canonical balance records reflect the latest values from Powens.",
+    context: "Triggered by scheduled workflows before generating summaries or forecasting cashflow.",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "balances"],
+    stability: "experimental"
+  },
+  io: {
+    input: OpenBankingRefreshBalancesInput,
+    output: OpenBankingRefreshBalancesOutput
+  },
+  policy: {
+    auth: "admin"
+  },
+  telemetry: {
+    success: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.balancesRefreshed },
+      properties: ({ input, output }) => {
+        const payload = input;
+        const result = output;
+        return {
+          tenantId: payload?.tenantId,
+          accountId: payload?.accountId,
+          refreshedAt: result?.refreshedAt,
+          balanceCount: Array.isArray(result?.balances) ? result?.balances.length : undefined
+        };
+      }
+    },
+    failure: {
+      event: { key: OPENBANKING_TELEMETRY_EVENTS.balancesRefreshFailed },
+      properties: ({ input, error }) => {
+        const payload = input;
+        return {
+          tenantId: payload?.tenantId,
+          accountId: payload?.accountId,
+          error: error instanceof Error ? error.message : String(error ?? "unknown")
+        };
+      }
+    }
+  }
+});
+var openBankingBalanceContracts = {
+  OpenBankingGetBalances,
+  OpenBankingRefreshBalances
+};
+function registerOpenBankingBalanceContracts(registry2) {
+  return registry2.register(OpenBankingGetBalances).register(OpenBankingRefreshBalances);
+}
+
+// src/integrations/openbanking/openbanking.feature.ts
+import { defineFeature } from "@contractspec/lib.contracts-spec/features";
+var OpenBankingFeature = defineFeature({
+  meta: {
+    key: "openbanking",
+    version: "1.0.0",
+    title: "Open Banking Integration",
+    description: "Open banking account sync, balance refresh, and transaction synchronization",
+    domain: "integrations",
+    owners: ["@platform.finance"],
+    tags: ["open-banking", "powens", "finance", "banking"],
+    stability: "experimental"
+  },
+  operations: [
+    { key: "openbanking.accounts.sync", version: "1.0.0" },
+    { key: "openbanking.accounts.list", version: "1.0.0" },
+    { key: "openbanking.accounts.get", version: "1.0.0" },
+    { key: "openbanking.balances.refresh", version: "1.0.0" },
+    { key: "openbanking.balances.get", version: "1.0.0" },
+    { key: "openbanking.transactions.sync", version: "1.0.0" },
+    { key: "openbanking.transactions.list", version: "1.0.0" }
+  ],
+  events: [],
+  presentations: [],
+  opToPresentation: [],
+  presentationsTargets: [],
+  capabilities: {
+    provides: [{ key: "openbanking", version: "1.0.0" }],
+    requires: [{ key: "identity", version: "1.0.0" }]
+  }
+});
+// src/integrations/openbanking/contracts/index.ts
+function registerOpenBankingContracts(registry2) {
+  return registerOpenBankingBalanceContracts(registerOpenBankingTransactionContracts(registerOpenBankingAccountContracts(registry2)));
+}
+
+// src/integrations/openbanking/guards.ts
+var PRIMARY_SLOT_ID = "primaryOpenBanking";
+function ensurePrimaryOpenBankingIntegration(config) {
+  const integration = config.integrations.find((item) => item.slot.slotId === PRIMARY_SLOT_ID);
+  if (!integration) {
+    return {
+      ok: false,
+      error: "primaryOpenBanking slot is not bound in the resolved app config."
+    };
+  }
+  const status = integration.connection.status;
+  if (status === "error" || status === "disconnected") {
+    return {
+      ok: false,
+      integration,
+      error: `primaryOpenBanking connection is in status "${status}".`
+    };
+  }
+  if (status === "unknown") {
+    return {
+      ok: false,
+      integration,
+      error: "primaryOpenBanking connection health is unknown."
+    };
+  }
+  return { ok: true, integration };
+}
+function assertPrimaryOpenBankingReady(config) {
+  const result = ensurePrimaryOpenBankingIntegration(config);
+  if (!result.ok) {
+    throw new Error(result.error ?? "Open banking integration not available.");
+  }
+  if (!result.integration) {
+    throw new Error(result.error ?? "Open banking integration not available.");
+  }
+  return result.integration;
+}
+
+// src/integrations/meeting-recorder/models.ts
+import { ScalarTypeEnum as ScalarTypeEnum5, SchemaModel as SchemaModel5 } from "@contractspec/lib.schema";
+var MeetingParticipantRecord = new SchemaModel5({
+  name: "MeetingParticipantRecord",
+  description: "Canonical participant entry for meetings and transcripts from recorder providers.",
+  fields: {
+    id: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    externalId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    name: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    email: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    role: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    isExternal: { type: ScalarTypeEnum5.Boolean(), isOptional: true },
+    metadata: { type: ScalarTypeEnum5.JSONObject(), isOptional: true }
+  }
+});
+var MeetingTranscriptSegmentRecord = new SchemaModel5({
+  name: "MeetingTranscriptSegmentRecord",
+  description: "A single transcript segment with speaker attribution.",
+  fields: {
+    index: { type: ScalarTypeEnum5.Int_unsecure(), isOptional: true },
+    speakerId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    speakerName: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    speakerEmail: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    text: { type: ScalarTypeEnum5.String_unsecure(), isOptional: false },
+    startTimeMs: { type: ScalarTypeEnum5.Float_unsecure(), isOptional: true },
+    endTimeMs: { type: ScalarTypeEnum5.Float_unsecure(), isOptional: true },
+    startTime: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    endTime: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    confidence: { type: ScalarTypeEnum5.Float_unsecure(), isOptional: true },
+    metadata: { type: ScalarTypeEnum5.JSONObject(), isOptional: true }
+  }
+});
+var MeetingRecord = new SchemaModel5({
+  name: "MeetingRecord",
+  description: "Canonical meeting metadata synced from meeting recorder providers.",
+  fields: {
+    id: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    externalId: { type: ScalarTypeEnum5.NonEmptyString(), isOptional: false },
+    title: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    summary: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    organizer: { type: MeetingParticipantRecord, isOptional: true },
+    invitees: {
+      type: MeetingParticipantRecord,
+      isArray: true,
+      isOptional: true
+    },
+    participants: {
+      type: MeetingParticipantRecord,
+      isArray: true,
+      isOptional: true
+    },
+    scheduledStartAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    scheduledEndAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    recordingStartAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    recordingEndAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    durationSeconds: {
+      type: ScalarTypeEnum5.Float_unsecure(),
+      isOptional: true
+    },
+    meetingUrl: { type: ScalarTypeEnum5.URL(), isOptional: true },
+    recordingUrl: { type: ScalarTypeEnum5.URL(), isOptional: true },
+    shareUrl: { type: ScalarTypeEnum5.URL(), isOptional: true },
+    sourcePlatform: {
+      type: ScalarTypeEnum5.String_unsecure(),
+      isOptional: true
+    },
+    language: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    transcriptAvailable: { type: ScalarTypeEnum5.Boolean(), isOptional: true },
+    createdAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    updatedAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    metadata: { type: ScalarTypeEnum5.JSONObject(), isOptional: true }
+  }
+});
+var MeetingTranscriptRecord = new SchemaModel5({
+  name: "MeetingTranscriptRecord",
+  description: "Canonical transcript payload for a recorded meeting.",
+  fields: {
+    id: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    meetingId: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum5.ID(), isOptional: false },
+    externalId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    format: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    text: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    segments: {
+      type: MeetingTranscriptSegmentRecord,
+      isArray: true,
+      isOptional: true
+    },
+    language: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    sourceUrl: { type: ScalarTypeEnum5.URL(), isOptional: true },
+    generatedAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    metadata: { type: ScalarTypeEnum5.JSONObject(), isOptional: true },
+    raw: { type: ScalarTypeEnum5.JSON(), isOptional: true }
+  }
+});
+var MeetingRecorderWebhookEventRecord = new SchemaModel5({
+  name: "MeetingRecorderWebhookEventRecord",
+  description: "Normalized webhook event from a meeting recorder provider.",
+  fields: {
+    id: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    providerKey: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    eventType: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    meetingId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    transcriptId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    recordingId: { type: ScalarTypeEnum5.String_unsecure(), isOptional: true },
+    receivedAt: { type: ScalarTypeEnum5.DateTime(), isOptional: true },
+    verified: { type: ScalarTypeEnum5.Boolean(), isOptional: true },
+    payload: { type: ScalarTypeEnum5.JSON(), isOptional: true },
+    metadata: { type: ScalarTypeEnum5.JSONObject(), isOptional: true }
+  }
+});
+
+// src/integrations/meeting-recorder/contracts/meetings.ts
+import { ScalarTypeEnum as ScalarTypeEnum6, SchemaModel as SchemaModel6 } from "@contractspec/lib.schema";
+import {
+  defineQuery as defineQuery4
+} from "@contractspec/lib.contracts-spec/operations";
+var MeetingRecorderListMeetingsInput = new SchemaModel6({
+  name: "MeetingRecorderListMeetingsInput",
+  description: "Parameters for listing meetings from a meeting recorder provider.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum6.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum6.ID(), isOptional: true },
+    from: { type: ScalarTypeEnum6.DateTime(), isOptional: true },
+    to: { type: ScalarTypeEnum6.DateTime(), isOptional: true },
+    cursor: { type: ScalarTypeEnum6.String_unsecure(), isOptional: true },
+    pageSize: { type: ScalarTypeEnum6.Int_unsecure(), isOptional: true },
+    query: { type: ScalarTypeEnum6.String_unsecure(), isOptional: true },
+    organizerEmail: {
+      type: ScalarTypeEnum6.String_unsecure(),
+      isOptional: true
+    },
+    participantEmail: {
+      type: ScalarTypeEnum6.String_unsecure(),
+      isOptional: true
+    },
+    includeTranscript: { type: ScalarTypeEnum6.Boolean(), isOptional: true },
+    includeSummary: { type: ScalarTypeEnum6.Boolean(), isOptional: true }
+  }
+});
+var MeetingRecorderListMeetingsOutput = new SchemaModel6({
+  name: "MeetingRecorderListMeetingsOutput",
+  description: "Paginated list of meetings for a recorder provider.",
+  fields: {
+    meetings: {
+      type: MeetingRecord,
+      isOptional: false,
+      isArray: true
+    },
+    nextCursor: { type: ScalarTypeEnum6.String_unsecure(), isOptional: true },
+    hasMore: { type: ScalarTypeEnum6.Boolean(), isOptional: true }
+  }
+});
+var MeetingRecorderGetMeetingInput = new SchemaModel6({
+  name: "MeetingRecorderGetMeetingInput",
+  description: "Parameters for retrieving a single meeting record.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum6.ID(), isOptional: false },
+    meetingId: { type: ScalarTypeEnum6.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum6.ID(), isOptional: true },
+    includeTranscript: { type: ScalarTypeEnum6.Boolean(), isOptional: true },
+    includeSummary: { type: ScalarTypeEnum6.Boolean(), isOptional: true }
+  }
+});
+var MeetingRecorderListMeetings = defineQuery4({
+  meta: {
+    key: "meeting-recorder.meetings.list",
+    version: "1.0.0",
+    description: "List meetings recorded by the configured meeting provider.",
+    goal: "Provide downstream workflows with recent meetings and metadata.",
+    context: "Used by integration hubs and sync workflows to enumerate meetings before pulling transcripts.",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "meetings", "transcripts"],
+    stability: "experimental"
+  },
+  io: {
+    input: MeetingRecorderListMeetingsInput,
+    output: MeetingRecorderListMeetingsOutput
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var MeetingRecorderGetMeeting = defineQuery4({
+  meta: {
+    key: "meeting-recorder.meetings.get",
+    version: "1.0.0",
+    description: "Retrieve metadata for a single meeting recording.",
+    goal: "Allow downstream experiences to display detailed meeting metadata.",
+    context: "Used when drilling into a specific meeting from a transcript or integration dashboard.",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "meetings"],
+    stability: "experimental"
+  },
+  io: {
+    input: MeetingRecorderGetMeetingInput,
+    output: MeetingRecord
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var meetingRecorderMeetingContracts = {
+  MeetingRecorderListMeetings,
+  MeetingRecorderGetMeeting
+};
+function registerMeetingRecorderMeetingContracts(registry2) {
+  return registry2.register(MeetingRecorderListMeetings).register(MeetingRecorderGetMeeting);
+}
+
+// src/integrations/meeting-recorder/telemetry.ts
+var MEETING_RECORDER_PII_FIELDS = [
+  "email",
+  "organizerEmail",
+  "participantEmail",
+  "participants",
+  "invitees",
+  "attendees",
+  "speakerName",
+  "speakerEmail",
+  "name",
+  "phone",
+  "phoneNumber",
+  "displayName"
+];
+var MEETING_RECORDER_TELEMETRY_EVENTS = {
+  meetingsSynced: "meeting-recorder.meetings.synced",
+  meetingsSyncFailed: "meeting-recorder.meetings.sync_failed",
+  transcriptsFetched: "meeting-recorder.transcripts.fetched",
+  transcriptsFetchFailed: "meeting-recorder.transcripts.fetch_failed",
+  transcriptsSynced: "meeting-recorder.transcripts.synced",
+  transcriptsSyncFailed: "meeting-recorder.transcripts.sync_failed",
+  webhookReceived: "meeting-recorder.webhooks.received",
+  webhookRejected: "meeting-recorder.webhooks.rejected"
+};
+function redactMeetingRecorderTelemetryPayload(payload) {
+  const redacted = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (MEETING_RECORDER_PII_FIELDS.includes(key)) {
+      redacted[key] = maskValue2(value);
+    } else if (Array.isArray(value)) {
+      redacted[key] = value.map((item) => typeof item === "object" && item !== null ? redactMeetingRecorderTelemetryPayload(item) : item);
+    } else if (typeof value === "object" && value !== null) {
+      redacted[key] = redactMeetingRecorderTelemetryPayload(value);
+    } else {
+      redacted[key] = value;
+    }
+  }
+  return redacted;
+}
+function maskValue2(value) {
+  if (value == null)
+    return "";
+  const str = String(value);
+  if (str.length <= 4)
+    return "*".repeat(str.length);
+  return `${"*".repeat(Math.max(str.length - 4, 0))}${str.slice(-4)}`;
+}
+
+// src/integrations/meeting-recorder/contracts/transcripts.ts
+import { ScalarTypeEnum as ScalarTypeEnum7, SchemaModel as SchemaModel7 } from "@contractspec/lib.schema";
+import {
+  defineCommand as defineCommand4,
+  defineQuery as defineQuery5
+} from "@contractspec/lib.contracts-spec/operations";
+var MeetingRecorderGetTranscriptInput = new SchemaModel7({
+  name: "MeetingRecorderGetTranscriptInput",
+  description: "Parameters for fetching a meeting transcript.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum7.ID(), isOptional: false },
+    meetingId: { type: ScalarTypeEnum7.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum7.ID(), isOptional: true },
+    includeSegments: { type: ScalarTypeEnum7.Boolean(), isOptional: true },
+    format: { type: ScalarTypeEnum7.String_unsecure(), isOptional: true }
+  }
+});
+var MeetingRecorderSyncTranscriptInput = new SchemaModel7({
+  name: "MeetingRecorderSyncTranscriptInput",
+  description: "Command payload to synchronise meeting transcripts.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum7.ID(), isOptional: false },
+    meetingId: { type: ScalarTypeEnum7.ID(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum7.ID(), isOptional: true },
+    forceRefresh: { type: ScalarTypeEnum7.Boolean(), isOptional: true },
+    triggerWebhooks: { type: ScalarTypeEnum7.Boolean(), isOptional: true }
+  }
+});
+var MeetingRecorderSyncTranscriptOutput = new SchemaModel7({
+  name: "MeetingRecorderSyncTranscriptOutput",
+  description: "Result of a transcript synchronisation run.",
+  fields: {
+    synced: { type: ScalarTypeEnum7.Int_unsecure(), isOptional: false },
+    failed: { type: ScalarTypeEnum7.Int_unsecure(), isOptional: false },
+    errors: {
+      type: ScalarTypeEnum7.String_unsecure(),
+      isArray: true,
+      isOptional: true
+    },
+    nextSyncSuggestedAt: {
+      type: ScalarTypeEnum7.DateTime(),
+      isOptional: true
+    }
+  }
+});
+var MeetingRecorderGetTranscript = defineQuery5({
+  meta: {
+    key: "meeting-recorder.transcripts.get",
+    version: "1.0.0",
+    description: "Fetch the transcript for a specific meeting recording.",
+    goal: "Expose meeting transcripts for downstream knowledge and analytics flows.",
+    context: "Used by agents and dashboards to access the transcript for a selected meeting.",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "transcripts"],
+    stability: "experimental"
+  },
+  io: {
+    input: MeetingRecorderGetTranscriptInput,
+    output: MeetingTranscriptRecord
+  },
+  policy: {
+    auth: "user"
+  }
+});
+var MeetingRecorderSyncTranscript = defineCommand4({
+  meta: {
+    key: "meeting-recorder.transcripts.sync",
+    version: "1.0.0",
+    description: "Trigger a transcript sync from the meeting recorder provider.",
+    goal: "Keep canonical transcripts aligned with external meeting providers.",
+    context: "Invoked by scheduled jobs or webhooks when new transcripts are ready.",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "transcripts", "sync"],
+    stability: "experimental"
+  },
+  io: {
+    input: MeetingRecorderSyncTranscriptInput,
+    output: MeetingRecorderSyncTranscriptOutput
+  },
+  policy: {
+    auth: "admin"
+  },
+  telemetry: {
+    success: {
+      event: { key: MEETING_RECORDER_TELEMETRY_EVENTS.transcriptsSynced },
+      properties: ({ input, output }) => {
+        const payload = input;
+        const result = output;
+        return {
+          tenantId: payload?.tenantId,
+          meetingId: payload?.meetingId,
+          synced: result?.synced,
+          failed: result?.failed
+        };
+      }
+    },
+    failure: {
+      event: { key: MEETING_RECORDER_TELEMETRY_EVENTS.transcriptsSyncFailed },
+      properties: ({ input, error }) => {
+        const payload = input;
+        return {
+          tenantId: payload?.tenantId,
+          meetingId: payload?.meetingId,
+          error: error instanceof Error ? error.message : String(error ?? "unknown")
+        };
+      }
+    }
+  }
+});
+var meetingRecorderTranscriptContracts = {
+  MeetingRecorderGetTranscript,
+  MeetingRecorderSyncTranscript
+};
+function registerMeetingRecorderTranscriptContracts(registry2) {
+  return registry2.register(MeetingRecorderGetTranscript).register(MeetingRecorderSyncTranscript);
+}
+
+// src/integrations/meeting-recorder/contracts/webhooks.ts
+import { ScalarTypeEnum as ScalarTypeEnum8, SchemaModel as SchemaModel8 } from "@contractspec/lib.schema";
+import {
+  defineCommand as defineCommand5
+} from "@contractspec/lib.contracts-spec/operations";
+var MeetingRecorderWebhookIngestInput = new SchemaModel8({
+  name: "MeetingRecorderWebhookIngestInput",
+  description: "Payload for ingesting a meeting recorder webhook event.",
+  fields: {
+    tenantId: { type: ScalarTypeEnum8.ID(), isOptional: false },
+    providerKey: { type: ScalarTypeEnum8.String_unsecure(), isOptional: false },
+    connectionId: { type: ScalarTypeEnum8.ID(), isOptional: true },
+    webhookId: { type: ScalarTypeEnum8.String_unsecure(), isOptional: true },
+    headers: { type: ScalarTypeEnum8.JSON(), isOptional: true },
+    payload: { type: ScalarTypeEnum8.JSON(), isOptional: false },
+    receivedAt: { type: ScalarTypeEnum8.DateTime(), isOptional: true }
+  }
+});
+var MeetingRecorderWebhookIngestOutput = new SchemaModel8({
+  name: "MeetingRecorderWebhookIngestOutput",
+  description: "Result of processing a meeting recorder webhook.",
+  fields: {
+    accepted: { type: ScalarTypeEnum8.Boolean(), isOptional: false },
+    event: { type: MeetingRecorderWebhookEventRecord, isOptional: true }
+  }
+});
+var MeetingRecorderWebhookIngest = defineCommand5({
+  meta: {
+    key: "meeting-recorder.webhooks.ingest",
+    version: "1.0.0",
+    description: "Ingest a webhook from a meeting recorder provider.",
+    goal: "Trigger transcript syncs or downstream workflows without polling.",
+    context: "Used by webhook handlers to validate and normalize provider webhook events.",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "webhooks", "transcripts"],
+    stability: "experimental"
+  },
+  io: {
+    input: MeetingRecorderWebhookIngestInput,
+    output: MeetingRecorderWebhookIngestOutput
+  },
+  policy: {
+    auth: "admin"
+  }
+});
+var meetingRecorderWebhookContracts = {
+  MeetingRecorderWebhookIngest
+};
+function registerMeetingRecorderWebhookContracts(registry2) {
+  return registry2.register(MeetingRecorderWebhookIngest);
+}
+
+// src/integrations/meeting-recorder/meeting-recorder.feature.ts
+import { defineFeature as defineFeature2 } from "@contractspec/lib.contracts-spec/features";
+var MeetingRecorderFeature = defineFeature2({
+  meta: {
+    key: "meeting-recorder",
+    version: "1.0.0",
+    title: "Meeting Recorder Integration",
+    description: "Meeting metadata, transcript retrieval, and webhook ingestion for meeting recorder providers.",
+    domain: "integrations",
+    owners: ["@platform.integrations"],
+    tags: ["meeting-recorder", "transcripts", "integrations"],
+    stability: "experimental"
+  },
+  operations: [
+    { key: "meeting-recorder.meetings.list", version: "1.0.0" },
+    { key: "meeting-recorder.meetings.get", version: "1.0.0" },
+    { key: "meeting-recorder.transcripts.get", version: "1.0.0" },
+    { key: "meeting-recorder.transcripts.sync", version: "1.0.0" },
+    { key: "meeting-recorder.webhooks.ingest", version: "1.0.0" }
+  ],
+  events: [],
+  presentations: [],
+  opToPresentation: [],
+  presentationsTargets: [],
+  capabilities: {
+    provides: [{ key: "meeting-recorder", version: "1.0.0" }],
+    requires: [{ key: "identity", version: "1.0.0" }]
+  }
+});
+// src/integrations/meeting-recorder/contracts/index.ts
+function registerMeetingRecorderContracts(registry2) {
+  return registerMeetingRecorderWebhookContracts(registerMeetingRecorderTranscriptContracts(registerMeetingRecorderMeetingContracts(registry2)));
+}
+// src/integrations/health.ts
+class IntegrationHealthService {
+  telemetry;
+  nowFn;
+  constructor(options = {}) {
+    this.telemetry = options.telemetry;
+    this.nowFn = options.now ?? (() => new Date);
+  }
+  async check(context, executor) {
+    const start = this.nowFn();
+    try {
+      await executor(context);
+      const end = this.nowFn();
+      const result = {
+        status: "connected",
+        checkedAt: end,
+        latencyMs: end.getTime() - start.getTime()
+      };
+      this.emitTelemetry(context, result, "success");
+      return result;
+    } catch (error) {
+      const end = this.nowFn();
+      const message = error instanceof Error ? error.message : "Unknown error";
+      const code = extractErrorCode(error);
+      const result = {
+        status: "error",
+        checkedAt: end,
+        latencyMs: end.getTime() - start.getTime(),
+        errorMessage: message,
+        errorCode: code
+      };
+      this.emitTelemetry(context, result, "error", code, message);
+      return result;
+    }
+  }
+  emitTelemetry(context, result, status, errorCode, errorMessage) {
+    if (!this.telemetry)
+      return;
+    this.telemetry.record({
+      tenantId: context.tenantId,
+      appId: context.appId,
+      environment: context.environment,
+      slotId: context.slotId,
+      integrationKey: context.spec.meta.key,
+      integrationVersion: context.spec.meta.version,
+      connectionId: context.connection.meta.id,
+      status,
+      durationMs: result.latencyMs,
+      errorCode,
+      errorMessage,
+      occurredAt: result.checkedAt ?? this.nowFn(),
+      metadata: {
+        ...context.trace ? {
+          blueprint: `${context.trace.blueprintName}.v${context.trace.blueprintVersion}`,
+          configVersion: context.trace.configVersion
+        } : {},
+        status: result.status
+      }
+    });
+  }
+}
+function extractErrorCode(error) {
+  if (!error || typeof error !== "object")
+    return;
+  const candidate = error;
+  if (candidate.code == null)
+    return;
+  return String(candidate.code);
+}
+
+// src/integrations/integrations.capability.ts
+import { defineCapability } from "@contractspec/lib.contracts-spec/capabilities";
+import { StabilityEnum as StabilityEnum24 } from "@contractspec/lib.contracts-spec/ownership";
+var IntegrationsCapability = defineCapability({
+  meta: {
+    key: "integrations",
+    version: "1.0.0",
+    kind: "integration",
+    stability: StabilityEnum24.Experimental,
+    description: "Core integrations capability for third-party connections",
+    owners: ["@platform.core"],
+    tags: ["integrations", "platform"]
+  }
+});
+
+// src/integrations/integrations.feature.ts
+import { defineFeature as defineFeature3 } from "@contractspec/lib.contracts-spec/features";
+var IntegrationsFeature = defineFeature3({
+  meta: {
+    key: "platform.integrations",
+    version: "1.0.0",
+    title: "Platform Integrations",
+    description: "Manage integration connections to external providers (e.g., Stripe, Qdrant)",
+    domain: "platform",
+    owners: ["@platform.integrations"],
+    tags: ["integrations", "connections", "platform"],
+    stability: "experimental"
+  },
+  operations: [
+    { key: "integrations.connection.create", version: "1.0.0" },
+    { key: "integrations.connection.update", version: "1.0.0" },
+    { key: "integrations.connection.delete", version: "1.0.0" },
+    { key: "integrations.connection.list", version: "1.0.0" },
+    { key: "integrations.connection.test", version: "1.0.0" }
+  ],
+  events: [],
+  presentations: [],
+  opToPresentation: [],
+  presentationsTargets: [],
+  capabilities: {
+    provides: [{ key: "integrations", version: "1.0.0" }],
+    requires: [{ key: "identity", version: "1.0.0" }]
+  }
+});
+
+// src/integrations/operations.ts
+import { ScalarTypeEnum as ScalarTypeEnum9, SchemaModel as SchemaModel9 } from "@contractspec/lib.schema";
+import {
+  defineCommand as defineCommand6,
+  defineQuery as defineQuery6
+} from "@contractspec/lib.contracts-spec/operations";
+var IntegrationConnectionRecord = new SchemaModel9({
+  name: "IntegrationConnectionRecord",
+  fields: {
+    id: { type: ScalarTypeEnum9.ID(), isOptional: false },
+    tenantId: { type: ScalarTypeEnum9.ID(), isOptional: false },
+    integrationKey: {
+      type: ScalarTypeEnum9.NonEmptyString(),
+      isOptional: false
+    },
+    integrationVersion: {
+      type: ScalarTypeEnum9.Int_unsecure(),
+      isOptional: false
+    },
+    label: { type: ScalarTypeEnum9.String_unsecure(), isOptional: false },
+    ownershipMode: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: false
+    },
+    externalAccountId: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    secretProvider: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: false
+    },
+    secretRef: { type: ScalarTypeEnum9.String_unsecure(), isOptional: false },
+    status: { type: ScalarTypeEnum9.String_unsecure(), isOptional: false },
+    environment: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    healthStatus: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    healthCheckedAt: { type: ScalarTypeEnum9.DateTime(), isOptional: true },
+    healthLatencyMs: {
+      type: ScalarTypeEnum9.Float_unsecure(),
+      isOptional: true
+    },
+    healthErrorCode: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    healthErrorMessage: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    usageRequestCount: {
+      type: ScalarTypeEnum9.Int_unsecure(),
+      isOptional: true
+    },
+    usageSuccessCount: {
+      type: ScalarTypeEnum9.Int_unsecure(),
+      isOptional: true
+    },
+    usageErrorCount: {
+      type: ScalarTypeEnum9.Int_unsecure(),
+      isOptional: true
+    },
+    usageLastUsedAt: {
+      type: ScalarTypeEnum9.DateTime(),
+      isOptional: true
+    },
+    usageLastErrorAt: {
+      type: ScalarTypeEnum9.DateTime(),
+      isOptional: true
+    },
+    usageLastErrorCode: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    createdAt: { type: ScalarTypeEnum9.DateTime(), isOptional: true },
+    updatedAt: { type: ScalarTypeEnum9.DateTime(), isOptional: true }
+  }
+});
+var CreateIntegrationConnectionInput = new SchemaModel9({
+  name: "CreateIntegrationConnectionInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum9.ID(), isOptional: false },
+    integrationKey: {
+      type: ScalarTypeEnum9.NonEmptyString(),
+      isOptional: false
+    },
+    integrationVersion: {
+      type: ScalarTypeEnum9.Int_unsecure(),
+      isOptional: false
+    },
+    label: { type: ScalarTypeEnum9.String_unsecure(), isOptional: false },
+    ownershipMode: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: false
+    },
+    externalAccountId: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    secretProvider: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: false
+    },
+    secretRef: { type: ScalarTypeEnum9.String_unsecure(), isOptional: false },
+    environment: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    config: { type: ScalarTypeEnum9.JSONObject(), isOptional: false }
+  }
+});
+var UpdateIntegrationConnectionInput = new SchemaModel9({
+  name: "UpdateIntegrationConnectionInput",
+  fields: {
+    connectionId: { type: ScalarTypeEnum9.ID(), isOptional: false },
+    label: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    status: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    ownershipMode: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    externalAccountId: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    secretProvider: {
+      type: ScalarTypeEnum9.String_unsecure(),
+      isOptional: true
+    },
+    secretRef: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    config: { type: ScalarTypeEnum9.JSONObject(), isOptional: true }
+  }
+});
+var DeleteIntegrationConnectionInput = new SchemaModel9({
+  name: "DeleteIntegrationConnectionInput",
+  fields: {
+    connectionId: { type: ScalarTypeEnum9.ID(), isOptional: false }
+  }
+});
+var ListIntegrationConnectionsInput = new SchemaModel9({
+  name: "ListIntegrationConnectionsInput",
+  fields: {
+    tenantId: { type: ScalarTypeEnum9.ID(), isOptional: false },
+    category: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    status: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true }
+  }
+});
+var ListIntegrationConnectionsOutput = new SchemaModel9({
+  name: "ListIntegrationConnectionsOutput",
+  fields: {
+    connections: {
+      type: IntegrationConnectionRecord,
+      isOptional: false,
+      isArray: true
+    }
+  }
+});
+var TestIntegrationConnectionInput = new SchemaModel9({
+  name: "TestIntegrationConnectionInput",
+  fields: {
+    connectionId: { type: ScalarTypeEnum9.ID(), isOptional: false }
+  }
+});
+var TestIntegrationConnectionOutput = new SchemaModel9({
+  name: "TestIntegrationConnectionOutput",
+  fields: {
+    success: { type: ScalarTypeEnum9.Boolean(), isOptional: false },
+    status: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    latencyMs: { type: ScalarTypeEnum9.Float_unsecure(), isOptional: true },
+    error: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true },
+    errorCode: { type: ScalarTypeEnum9.String_unsecure(), isOptional: true }
+  }
+});
+var DeleteIntegrationConnectionOutput = new SchemaModel9({
+  name: "DeleteIntegrationConnectionOutput",
+  fields: {
+    success: { type: ScalarTypeEnum9.Boolean(), isOptional: false }
+  }
+});
+var CreateIntegrationConnection = defineCommand6({
+  meta: {
+    key: "integrations.connection.create",
+    title: "Create Integration Connection",
+    version: "1.0.0",
+    description: "Create a new integration connection for a tenant.",
+    goal: "Provision a tenant-scoped connection to an external provider.",
+    context: "Used by Ops or the App Studio to configure external integrations such as Stripe or Qdrant.",
+    owners: ["@platform.integrations"],
+    tags: ["integration", "connections"],
+    stability: "experimental"
+  },
+  io: {
+    input: CreateIntegrationConnectionInput,
+    output: IntegrationConnectionRecord
+  },
+  policy: {
+    auth: "admin",
+    policies: [{ key: "platform.integration.manage", version: "1.0.0" }]
+  }
+});
+var UpdateIntegrationConnection = defineCommand6({
+  meta: {
+    key: "integrations.connection.update",
+    title: "Update Integration Connection",
+    version: "1.0.0",
+    description: "Update metadata or credentials for an integration connection.",
+    goal: "Allow secure rotation of credentials and metadata adjustments.",
+    context: "Supports rotating API keys, toggling status, or updating labels for tenant integrations.",
+    owners: ["@platform.integrations"],
+    tags: ["integration", "connections"],
+    stability: "experimental"
+  },
+  io: {
+    input: UpdateIntegrationConnectionInput,
+    output: IntegrationConnectionRecord
+  },
+  policy: {
+    auth: "admin",
+    policies: [{ key: "platform.integration.manage", version: "1.0.0" }]
+  }
+});
+var DeleteIntegrationConnection = defineCommand6({
+  meta: {
+    key: "integrations.connection.delete",
+    title: "Delete Integration Connection",
+    version: "1.0.0",
+    description: "Delete an integration connection for a tenant.",
+    goal: "Safely remove credentials and disable connector usage.",
+    context: "Ensures connections are de-provisioned when no longer needed or breached.",
+    owners: ["@platform.integrations"],
+    tags: ["integration", "connections"],
+    stability: "experimental"
+  },
+  io: {
+    input: DeleteIntegrationConnectionInput,
+    output: DeleteIntegrationConnectionOutput
+  },
+  policy: {
+    auth: "admin",
+    policies: [{ key: "platform.integration.manage", version: "1.0.0" }]
+  }
+});
+var ListIntegrationConnections = defineQuery6({
+  meta: {
+    key: "integrations.connection.list",
+    title: "List Integration Connections",
+    version: "1.0.0",
+    description: "List integration connections for a tenant.",
+    goal: "Provide visibility into configured integrations and their status.",
+    context: "Used by the App Studio and Ops flows to show bindings and health.",
+    owners: ["@platform.integrations"],
+    tags: ["integration", "connections"],
+    stability: "experimental"
+  },
+  io: {
+    input: ListIntegrationConnectionsInput,
+    output: ListIntegrationConnectionsOutput
+  },
+  policy: {
+    auth: "admin",
+    policies: [{ key: "platform.integration.read", version: "1.0.0" }]
+  }
+});
+var TestIntegrationConnection = defineCommand6({
+  meta: {
+    key: "integrations.connection.test",
+    title: "Test Integration Connection",
+    version: "1.0.0",
+    description: "Run a health check against a configured integration connection.",
+    goal: "Validate credentials and connectivity for external providers.",
+    context: "Triggered manually or by background monitors to confirm provider availability.",
+    owners: ["@platform.integrations"],
+    tags: ["integration", "connections"],
+    stability: "experimental"
+  },
+  io: {
+    input: TestIntegrationConnectionInput,
+    output: TestIntegrationConnectionOutput
+  },
+  policy: {
+    auth: "admin",
+    policies: [{ key: "platform.integration.manage", version: "1.0.0" }]
+  }
+});
+var integrationContracts = {
+  CreateIntegrationConnection,
+  UpdateIntegrationConnection,
+  DeleteIntegrationConnection,
+  ListIntegrationConnections,
+  TestIntegrationConnection
+};
+function registerIntegrationContracts(registry2) {
+  return registry2.register(CreateIntegrationConnection).register(UpdateIntegrationConnection).register(DeleteIntegrationConnection).register(ListIntegrationConnections).register(TestIntegrationConnection);
+}
+export {
+  twilioSmsIntegrationSpec,
+  tldvIntegrationSpec,
+  supabaseVectorIntegrationSpec,
+  supabasePostgresIntegrationSpec,
+  stripeIntegrationSpec,
+  registerTwilioSmsIntegration,
+  registerTldvIntegration,
+  registerSupabaseVectorIntegration,
+  registerSupabasePostgresIntegration,
+  registerStripeIntegration,
+  registerQdrantIntegration,
+  registerPowensIntegration,
+  registerPostmarkIntegration,
+  registerPosthogIntegration,
+  registerOpenBankingContracts,
+  registerNotionIntegration,
+  registerMistralIntegration,
+  registerMeetingRecorderContracts,
+  registerLinearIntegration,
+  registerJiraIntegration,
+  registerIntegrationContracts,
+  registerGranolaIntegration,
+  registerGradiumIntegration,
+  registerGoogleCalendarIntegration,
+  registerGmailIntegration,
+  registerGcsStorageIntegration,
+  registerFirefliesIntegration,
+  registerFathomIntegration,
+  registerFalIntegration,
+  registerElevenLabsIntegration,
+  redactPostHogLLMTelemetryPayload,
+  redactOpenBankingTelemetryPayload,
+  redactMeetingRecorderTelemetryPayload,
+  qdrantIntegrationSpec,
+  powensIntegrationSpec,
+  postmarkIntegrationSpec,
+  posthogLLMTelemetrySpec,
+  posthogIntegrationSpec,
+  notionIntegrationSpec,
+  mistralIntegrationSpec,
+  makeIntegrationSpecKey,
+  linearIntegrationSpec,
+  jiraIntegrationSpec,
+  integrationContracts,
+  granolaIntegrationSpec,
+  gradiumIntegrationSpec,
+  googleCalendarIntegrationSpec,
+  gmailIntegrationSpec,
+  gcsStorageIntegrationSpec,
+  firefliesIntegrationSpec,
+  fathomIntegrationSpec,
+  falIntegrationSpec,
+  ensurePrimaryOpenBankingIntegration,
+  elevenLabsIntegrationSpec,
+  defineIntegration,
+  createDefaultIntegrationSpecRegistry,
+  assertPrimaryOpenBankingReady,
+  UpdateIntegrationConnection,
+  TestIntegrationConnection,
+  POSTHOG_LLM_TELEMETRY_EVENTS,
+  POSTHOG_LLM_PII_FIELDS,
+  POSTHOG_EVALUATION_TEMPLATES,
+  OpenBankingSyncTransactions,
+  OpenBankingSyncAccounts,
+  OpenBankingRefreshBalances,
+  OpenBankingListTransactions,
+  OpenBankingListAccounts,
+  OpenBankingGetBalances,
+  OpenBankingGetAccount,
+  OpenBankingFeature,
+  OPENBANKING_TELEMETRY_EVENTS,
+  OPENBANKING_PII_FIELDS,
+  MeetingTranscriptSegmentRecord,
+  MeetingTranscriptRecord as MeetingTranscriptRecordModel,
+  MeetingRecorderWebhookIngest,
+  MeetingRecorderWebhookEventRecord,
+  MeetingRecorderSyncTranscript,
+  MeetingRecorderListMeetings,
+  MeetingRecorderGetTranscript,
+  MeetingRecorderGetMeeting,
+  MeetingRecorderFeature,
+  MeetingRecord as MeetingRecordModel,
+  MeetingParticipantRecord,
+  MEETING_RECORDER_TELEMETRY_EVENTS,
+  MEETING_RECORDER_PII_FIELDS,
+  ListIntegrationConnections,
+  IntegrationsFeature,
+  IntegrationsCapability,
+  IntegrationSpecRegistry,
+  IntegrationHealthService,
+  DeleteIntegrationConnection,
+  CreateIntegrationConnection,
+  BankTransactionRecord,
+  BankAccountRecord,
+  AccountBalanceRecord
+};