@lssm/lib.contracts-integrations 9.0.1

package/dist/integrations/docs/integrations.docblock.js

@@ -0,0 +1,101 @@
+// @bun
+import{registerDocBlocks as e}from"@lssm/lib.contracts-spec/docs/registry";var t=[{id:"docs.tech.contracts.integrations",title:"ContractSpec Integrations",summary:"Provider-agnostic integration contracts: specs, connections, secrets, health checks, and runtime guards.",kind:"reference",visibility:"public",route:"/docs/tech/contracts/integrations",tags:["tech","contracts","integrations"],body:`# ContractSpec Integrations
+
+This document describes the integration architecture that powers ContractSpec-based apps. It focuses on provider-agnostic contracts, secret management, health checks, and runtime guards.
+
+## Core Concepts
+
+- **IntegrationSpec** \u2013 declarative description of a provider that lists supported ownership modes, capability mappings, configuration schema, secret schema, health check policy, and documentation metadata.
+- **IntegrationConnection** \u2013 tenant/environment binding to a provider (\`meta\` + ownership mode + config + \`secretRef\`). Secrets are never embedded in specs or configs.
+- **AppIntegrationSlot** \u2013 blueprint-level requirement that declares which integration categories/capabilities must be satisfied at runtime (e.g. \`primaryLLM\`, \`primaryVectorDb\`).
+- **AppIntegrationBinding** \u2013 tenant-level slot \u2192 connection mapping.
+- **ResolvedIntegration** \u2013 runtime view containing slot metadata, connection details, and the resolved IntegrationSpec.
+
+## Registered Providers
+
+The contracts library ships twenty-two priority providers in \`packages/libs/contracts/src/integrations/providers\`:
+
+| Category      | Provider         | Key                         | Notes                                             |
+| ------------- | ---------------- | --------------------------- | ------------------------------------------------- |
+| payments      | Stripe           | \`payments.stripe\`          | Card + invoice flows, managed or BYOK credentials |
+| email (out)   | Postmark         | \`email.postmark\`           | Transactional email delivery                      |
+| email (in)    | Gmail API        | \`email.gmail\`              | Thread ingestion (OAuth BYOK or service account)  |
+| calendar      | Google Calendar  | \`calendar.google\`          | Event scheduling via service account              |
+| analytics     | PostHog          | \`analytics.posthog\`         | Product analytics, flags, and HogQL queries       |
+| vector-db     | Qdrant           | \`vectordb.qdrant\`          | Embedding storage & search                        |
+| vector-db     | Supabase pgvector| \`vectordb.supabase\`        | Embedding storage & search on Supabase Postgres   |
+| database      | Supabase Postgres| \`database.supabase\`        | SQL queries and transactions on Supabase Postgres |
+| storage       | Google Cloud     | \`storage.gcs\`              | Object storage                                    |
+| storage       | Google Drive     | \`storage.google-drive\`     | File search, retrieval, and knowledge ingestion   |
+| ai-llm        | Mistral          | \`ai-llm.mistral\`           | Primary chat + embedding provider                 |
+| ai-voice      | ElevenLabs       | \`ai-voice.elevenlabs\`      | Text-to-speech synthesis                          |
+| ai-voice      | Gradium          | \`ai-voice.gradium\`         | Low-latency text-to-speech synthesis              |
+| ai-voice      | Fal Chatterbox   | \`ai-voice.fal\`             | Chatterbox text-to-speech via queue API           |
+| sms           | Twilio SMS       | \`sms.twilio\`               | Urgent and fallback reminders                     |
+| open-banking  | Powens           | \`openbanking.powens\`       | Read-only account, transaction, and balance sync  |
+| project-management | Linear       | \`project-management.linear\` | Issues, project tracking, and team tasks          |
+| project-management | Jira Cloud   | \`project-management.jira\`   | Work item sync for Jira Cloud                     |
+| project-management | Notion       | \`project-management.notion\` | Shared summaries and task databases               |
+| meeting-recorder | Granola       | \`meeting-recorder.granola\`  | Meeting notes + transcripts via API or MCP        |
+| meeting-recorder | tl;dv         | \`meeting-recorder.tldv\`     | Meeting recordings, transcripts, and webhooks     |
+| meeting-recorder | Fireflies     | \`meeting-recorder.fireflies\` | GraphQL transcripts + webhook events              |
+| meeting-recorder | Fathom        | \`meeting-recorder.fathom\`   | External API meetings + webhook registration      |
+
+Matrix is bridge-aware but does not replace direct Slack, Telegram, WhatsApp, SMS, email, or other provider integrations. Homeserver provisioning, hosted signup automation, and bridge installation remain externally managed.
+
+PostHog adapters also support read access (events, persons, insights, cohorts, annotations) via analytics providers.
+
+Each provider ships with:
+
+- Strongly typed adapter interfaces (\`payments.ts\`, \`llm.ts\`, etc.)
+- A concrete SDK-backed implementation under \`providers/impls\`
+- Unit tests validating adapter behaviour and health checks
+
+Provider delta-capable integrations such as Gmail and Google Drive can also
+carry lease ownership, cursor/watermark versions, webhook channel expiry,
+provider event IDs, dedupe/idempotency keys, replay checkpoints, and
+tombstones before runtime sync workers begin.
+
+### Example package
+
+- Supabase dual-store example (vector + SQL): \`@lssm/example.integration-supabase\`
+
+### Canonical registry builder
+
+To list all shipped specs at runtime, use:
+
+- \`createDefaultIntegrationSpecRegistry()\` from \`@lssm/lib.contracts-integrations\`
+
+## Secret Management
+
+All integrations rely on the \`SecretProvider\` abstraction defined in \`integrations/secrets\`. Providers ship with the contracts library and are orchestrated by the \`SecretProviderManager\` composite:
+
+- **EnvSecretProvider** (\`env-secret-provider.ts\`) \u2013 high-priority, read-only overrides backed by environment variables.
+  - Supports the \`env://VARIABLE_NAME\` scheme
+  - Supports overrides for other schemes via \`?env=ALIAS\` or derived uppercase keys
+- **GcpSecretManagerProvider** (\`gcp-secret-manager.ts\`) \u2013 versioned secrets stored in Google Cloud Secret Manager.
+  - Example: \`gcp://projects/demo/secrets/stripe-key/versions/latest\`
+- **AwsSecretsManagerProvider** (\`aws-secret-manager.ts\`) \u2013 AWS Secrets Manager backend.
+  - Example: \`aws://secretsmanager/eu-west-1/my-secret?version=AWSCURRENT\`
+  - Region may be in the reference or provided via \`AWS_REGION\` / \`AWS_DEFAULT_REGION\`
+- **ScalewaySecretManagerProvider** (\`scaleway-secret-manager.ts\`) \u2013 Scaleway Secret Manager backend.
+  - Example (id): \`scw://secret-manager/fr-par/1234...-uuid?version=latest\`
+  - Example (name, create+write): \`scw://secret-manager/fr-par/my-secret-name\`
+  - Requires \`SCW_SECRET_KEY\` (token) and \`SCW_DEFAULT_PROJECT_ID\` when creating secrets by name
+
+The manager attempts providers in priority order (environment first, then cloud providers). Key points:
+
+- \`secretRef\` is a URI-like reference; raw secrets are never returned.
+- \`IntegrationCallGuard\` fetches and parses secrets before executing a provider adapter.
+- Local development can rely on \`.env\` files, while staging/production reference cloud secret stores.
+
+## Health Checks & Telemetry
+
+- Each IntegrationSpec optionally declares \`healthCheck.method\` and timeouts.
+- \`IntegrationCallGuard\` enforces connection status, wraps retries with exponential back-off, and emits telemetry events tagged with tenant/app/slot metadata.
+- Validation rules (\`app-config/validation.ts\`) surface issues at publish time (slot mismatch, unsupported ownership modes, missing capabilities, etc.).
+
+## Studio persistence (ContractSpec Studio)
+
+ContractSpec Studio persists tenant \`IntegrationConnection\` records in Postgres (Prisma model \`IntegrationConnection\` in \`@lssm/lib.database-studio\`) and exposes a platform-admin management surface (see the Studio platform admin panel).
+`}];e(t);export{t as tech_contracts_integrations_DocBlocks};

package/dist/integrations/email-operations.d.ts

@@ -0,0 +1,152 @@
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const EmailProviderHealthQuery: import("@lssm/lib.contracts-spec").OperationSpec<SchemaModel<{
+    tenantId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, SchemaModel<{
+    provider: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    status: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    checkedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+    latencyMs: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: true;
+    };
+    errorCode: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>, undefined>;
+export declare const ListEmailInboundRoutesQuery: import("@lssm/lib.contracts-spec").OperationSpec<SchemaModel<{
+    tenantId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, SchemaModel<{
+    provider: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    routes: {
+        type: SchemaModel<{
+            id: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            domainId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            name: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            enabled: {
+                type: import("@lssm/lib.schema").FieldType<boolean, boolean>;
+                isOptional: false;
+            };
+            createdAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: true;
+            };
+            updatedAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: true;
+            };
+        }>;
+        isOptional: false;
+        isArray: true;
+    };
+}>, undefined>;
+export declare const emailProviderOperations: readonly [import("@lssm/lib.contracts-spec").OperationSpec<SchemaModel<{
+    tenantId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, SchemaModel<{
+    provider: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    status: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    checkedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+    latencyMs: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: true;
+    };
+    errorCode: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>, undefined>, import("@lssm/lib.contracts-spec").OperationSpec<SchemaModel<{
+    tenantId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, SchemaModel<{
+    provider: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    routes: {
+        type: SchemaModel<{
+            id: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            domainId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            name: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            enabled: {
+                type: import("@lssm/lib.schema").FieldType<boolean, boolean>;
+                isOptional: false;
+            };
+            createdAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: true;
+            };
+            updatedAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: true;
+            };
+        }>;
+        isOptional: false;
+        isArray: true;
+    };
+}>, undefined>];

package/dist/integrations/email-operations.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineQuery as i}from"@lssm/lib.contracts-spec/operations";import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";var n=new t({name:"EmailProviderScopeInput",fields:{tenantId:{type:e.ID(),isOptional:!1},connectionId:{type:e.ID(),isOptional:!1}}}),o=new t({name:"EmailProviderHealthOutput",fields:{provider:{type:e.NonEmptyString(),isOptional:!1},status:{type:e.NonEmptyString(),isOptional:!1},checkedAt:{type:e.DateTime(),isOptional:!1},latencyMs:{type:e.Float_unsecure(),isOptional:!0},errorCode:{type:e.String_unsecure(),isOptional:!0}}}),a=new t({name:"EmailInboundRouteRecord",fields:{id:{type:e.ID(),isOptional:!1},domainId:{type:e.ID(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},enabled:{type:e.Boolean(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!0},updatedAt:{type:e.DateTime(),isOptional:!0}}}),r=new t({name:"EmailInboundRoutesOutput",fields:{provider:{type:e.NonEmptyString(),isOptional:!1},routes:{type:a,isOptional:!1,isArray:!0}}}),s=i({meta:{key:"integrations.email.provider.health",title:"Inspect Email Provider Health",version:"1.0.0",description:"Inspect the redacted health state of a tenant-scoped email provider connection.",goal:"Give operators and governed agents safe provider diagnostics.",context:"Returns health metadata only; credentials and provider response bodies are never exposed.",owners:["@platform.integrations"],tags:["integration","email","health"],stability:"experimental"},io:{input:n,output:o},policy:{auth:"admin",policies:[{key:"platform.integration.read",version:"1.0.0"}]}}),l=i({meta:{key:"integrations.email.inbound-routes.list",title:"List Email Inbound Routes",version:"1.0.0",description:"List redacted inbound routing metadata for a tenant-scoped email provider connection.",goal:"Let operators verify inbound delivery configuration without revealing secrets.",context:"Exposes identifiers, labels, enabled state, and timestamps; filters and webhook secrets stay server-side.",owners:["@platform.integrations"],tags:["integration","email","inbound"],stability:"experimental"},io:{input:n,output:r},policy:{auth:"admin",policies:[{key:"platform.integration.read",version:"1.0.0"}]}}),u=[s,l];export{s as EmailProviderHealthQuery,l as ListEmailInboundRoutesQuery,u as emailProviderOperations};

package/dist/integrations/gtm/capability-ledger.d.ts

@@ -0,0 +1,48 @@
+export declare const capabilityGranularities: readonly ['endpoint', 'webhook-event', 'oauth-scope', 'hosted-mcp-tool', 'hosted-mcp-category'];
+export declare const implementationStates: readonly ['implemented', 'deferred', 'not-applicable'];
+export declare const capabilityAvailabilities: readonly ['public', 'plan-gated', 'account-gated', 'vendor-unsupported'];
+export declare const capabilityStabilities: readonly ['stable', 'beta', 'alpha', 'deprecated'];
+export declare const surfaceSupportStates: readonly ['supported', 'unsupported', 'discovered-at-connect', 'not-applicable'];
+export declare const capabilitySurfaceNames: readonly ['api', 'localMcp', 'hostedMcp', 'inboundWebhook', 'outboundWebhook'];
+type ValueOf<T extends readonly string[]> = T[number];
+export interface CapabilitySurfaceSupport {
+    state: ValueOf<typeof surfaceSupportStates>;
+    reason?: string;
+}
+export interface CapabilityLedgerRow {
+    upstreamCapabilityId: string;
+    granularity: ValueOf<typeof capabilityGranularities>;
+    implementationState: ValueOf<typeof implementationStates>;
+    availability: ValueOf<typeof capabilityAvailabilities>;
+    stability: ValueOf<typeof capabilityStabilities>;
+    surfaces: Record<ValueOf<typeof capabilitySurfaceNames>, CapabilitySurfaceSupport>;
+    contract: {
+        operationKeys: string[];
+        eventKeys: string[];
+    };
+    auth: {
+        methods: string[];
+        scopes: string[];
+    };
+    effects: string[];
+    evidence: {
+        sourceUrl: string;
+        sha256: string;
+        retrievedAt: string;
+    };
+    testIds: string[];
+    waiverArtifact?: string;
+}
+export interface CapabilityEvidenceManifest {
+    provider: string;
+    sourceUrl: string;
+    retrievedAt: string;
+    sha256: string;
+    redistribution: 'digest-only' | 'redistributable';
+    stability: ValueOf<typeof capabilityStabilities>;
+}
+export declare function assertCapabilityLedger(rows: readonly unknown[], options?: {
+    release?: boolean;
+}): asserts rows is CapabilityLedgerRow[];
+export declare function assertPinnedEvidenceDigest(manifest: CapabilityEvidenceManifest, observedSha256: string): void;
+export {};

package/dist/integrations/gtm/capability-ledger.fixture-helpers.d.ts

@@ -0,0 +1,9 @@
+import type { CapabilityEvidenceManifest, CapabilityLedgerRow } from './capability-ledger.js';
+export declare function apiCapability(id: string, operationKey: string, evidence: CapabilityEvidenceManifest, options?: {
+    availability?: CapabilityLedgerRow['availability'];
+    stability?: CapabilityLedgerRow['stability'];
+    effects?: string[];
+}): CapabilityLedgerRow;
+export declare function webhookCapability(id: string, eventKey: string | readonly string[], evidence: CapabilityEvidenceManifest, operationKey?: string): CapabilityLedgerRow;
+export declare function outboundWebhookCapability(id: string, operationKey: string, evidence: CapabilityEvidenceManifest): CapabilityLedgerRow;
+export declare function hostedCategory(id: string, evidence: CapabilityEvidenceManifest): CapabilityLedgerRow;

package/dist/integrations/gtm/capability-ledger.fixture-helpers.js

@@ -0,0 +1,2 @@
+// @bun
+var s=(t)=>({state:"unsupported",reason:t}),e=(t)=>({state:"not-applicable",reason:t});function n(t,a,i,o={}){return{upstreamCapabilityId:t,granularity:"endpoint",implementationState:"implemented",availability:o.availability??"public",stability:o.stability??i.stability,surfaces:{api:{state:"supported"},localMcp:{state:"supported"},hostedMcp:e("Tracked separately as an external catalog"),inboundWebhook:e("This unit is an API endpoint"),outboundWebhook:e("This unit is an API endpoint")},contract:{operationKeys:[a],eventKeys:[]},auth:{methods:["provider-credential"],scopes:[]},effects:o.effects??["read"],evidence:i,testIds:[`coverage:${t}`]}}function r(t,a,i,o){return{upstreamCapabilityId:t,granularity:"webhook-event",implementationState:"implemented",availability:"public",stability:i.stability,surfaces:{api:s("Webhook delivery is raw ingress"),localMcp:s("Raw webhook ingress is never projected to MCP"),hostedMcp:e("Webhook delivery is not a hosted MCP tool"),inboundWebhook:{state:"supported"},outboundWebhook:e("This unit is inbound delivery")},contract:{operationKeys:o?[o]:[],eventKeys:typeof a==="string"?[a]:[...a]},auth:{methods:["webhook-policy"],scopes:[]},effects:["external-side-effect"],evidence:i,testIds:[`coverage:${t}`]}}function p(t,a,i){return{upstreamCapabilityId:t,granularity:"endpoint",implementationState:"implemented",availability:"public",stability:i.stability,surfaces:{api:{state:"supported"},localMcp:{state:"supported"},hostedMcp:e("Outbound delivery is not hosted MCP"),inboundWebhook:e("This unit sends outbound delivery"),outboundWebhook:{state:"supported"}},contract:{operationKeys:[a],eventKeys:[]},auth:{methods:["configured-shared-token"],scopes:[]},effects:["external-side-effect","write"],evidence:i,testIds:[`coverage:${t}`]}}function l(t,a){return{upstreamCapabilityId:t,granularity:"hosted-mcp-category",implementationState:"not-applicable",availability:"account-gated",stability:a.stability,surfaces:{api:e("Vendor-hosted catalog is an external session"),localMcp:e("Local MCP projects ContractSpec operations"),hostedMcp:{state:"discovered-at-connect"},inboundWebhook:e("Hosted MCP category is not webhook ingress"),outboundWebhook:e("Hosted MCP category is not a webhook target")},contract:{operationKeys:[],eventKeys:[]},auth:{methods:["oauth2"],scopes:[]},effects:[],evidence:a,testIds:[`hosted-mcp:${t}`]}}export{n as apiCapability,l as hostedCategory,p as outboundWebhookCapability,r as webhookCapability};

package/dist/integrations/gtm/capability-ledger.fixtures.d.ts

@@ -0,0 +1,5 @@
+import type { CapabilityEvidenceManifest, CapabilityLedgerRow } from './capability-ledger.js';
+export declare const gtmEvidenceManifests: readonly [CapabilityEvidenceManifest, CapabilityEvidenceManifest, CapabilityEvidenceManifest];
+export declare const attioCapabilityLedger: CapabilityLedgerRow[];
+export declare const clayCapabilityLedger: CapabilityLedgerRow[];
+export declare const fullEnrichCapabilityLedger: CapabilityLedgerRow[];

package/dist/integrations/gtm/capability-ledger.fixtures.js

@@ -0,0 +1,2 @@
+// @bun
+var m=(e)=>({state:"unsupported",reason:e}),i=(e)=>({state:"not-applicable",reason:e});function h(e,t,a,r={}){return{upstreamCapabilityId:e,granularity:"endpoint",implementationState:"implemented",availability:r.availability??"public",stability:r.stability??a.stability,surfaces:{api:{state:"supported"},localMcp:{state:"supported"},hostedMcp:i("Tracked separately as an external catalog"),inboundWebhook:i("This unit is an API endpoint"),outboundWebhook:i("This unit is an API endpoint")},contract:{operationKeys:[t],eventKeys:[]},auth:{methods:["provider-credential"],scopes:[]},effects:r.effects??["read"],evidence:a,testIds:[`coverage:${e}`]}}function s(e,t,a,r){return{upstreamCapabilityId:e,granularity:"webhook-event",implementationState:"implemented",availability:"public",stability:a.stability,surfaces:{api:m("Webhook delivery is raw ingress"),localMcp:m("Raw webhook ingress is never projected to MCP"),hostedMcp:i("Webhook delivery is not a hosted MCP tool"),inboundWebhook:{state:"supported"},outboundWebhook:i("This unit is inbound delivery")},contract:{operationKeys:r?[r]:[],eventKeys:typeof t==="string"?[t]:[...t]},auth:{methods:["webhook-policy"],scopes:[]},effects:["external-side-effect"],evidence:a,testIds:[`coverage:${e}`]}}function f(e,t,a){return{upstreamCapabilityId:e,granularity:"endpoint",implementationState:"implemented",availability:"public",stability:a.stability,surfaces:{api:{state:"supported"},localMcp:{state:"supported"},hostedMcp:i("Outbound delivery is not hosted MCP"),inboundWebhook:i("This unit sends outbound delivery"),outboundWebhook:{state:"supported"}},contract:{operationKeys:[t],eventKeys:[]},auth:{methods:["configured-shared-token"],scopes:[]},effects:["external-side-effect","write"],evidence:a,testIds:[`coverage:${e}`]}}function l(e,t){return{upstreamCapabilityId:e,granularity:"hosted-mcp-category",implementationState:"not-applicable",availability:"account-gated",stability:t.stability,surfaces:{api:i("Vendor-hosted catalog is an external session"),localMcp:i("Local MCP projects ContractSpec operations"),hostedMcp:{state:"discovered-at-connect"},inboundWebhook:i("Hosted MCP category is not webhook ingress"),outboundWebhook:i("Hosted MCP category is not a webhook target")},contract:{operationKeys:[],eventKeys:[]},auth:{methods:["oauth2"],scopes:[]},effects:[],evidence:t,testIds:[`hosted-mcp:${e}`]}}var k=["crm.attio.objects.list","crm.attio.objects.get","crm.attio.attributes.list","crm.attio.attributes.get","crm.attio.attributes.create","crm.attio.attributes.update","crm.attio.options.list","crm.attio.options.create","crm.attio.options.update","crm.attio.options.delete","crm.attio.statuses.list","crm.attio.statuses.create","crm.attio.statuses.update","crm.attio.records.query","crm.attio.records.get","crm.attio.records.create","crm.attio.records.update","crm.attio.records.delete","crm.attio.records.assert","crm.attio.lists.list","crm.attio.lists.get","crm.attio.lists.create","crm.attio.lists.update","crm.attio.entries.query","crm.attio.entries.get","crm.attio.entries.create","crm.attio.entries.update","crm.attio.entries.delete","crm.attio.entries.assert","crm.attio.workspace-members.list","crm.attio.workspace-members.get","crm.attio.notes.list","crm.attio.notes.get","crm.attio.notes.create","crm.attio.notes.delete","crm.attio.tasks.list","crm.attio.tasks.get","crm.attio.tasks.create","crm.attio.tasks.update","crm.attio.tasks.delete","crm.attio.threads.list","crm.attio.threads.get","crm.attio.comments.create","crm.attio.comments.delete","crm.attio.meetings.list","crm.attio.meetings.get","crm.attio.call-recordings.get","crm.attio.transcripts.get","crm.attio.files.get","crm.attio.webhooks.list","crm.attio.webhooks.get","crm.attio.webhooks.create","crm.attio.webhooks.update","crm.attio.webhooks.delete","crm.attio.meta.identify","crm.attio.mcp.remote.describe"],w=["call-recording.created","comment.created","comment.deleted","comment.resolved","comment.unresolved","list-attribute.created","list-attribute.updated","list-entry.created","list-entry.deleted","list-entry.updated","list.created","list.deleted","list.updated","note-content.updated","note.created","note.deleted","note.updated","object-attribute.created","object-attribute.updated","record.created","record.deleted","record.merged","record.updated","task.created","task.deleted","task.updated","workspace-member.created"];function C(e){if(/\.(list|get|query|identify|describe)$/.test(e))return["read"];return e.endsWith(".delete")?["write","destructive","external-side-effect"]:["write","external-side-effect"]}var n={provider:"attio",evidence:{sourceUrl:"https://docs.attio.com/llms.txt",retrievedAt:"2026-07-18",version:"attio-rest-index-2026-07-18",sha256:"f526902d1b562df168a04305fccab48f69cc55ce3637df2c7e9be6a659775477"},endpoints:k.map((e)=>({upstreamId:e.replace("crm.attio.","attio.rest."),contractKey:e,sourceUrl:"https://docs.attio.com/rest-api/endpoint-reference",stability:"stable",availability:"public",effects:C(e)})),scopes:["record_permission:read","record_permission:read-write","object_configuration:read","object_configuration:read-write","webhook:read-write"],events:w.map((e)=>({upstreamId:`attio.webhook.${e}`,eventKey:`gtm.attio.webhook.${e}`,sourceUrl:"https://docs.attio.com/rest-api/webhook-reference"}))};var I=["sales-intelligence.clay.identity.get","sales-intelligence.clay.searches.create","sales-intelligence.clay.searches.get","sales-intelligence.clay.searches.results.list","sales-intelligence.clay.routines.list","sales-intelligence.clay.routines.get","sales-intelligence.clay.routines.execute","sales-intelligence.clay.runs.get","sales-intelligence.clay.tables.list","sales-intelligence.clay.tables.get","sales-intelligence.clay.tables.records.list","sales-intelligence.clay.workflows.list","sales-intelligence.clay.workflows.get","sales-intelligence.clay.workflows.execute","sales-intelligence.clay.webhook-table.trigger","sales-intelligence.clay.mcp.remote.describe"],c={provider:"clay",evidence:{sourceUrl:"https://developers.clay.com/llms.txt",retrievedAt:"2026-07-18",version:"clay-developer-platform-open-beta",sha256:"2cbad9d8e99517f5499185435298b57d9f0e18de0a168460d7ced7fbab592896"},endpoints:I.map((e)=>({upstreamId:e.replace("sales-intelligence.clay.","clay.developer."),contractKey:e,sourceUrl:e.includes(".workflows.")?"https://developers.clay.com/recipes/build-workflow-alpha":"https://developers.clay.com/api-reference",stability:e.includes(".workflows.")?"alpha":"beta",availability:e.includes(".tables.")?"plan-gated":"public",effects:/\.(create|execute|trigger)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"clay.webhook.routine-run.finished",eventKey:"sales-intelligence.clay.callback.received",sourceUrl:"https://developers.clay.com/public-api/webhooks"}]};var x=["sales-intelligence.fullenrich.credits.get","sales-intelligence.fullenrich.api-key.validate","sales-intelligence.fullenrich.people.search","sales-intelligence.fullenrich.companies.search","sales-intelligence.fullenrich.people.lookup","sales-intelligence.fullenrich.companies.lookup","sales-intelligence.fullenrich.contact.enrichment.start","sales-intelligence.fullenrich.contact.enrichment.result.get","sales-intelligence.fullenrich.contact.enrichment.cancel","sales-intelligence.fullenrich.reverse-email.start","sales-intelligence.fullenrich.reverse-email.result.get","sales-intelligence.fullenrich.webhook.enrichment.received","sales-intelligence.fullenrich.mcp.remote.describe"],d={provider:"fullenrich",evidence:{sourceUrl:"https://docs.fullenrich.com/llms.txt",retrievedAt:"2026-07-18",version:"fullenrich-api-v2",sha256:"b853575683a1f8338527564a0ab4e46df4ae79f2c5a439cbe6fed9fb78d0e599"},endpoints:x.map((e)=>({upstreamId:e.replace("sales-intelligence.fullenrich.","fullenrich.v2."),contractKey:e,sourceUrl:"https://docs.fullenrich.com/api/v2/reference",stability:"stable",availability:"public",effects:/\.(start|lookup|cancel)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"fullenrich.webhook.batch-complete",eventKey:"sales-intelligence.fullenrich.webhook.batch-complete",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"},{upstreamId:"fullenrich.webhook.contact-finished",eventKey:"sales-intelligence.fullenrich.webhook.contact-finished",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"}]};function b(e,t){return{provider:e.provider,sourceUrl:e.evidence.sourceUrl,retrievedAt:e.evidence.retrievedAt,sha256:e.evidence.sha256,redistribution:"digest-only",stability:t}}var p=b(n,"stable"),o=b(c,"beta"),u=b(d,"stable"),P=[p,o,u];function y(e,t){return h(e.upstreamId,e.contractKey,t,{availability:e.availability,stability:e.stability,effects:e.effects})}var T=[...n.endpoints.map((e)=>y(e,p)),...n.events.map((e)=>s(e.upstreamId,e.eventKey,p)),l("attio.mcp.workspace",p)],g="sales-intelligence.clay.webhook-table.trigger",_=[...c.endpoints.filter((e)=>e.contractKey!==g).map((e)=>y(e,o)),f("clay.developer.webhook-table.trigger",g,o),...c.events.map((e)=>s(e.upstreamId,e.eventKey,o)),l("clay.mcp.workspace",o)],v="sales-intelligence.fullenrich.webhook.enrichment.received",q=[...d.endpoints.filter((e)=>e.contractKey!==v).map((e)=>y(e,u)),s("fullenrich.v2.webhook.enrichment.received",d.events.map((e)=>e.eventKey),u,v),l("fullenrich.mcp.enrichment",u)];export{T as attioCapabilityLedger,_ as clayCapabilityLedger,q as fullEnrichCapabilityLedger,P as gtmEvidenceManifests};

package/dist/integrations/gtm/capability-ledger.js

@@ -0,0 +1,2 @@
+// @bun
+var b=["endpoint","webhook-event","oauth-scope","hosted-mcp-tool","hosted-mcp-category"],y=["implemented","deferred","not-applicable"],w=["public","plan-gated","account-gated","vendor-unsupported"],m=["stable","beta","alpha","deprecated"],g=["supported","unsupported","discovered-at-connect","not-applicable"],u=["api","localMcp","hostedMcp","inboundWebhook","outboundWebhook"];function o(r,a,s){if(!a.includes(String(r)))throw Error(`${s} must be one of ${a.join(", ")}`)}function d(r,a){if(typeof r!=="string"||r.trim().length===0)throw Error(`${a} must be a non-empty string`)}function h(r,a){let s=`rows[${a}].evidence`;if(d(r.evidence?.sourceUrl,`${s}.sourceUrl`),new URL(r.evidence.sourceUrl).protocol!=="https:")throw Error(`${s}.sourceUrl must use HTTPS`);if(!/^[a-f0-9]{64}$/.test(r.evidence.sha256))throw Error(`${s}.sha256 must be a lowercase SHA-256 digest`);if(!/^\d{4}-\d{2}-\d{2}$/.test(r.evidence.retrievedAt))throw Error(`${s}.retrievedAt must be YYYY-MM-DD`)}function v(r,a={}){let s=new Set,p=new Set,l=new Set;for(let[i,c]of r.entries()){if(!c||typeof c!=="object")throw Error(`rows[${i}] must be an object`);let e=c;if(d(e.upstreamCapabilityId,`rows[${i}].upstreamCapabilityId`),s.has(e.upstreamCapabilityId))throw Error(`duplicate upstream capability ${e.upstreamCapabilityId}`);s.add(e.upstreamCapabilityId),o(e.granularity,b,`rows[${i}].granularity`),o(e.implementationState,y,`rows[${i}].implementationState`),o(e.availability,w,`rows[${i}].availability`),o(e.stability,m,`rows[${i}].stability`);for(let t of u){let n=e.surfaces?.[t];if(!n)throw Error(`rows[${i}].surfaces.${t} is required`);if(o(n.state,g,`rows[${i}].surfaces.${t}.state`),["unsupported","not-applicable"].includes(n.state)&&!n.reason)throw Error(`rows[${i}].surfaces.${t}.reason is required`)}if(h(e,i),!Array.isArray(e.testIds)||e.testIds.length===0)throw Error(`rows[${i}].testIds must not be empty`);if(e.availability==="vendor-unsupported"&&e.implementationState==="implemented")throw Error(`${e.upstreamCapabilityId} is vendor-unsupported`);let f=u.map((t)=>e.surfaces[t].state);if(e.implementationState==="implemented"&&!f.some((t)=>t==="supported"))throw Error(`${e.upstreamCapabilityId} has no supported surface`);if(e.surfaces.localMcp.state==="supported"&&e.contract.operationKeys.length===0)throw Error(`${e.upstreamCapabilityId} local MCP requires an operation`);if(e.surfaces.inboundWebhook.state==="supported"&&e.contract.eventKeys.length===0)throw Error(`${e.upstreamCapabilityId} inbound webhook requires an event`);if(a.release&&e.implementationState==="deferred"&&!e.waiverArtifact)throw Error(`${e.upstreamCapabilityId} is deferred without a waiver`);for(let t of e.contract.operationKeys){if(p.has(t))throw Error(`operation ${t} maps to multiple capability units`);p.add(t)}for(let t of e.contract.eventKeys){if(l.has(t))throw Error(`event ${t} maps to multiple capability units`);l.add(t)}}}function S(r,a){if(r.sha256!==a)throw Error(`${r.provider} capability evidence drift requires evidence review`)}export{v as assertCapabilityLedger,S as assertPinnedEvidenceDigest,w as capabilityAvailabilities,b as capabilityGranularities,m as capabilityStabilities,u as capabilitySurfaceNames,y as implementationStates,g as surfaceSupportStates};

package/dist/integrations/gtm/capability-ledger.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/gtm/hosted-mcp.d.ts

@@ -0,0 +1,12 @@
+export interface VendorHostedMcpDescriptor {
+    ownership: 'vendor-hosted';
+    execution: 'external-session';
+    proxyability: 'never';
+    endpoint: string;
+    discovery: 'static-endpoint' | 'oauth-protected';
+    accountDependentCatalog: boolean;
+    knownCategories: readonly string[];
+    confirmationAuthority: 'vendor-client';
+    tokenHandling: 'client-held';
+}
+export declare function defineVendorHostedMcp(descriptor: VendorHostedMcpDescriptor): VendorHostedMcpDescriptor;

package/dist/integrations/gtm/hosted-mcp.js

@@ -0,0 +1,2 @@
+// @bun
+function o(e){return Object.freeze({...e})}export{o as defineVendorHostedMcp};

package/dist/integrations/gtm/index.d.ts

@@ -0,0 +1,5 @@
+export * from './capability-ledger.js';
+export * from './hosted-mcp.js';
+export * from './preflight.js';
+export * from './schemas.js';
+export * from './webhook-ingress.js';

package/dist/integrations/gtm/index.js

@@ -0,0 +1,2 @@
+// @bun
+var w=["endpoint","webhook-event","oauth-scope","hosted-mcp-tool","hosted-mcp-category"],g=["implemented","deferred","not-applicable"],h=["public","plan-gated","account-gated","vendor-unsupported"],v=["stable","beta","alpha","deprecated"],O=["supported","unsupported","discovered-at-connect","not-applicable"],m=["api","localMcp","hostedMcp","inboundWebhook","outboundWebhook"];function c(e,i,r){if(!i.includes(String(e)))throw Error(`${r} must be one of ${i.join(", ")}`)}function b(e,i){if(typeof e!=="string"||e.trim().length===0)throw Error(`${i} must be a non-empty string`)}function x(e,i){let r=`rows[${i}].evidence`;if(b(e.evidence?.sourceUrl,`${r}.sourceUrl`),new URL(e.evidence.sourceUrl).protocol!=="https:")throw Error(`${r}.sourceUrl must use HTTPS`);if(!/^[a-f0-9]{64}$/.test(e.evidence.sha256))throw Error(`${r}.sha256 must be a lowercase SHA-256 digest`);if(!/^\d{4}-\d{2}-\d{2}$/.test(e.evidence.retrievedAt))throw Error(`${r}.retrievedAt must be YYYY-MM-DD`)}function C(e,i={}){let r=new Set,l=new Set,d=new Set;for(let[n,f]of e.entries()){if(!f||typeof f!=="object")throw Error(`rows[${n}] must be an object`);let a=f;if(b(a.upstreamCapabilityId,`rows[${n}].upstreamCapabilityId`),r.has(a.upstreamCapabilityId))throw Error(`duplicate upstream capability ${a.upstreamCapabilityId}`);r.add(a.upstreamCapabilityId),c(a.granularity,w,`rows[${n}].granularity`),c(a.implementationState,g,`rows[${n}].implementationState`),c(a.availability,h,`rows[${n}].availability`),c(a.stability,v,`rows[${n}].stability`);for(let o of m){let u=a.surfaces?.[o];if(!u)throw Error(`rows[${n}].surfaces.${o} is required`);if(c(u.state,O,`rows[${n}].surfaces.${o}.state`),["unsupported","not-applicable"].includes(u.state)&&!u.reason)throw Error(`rows[${n}].surfaces.${o}.reason is required`)}if(x(a,n),!Array.isArray(a.testIds)||a.testIds.length===0)throw Error(`rows[${n}].testIds must not be empty`);if(a.availability==="vendor-unsupported"&&a.implementationState==="implemented")throw Error(`${a.upstreamCapabilityId} is vendor-unsupported`);let I=m.map((o)=>a.surfaces[o].state);if(a.implementationState==="implemented"&&!I.some((o)=>o==="supported"))throw Error(`${a.upstreamCapabilityId} has no supported surface`);if(a.surfaces.localMcp.state==="supported"&&a.contract.operationKeys.length===0)throw Error(`${a.upstreamCapabilityId} local MCP requires an operation`);if(a.surfaces.inboundWebhook.state==="supported"&&a.contract.eventKeys.length===0)throw Error(`${a.upstreamCapabilityId} inbound webhook requires an event`);if(i.release&&a.implementationState==="deferred"&&!a.waiverArtifact)throw Error(`${a.upstreamCapabilityId} is deferred without a waiver`);for(let o of a.contract.operationKeys){if(l.has(o))throw Error(`operation ${o} maps to multiple capability units`);l.add(o)}for(let o of a.contract.eventKeys){if(d.has(o))throw Error(`event ${o} maps to multiple capability units`);d.add(o)}}}function S(e,i){if(e.sha256!==i)throw Error(`${e.provider} capability evidence drift requires evidence review`)}function k(e){return Object.freeze({...e})}function R(e){let i=[],{row:r}=e,l=r.effects.some((n)=>["write","destructive","cost-bearing","external-side-effect"].includes(n));if(r.implementationState!=="implemented")i.push(`implementation:${r.implementationState}`);if(!e.connectionReady)i.push("connection:not-ready");if(r.availability==="plan-gated"&&!e.entitlements.includes(r.upstreamCapabilityId))i.push("entitlement:missing");if(r.availability==="account-gated")i.push("availability:discover-at-connect");if(r.availability==="vendor-unsupported")i.push("availability:vendor-unsupported");if(r.stability==="beta"&&!e.allowBeta)i.push("stability:beta-opt-in-required");if(r.stability==="alpha"&&!e.allowAlpha)i.push("stability:alpha-opt-in-required");let d=r.auth.scopes.filter((n)=>!e.grantedScopes.includes(n));if(d.length>0)i.push(`scopes:missing:${d.join(",")}`);if(r.surfaces[e.surface].state!=="supported")i.push(`surface:${r.surfaces[e.surface].state}`);if((e.surface==="inboundWebhook"||e.surface==="outboundWebhook")&&!e.webhookConfigured)i.push("webhook:not-configured");if(l&&!e.approvalAvailable)i.push("approval:required");return{ready:i.length===0,operationKeys:r.contract.operationKeys,eventKeys:r.contract.eventKeys,blockers:i,requiresApproval:l}}import{ScalarTypeEnum as y,SchemaModel as s}from"@lssm/lib.schema";var p=y.JSONObject(),t=y.NonEmptyString(),K=new s({name:"GtmConnectionInput",fields:{connectionId:{type:t,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),M=new s({name:"GtmResourceInput",fields:{connectionId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!0},parentId:{type:t,isOptional:!0},cursor:{type:t,isOptional:!0},payload:{type:p,isOptional:!0},filters:{type:p,isOptional:!0},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),q=new s({name:"GtmCollectionInput",fields:{connectionId:{type:t,isOptional:!1},cursor:{type:t,isOptional:!0},filters:{type:p,isOptional:!0},correlationId:{type:t,isOptional:!0}}}),U=new s({name:"GtmResourceIdInput",fields:{connectionId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),D=new s({name:"GtmNestedResourceIdInput",fields:{connectionId:{type:t,isOptional:!1},parentId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),N=new s({name:"GtmCreateInput",fields:{connectionId:{type:t,isOptional:!1},payload:{type:p,isOptional:!1},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),P=new s({name:"GtmNestedCreateInput",fields:{connectionId:{type:t,isOptional:!1},parentId:{type:t,isOptional:!1},payload:{type:p,isOptional:!1},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),B=new s({name:"GtmUpdateInput",fields:{connectionId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!1},payload:{type:p,isOptional:!1},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),V=new s({name:"GtmNestedUpdateInput",fields:{connectionId:{type:t,isOptional:!1},parentId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!1},payload:{type:p,isOptional:!1},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),H=new s({name:"GtmAttributeChildInput",fields:{connectionId:{type:t,isOptional:!1},parentId:{type:t,isOptional:!1},resourceId:{type:t,isOptional:!1},childId:{type:t,isOptional:!0},payload:{type:p,isOptional:!0},correlationId:{type:t,isOptional:!0}}}),L=new s({name:"GtmNestedQueryInput",fields:{connectionId:{type:t,isOptional:!1},parentId:{type:t,isOptional:!1},cursor:{type:t,isOptional:!0},filters:{type:p,isOptional:!0},correlationId:{type:t,isOptional:!0}}}),j=new s({name:"GtmResourceOutput",fields:{data:{type:p,isOptional:!1},nextCursor:{type:t,isOptional:!0},requestId:{type:t,isOptional:!0}}}),T=new s({name:"GtmWebhookInput",fields:{connectionId:{type:t,isOptional:!1},deliveryId:{type:t,isOptional:!0},headers:{type:p,isOptional:!1},payload:{type:p,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),Y=new s({name:"GtmWebhookReceiptOutput",fields:{accepted:{type:y.Boolean(),isOptional:!1},duplicate:{type:y.Boolean(),isOptional:!1},receiptId:{type:t,isOptional:!1},verificationStatus:{type:t,isOptional:!1}}}),z=new s({name:"HostedMcpDescriptorOutput",fields:{descriptor:{type:p,isOptional:!1}}});async function J(e){if(e.rawBody.byteLength>e.maxBytes)return await e.store.quarantine(e.deliveryId,"payload-too-large"),{accepted:!1,duplicate:!1};if(!e.verify(e.rawBody))return await e.store.quarantine(e.deliveryId,"verification-failed"),{accepted:!1,duplicate:!1};let i=await e.store.claim(e.deliveryId,e.leaseMs??30000);if(!i.claimed||!i.leaseId)return{accepted:!0,duplicate:i.duplicate??!0};try{let r=e.normalize(e.rawBody,e.deliveryId),l=await e.handoff.persist({provider:e.provider,deliveryId:e.deliveryId,events:r,receivedAt:(e.now??(()=>new Date))().toISOString()});return await e.store.complete(e.deliveryId,i.leaseId),{accepted:!0,duplicate:!1,handoffReceiptId:l}}catch(r){let l=r instanceof Error?r.name:"unknown";throw await e.store.release(e.deliveryId,i.leaseId,l),r}}export{H as GtmAttributeChildInput,q as GtmCollectionInput,K as GtmConnectionInput,N as GtmCreateInput,P as GtmNestedCreateInput,L as GtmNestedQueryInput,D as GtmNestedResourceIdInput,V as GtmNestedUpdateInput,U as GtmResourceIdInput,M as GtmResourceInput,j as GtmResourceOutput,B as GtmUpdateInput,T as GtmWebhookInput,Y as GtmWebhookReceiptOutput,z as HostedMcpDescriptorOutput,J as acceptWebhookIngress,C as assertCapabilityLedger,S as assertPinnedEvidenceDigest,h as capabilityAvailabilities,w as capabilityGranularities,v as capabilityStabilities,m as capabilitySurfaceNames,k as defineVendorHostedMcp,g as implementationStates,R as preflightGtmCapability,O as surfaceSupportStates};

package/dist/integrations/gtm/inventory/attio.d.ts

@@ -0,0 +1,2 @@
+import type { VendorCapabilityInventory } from './types.js';
+export declare const attioAuthoritativeInventory: VendorCapabilityInventory;

package/dist/integrations/gtm/inventory/attio.js

@@ -0,0 +1,2 @@
+// @bun
+var e=["crm.attio.objects.list","crm.attio.objects.get","crm.attio.attributes.list","crm.attio.attributes.get","crm.attio.attributes.create","crm.attio.attributes.update","crm.attio.options.list","crm.attio.options.create","crm.attio.options.update","crm.attio.options.delete","crm.attio.statuses.list","crm.attio.statuses.create","crm.attio.statuses.update","crm.attio.records.query","crm.attio.records.get","crm.attio.records.create","crm.attio.records.update","crm.attio.records.delete","crm.attio.records.assert","crm.attio.lists.list","crm.attio.lists.get","crm.attio.lists.create","crm.attio.lists.update","crm.attio.entries.query","crm.attio.entries.get","crm.attio.entries.create","crm.attio.entries.update","crm.attio.entries.delete","crm.attio.entries.assert","crm.attio.workspace-members.list","crm.attio.workspace-members.get","crm.attio.notes.list","crm.attio.notes.get","crm.attio.notes.create","crm.attio.notes.delete","crm.attio.tasks.list","crm.attio.tasks.get","crm.attio.tasks.create","crm.attio.tasks.update","crm.attio.tasks.delete","crm.attio.threads.list","crm.attio.threads.get","crm.attio.comments.create","crm.attio.comments.delete","crm.attio.meetings.list","crm.attio.meetings.get","crm.attio.call-recordings.get","crm.attio.transcripts.get","crm.attio.files.get","crm.attio.webhooks.list","crm.attio.webhooks.get","crm.attio.webhooks.create","crm.attio.webhooks.update","crm.attio.webhooks.delete","crm.attio.meta.identify","crm.attio.mcp.remote.describe"],r=["call-recording.created","comment.created","comment.deleted","comment.resolved","comment.unresolved","list-attribute.created","list-attribute.updated","list-entry.created","list-entry.deleted","list-entry.updated","list.created","list.deleted","list.updated","note-content.updated","note.created","note.deleted","note.updated","object-attribute.created","object-attribute.updated","record.created","record.deleted","record.merged","record.updated","task.created","task.deleted","task.updated","workspace-member.created"];function o(t){if(/\.(list|get|query|identify|describe)$/.test(t))return["read"];return t.endsWith(".delete")?["write","destructive","external-side-effect"]:["write","external-side-effect"]}var a={provider:"attio",evidence:{sourceUrl:"https://docs.attio.com/llms.txt",retrievedAt:"2026-07-18",version:"attio-rest-index-2026-07-18",sha256:"f526902d1b562df168a04305fccab48f69cc55ce3637df2c7e9be6a659775477"},endpoints:e.map((t)=>({upstreamId:t.replace("crm.attio.","attio.rest."),contractKey:t,sourceUrl:"https://docs.attio.com/rest-api/endpoint-reference",stability:"stable",availability:"public",effects:o(t)})),scopes:["record_permission:read","record_permission:read-write","object_configuration:read","object_configuration:read-write","webhook:read-write"],events:r.map((t)=>({upstreamId:`attio.webhook.${t}`,eventKey:`gtm.attio.webhook.${t}`,sourceUrl:"https://docs.attio.com/rest-api/webhook-reference"}))};export{a as attioAuthoritativeInventory};

package/dist/integrations/gtm/inventory/clay.d.ts

@@ -0,0 +1,2 @@
+import type { VendorCapabilityInventory } from './types.js';
+export declare const clayAuthoritativeInventory: VendorCapabilityInventory;

package/dist/integrations/gtm/inventory/clay.js

@@ -0,0 +1,2 @@
+// @bun
+var l=["sales-intelligence.clay.identity.get","sales-intelligence.clay.searches.create","sales-intelligence.clay.searches.get","sales-intelligence.clay.searches.results.list","sales-intelligence.clay.routines.list","sales-intelligence.clay.routines.get","sales-intelligence.clay.routines.execute","sales-intelligence.clay.runs.get","sales-intelligence.clay.tables.list","sales-intelligence.clay.tables.get","sales-intelligence.clay.tables.records.list","sales-intelligence.clay.workflows.list","sales-intelligence.clay.workflows.get","sales-intelligence.clay.workflows.execute","sales-intelligence.clay.webhook-table.trigger","sales-intelligence.clay.mcp.remote.describe"],s={provider:"clay",evidence:{sourceUrl:"https://developers.clay.com/llms.txt",retrievedAt:"2026-07-18",version:"clay-developer-platform-open-beta",sha256:"2cbad9d8e99517f5499185435298b57d9f0e18de0a168460d7ced7fbab592896"},endpoints:l.map((e)=>({upstreamId:e.replace("sales-intelligence.clay.","clay.developer."),contractKey:e,sourceUrl:e.includes(".workflows.")?"https://developers.clay.com/recipes/build-workflow-alpha":"https://developers.clay.com/api-reference",stability:e.includes(".workflows.")?"alpha":"beta",availability:e.includes(".tables.")?"plan-gated":"public",effects:/\.(create|execute|trigger)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"clay.webhook.routine-run.finished",eventKey:"sales-intelligence.clay.callback.received",sourceUrl:"https://developers.clay.com/public-api/webhooks"}]};export{s as clayAuthoritativeInventory};

package/dist/integrations/gtm/inventory/fullenrich.d.ts

@@ -0,0 +1,2 @@
+import type { VendorCapabilityInventory } from './types.js';
+export declare const fullEnrichAuthoritativeInventory: VendorCapabilityInventory;

package/dist/integrations/gtm/inventory/fullenrich.js

@@ -0,0 +1,2 @@
+// @bun
+var l=["sales-intelligence.fullenrich.credits.get","sales-intelligence.fullenrich.api-key.validate","sales-intelligence.fullenrich.people.search","sales-intelligence.fullenrich.companies.search","sales-intelligence.fullenrich.people.lookup","sales-intelligence.fullenrich.companies.lookup","sales-intelligence.fullenrich.contact.enrichment.start","sales-intelligence.fullenrich.contact.enrichment.result.get","sales-intelligence.fullenrich.contact.enrichment.cancel","sales-intelligence.fullenrich.reverse-email.start","sales-intelligence.fullenrich.reverse-email.result.get","sales-intelligence.fullenrich.webhook.enrichment.received","sales-intelligence.fullenrich.mcp.remote.describe"],i={provider:"fullenrich",evidence:{sourceUrl:"https://docs.fullenrich.com/llms.txt",retrievedAt:"2026-07-18",version:"fullenrich-api-v2",sha256:"b853575683a1f8338527564a0ab4e46df4ae79f2c5a439cbe6fed9fb78d0e599"},endpoints:l.map((e)=>({upstreamId:e.replace("sales-intelligence.fullenrich.","fullenrich.v2."),contractKey:e,sourceUrl:"https://docs.fullenrich.com/api/v2/reference",stability:"stable",availability:"public",effects:/\.(start|lookup|cancel)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"fullenrich.webhook.batch-complete",eventKey:"sales-intelligence.fullenrich.webhook.batch-complete",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"},{upstreamId:"fullenrich.webhook.contact-finished",eventKey:"sales-intelligence.fullenrich.webhook.contact-finished",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"}]};export{i as fullEnrichAuthoritativeInventory};

package/dist/integrations/gtm/inventory/index.d.ts

@@ -0,0 +1,4 @@
+export * from './attio.js';
+export * from './clay.js';
+export * from './fullenrich.js';
+export * from './types.js';

package/dist/integrations/gtm/inventory/index.js

@@ -0,0 +1,2 @@
+// @bun
+var t=["crm.attio.objects.list","crm.attio.objects.get","crm.attio.attributes.list","crm.attio.attributes.get","crm.attio.attributes.create","crm.attio.attributes.update","crm.attio.options.list","crm.attio.options.create","crm.attio.options.update","crm.attio.options.delete","crm.attio.statuses.list","crm.attio.statuses.create","crm.attio.statuses.update","crm.attio.records.query","crm.attio.records.get","crm.attio.records.create","crm.attio.records.update","crm.attio.records.delete","crm.attio.records.assert","crm.attio.lists.list","crm.attio.lists.get","crm.attio.lists.create","crm.attio.lists.update","crm.attio.entries.query","crm.attio.entries.get","crm.attio.entries.create","crm.attio.entries.update","crm.attio.entries.delete","crm.attio.entries.assert","crm.attio.workspace-members.list","crm.attio.workspace-members.get","crm.attio.notes.list","crm.attio.notes.get","crm.attio.notes.create","crm.attio.notes.delete","crm.attio.tasks.list","crm.attio.tasks.get","crm.attio.tasks.create","crm.attio.tasks.update","crm.attio.tasks.delete","crm.attio.threads.list","crm.attio.threads.get","crm.attio.comments.create","crm.attio.comments.delete","crm.attio.meetings.list","crm.attio.meetings.get","crm.attio.call-recordings.get","crm.attio.transcripts.get","crm.attio.files.get","crm.attio.webhooks.list","crm.attio.webhooks.get","crm.attio.webhooks.create","crm.attio.webhooks.update","crm.attio.webhooks.delete","crm.attio.meta.identify","crm.attio.mcp.remote.describe"],r=["call-recording.created","comment.created","comment.deleted","comment.resolved","comment.unresolved","list-attribute.created","list-attribute.updated","list-entry.created","list-entry.deleted","list-entry.updated","list.created","list.deleted","list.updated","note-content.updated","note.created","note.deleted","note.updated","object-attribute.created","object-attribute.updated","record.created","record.deleted","record.merged","record.updated","task.created","task.deleted","task.updated","workspace-member.created"];function i(e){if(/\.(list|get|query|identify|describe)$/.test(e))return["read"];return e.endsWith(".delete")?["write","destructive","external-side-effect"]:["write","external-side-effect"]}var l={provider:"attio",evidence:{sourceUrl:"https://docs.attio.com/llms.txt",retrievedAt:"2026-07-18",version:"attio-rest-index-2026-07-18",sha256:"f526902d1b562df168a04305fccab48f69cc55ce3637df2c7e9be6a659775477"},endpoints:t.map((e)=>({upstreamId:e.replace("crm.attio.","attio.rest."),contractKey:e,sourceUrl:"https://docs.attio.com/rest-api/endpoint-reference",stability:"stable",availability:"public",effects:i(e)})),scopes:["record_permission:read","record_permission:read-write","object_configuration:read","object_configuration:read-write","webhook:read-write"],events:r.map((e)=>({upstreamId:`attio.webhook.${e}`,eventKey:`gtm.attio.webhook.${e}`,sourceUrl:"https://docs.attio.com/rest-api/webhook-reference"}))};var s=["sales-intelligence.clay.identity.get","sales-intelligence.clay.searches.create","sales-intelligence.clay.searches.get","sales-intelligence.clay.searches.results.list","sales-intelligence.clay.routines.list","sales-intelligence.clay.routines.get","sales-intelligence.clay.routines.execute","sales-intelligence.clay.runs.get","sales-intelligence.clay.tables.list","sales-intelligence.clay.tables.get","sales-intelligence.clay.tables.records.list","sales-intelligence.clay.workflows.list","sales-intelligence.clay.workflows.get","sales-intelligence.clay.workflows.execute","sales-intelligence.clay.webhook-table.trigger","sales-intelligence.clay.mcp.remote.describe"],o={provider:"clay",evidence:{sourceUrl:"https://developers.clay.com/llms.txt",retrievedAt:"2026-07-18",version:"clay-developer-platform-open-beta",sha256:"2cbad9d8e99517f5499185435298b57d9f0e18de0a168460d7ced7fbab592896"},endpoints:s.map((e)=>({upstreamId:e.replace("sales-intelligence.clay.","clay.developer."),contractKey:e,sourceUrl:e.includes(".workflows.")?"https://developers.clay.com/recipes/build-workflow-alpha":"https://developers.clay.com/api-reference",stability:e.includes(".workflows.")?"alpha":"beta",availability:e.includes(".tables.")?"plan-gated":"public",effects:/\.(create|execute|trigger)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"clay.webhook.routine-run.finished",eventKey:"sales-intelligence.clay.callback.received",sourceUrl:"https://developers.clay.com/public-api/webhooks"}]};var a=["sales-intelligence.fullenrich.credits.get","sales-intelligence.fullenrich.api-key.validate","sales-intelligence.fullenrich.people.search","sales-intelligence.fullenrich.companies.search","sales-intelligence.fullenrich.people.lookup","sales-intelligence.fullenrich.companies.lookup","sales-intelligence.fullenrich.contact.enrichment.start","sales-intelligence.fullenrich.contact.enrichment.result.get","sales-intelligence.fullenrich.contact.enrichment.cancel","sales-intelligence.fullenrich.reverse-email.start","sales-intelligence.fullenrich.reverse-email.result.get","sales-intelligence.fullenrich.webhook.enrichment.received","sales-intelligence.fullenrich.mcp.remote.describe"],d={provider:"fullenrich",evidence:{sourceUrl:"https://docs.fullenrich.com/llms.txt",retrievedAt:"2026-07-18",version:"fullenrich-api-v2",sha256:"b853575683a1f8338527564a0ab4e46df4ae79f2c5a439cbe6fed9fb78d0e599"},endpoints:a.map((e)=>({upstreamId:e.replace("sales-intelligence.fullenrich.","fullenrich.v2."),contractKey:e,sourceUrl:"https://docs.fullenrich.com/api/v2/reference",stability:"stable",availability:"public",effects:/\.(start|lookup|cancel)$/.test(e)?["write","cost-bearing","external-side-effect"]:["read"]})),scopes:[],events:[{upstreamId:"fullenrich.webhook.batch-complete",eventKey:"sales-intelligence.fullenrich.webhook.batch-complete",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"},{upstreamId:"fullenrich.webhook.contact-finished",eventKey:"sales-intelligence.fullenrich.webhook.contact-finished",sourceUrl:"https://docs.fullenrich.com/api/v2/general/webhooks"}]};export{l as attioAuthoritativeInventory,o as clayAuthoritativeInventory,d as fullEnrichAuthoritativeInventory};

package/dist/integrations/gtm/inventory/inventory.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/gtm/inventory/types.d.ts

@@ -0,0 +1,26 @@
+export interface VendorInventoryEvidence {
+    sourceUrl: string;
+    retrievedAt: string;
+    version: string;
+    sha256: string;
+}
+export interface VendorEndpointInventoryItem {
+    upstreamId: string;
+    contractKey: string;
+    sourceUrl: string;
+    stability: 'stable' | 'beta' | 'alpha';
+    availability: 'public' | 'plan-gated' | 'account-gated';
+    effects: string[];
+}
+export interface VendorEventInventoryItem {
+    upstreamId: string;
+    eventKey: string;
+    sourceUrl: string;
+}
+export interface VendorCapabilityInventory {
+    provider: 'attio' | 'clay' | 'fullenrich';
+    evidence: VendorInventoryEvidence;
+    endpoints: readonly VendorEndpointInventoryItem[];
+    scopes: readonly string[];
+    events: readonly VendorEventInventoryItem[];
+}

package/dist/integrations/gtm/inventory/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/integrations/gtm/preflight.d.ts

@@ -0,0 +1,20 @@
+import type { CapabilityLedgerRow } from './capability-ledger.js';
+export interface CapabilityPreflightInput {
+    row: CapabilityLedgerRow;
+    connectionReady: boolean;
+    grantedScopes: readonly string[];
+    entitlements: readonly string[];
+    allowBeta?: boolean;
+    allowAlpha?: boolean;
+    approvalAvailable?: boolean;
+    webhookConfigured?: boolean;
+    surface: keyof CapabilityLedgerRow['surfaces'];
+}
+export interface CapabilityPreflightResult {
+    ready: boolean;
+    operationKeys: readonly string[];
+    eventKeys: readonly string[];
+    blockers: readonly string[];
+    requiresApproval: boolean;
+}
+export declare function preflightGtmCapability(input: CapabilityPreflightInput): CapabilityPreflightResult;

package/dist/integrations/gtm/preflight.js

@@ -0,0 +1,2 @@
+// @bun
+function r(t){let a=[],{row:e}=t,o=e.effects.some((i)=>["write","destructive","cost-bearing","external-side-effect"].includes(i));if(e.implementationState!=="implemented")a.push(`implementation:${e.implementationState}`);if(!t.connectionReady)a.push("connection:not-ready");if(e.availability==="plan-gated"&&!t.entitlements.includes(e.upstreamCapabilityId))a.push("entitlement:missing");if(e.availability==="account-gated")a.push("availability:discover-at-connect");if(e.availability==="vendor-unsupported")a.push("availability:vendor-unsupported");if(e.stability==="beta"&&!t.allowBeta)a.push("stability:beta-opt-in-required");if(e.stability==="alpha"&&!t.allowAlpha)a.push("stability:alpha-opt-in-required");let l=e.auth.scopes.filter((i)=>!t.grantedScopes.includes(i));if(l.length>0)a.push(`scopes:missing:${l.join(",")}`);if(e.surfaces[t.surface].state!=="supported")a.push(`surface:${e.surfaces[t.surface].state}`);if((t.surface==="inboundWebhook"||t.surface==="outboundWebhook")&&!t.webhookConfigured)a.push("webhook:not-configured");if(o&&!t.approvalAvailable)a.push("approval:required");return{ready:a.length===0,operationKeys:e.contract.operationKeys,eventKeys:e.contract.eventKeys,blockers:a,requiresApproval:o}}export{r as preflightGtmCapability};

package/dist/integrations/gtm/preflight.test.d.ts

@@ -0,0 +1 @@
+export {};