@tangle-network/agent-integrations 0.25.2 → 0.25.3

package/dist/registry.d.ts

@@ -0,0 +1,1982 @@
+import { C as ConnectorAdapter, R as ResolvedDataSource, a as ConnectorCredentials } from './index-BNb1A0Id.js';
+import './connectors/index.js';
+import { Server, IncomingMessage, ServerResponse } from 'node:http';
+
+type IntegrationSupportTier = 'catalogOnly' | 'setupReady' | 'gatewayExecutable' | 'firstPartyExecutable' | 'sandboxExecutable';
+interface IntegrationCatalogSource {
+    id: string;
+    connectors: IntegrationConnector[];
+    precedence?: number;
+}
+interface IntegrationRegistrySourceRef {
+    sourceId: string;
+    providerId: string;
+    connectorId: string;
+    supportTier: IntegrationSupportTier;
+    actionCount: number;
+    triggerCount: number;
+}
+interface IntegrationRegistryConflict {
+    field: 'auth' | 'category';
+    values: Array<{
+        value: string;
+        sourceId: string;
+        connectorId: string;
+    }>;
+}
+interface IntegrationRegistryEntry {
+    canonicalId: string;
+    connector: IntegrationConnector;
+    aliases: string[];
+    supportTier: IntegrationSupportTier;
+    sources: IntegrationRegistrySourceRef[];
+    conflicts: IntegrationRegistryConflict[];
+}
+interface IntegrationRegistry {
+    entries: IntegrationRegistryEntry[];
+    connectors: IntegrationConnector[];
+    byId: Map<string, IntegrationRegistryEntry>;
+}
+interface IntegrationRegistrySummary {
+    totalEntries: number;
+    totalSources: number;
+    toolBindableEntries: number;
+    conflictEntries: number;
+    bySupportTier: Record<IntegrationSupportTier, number>;
+}
+interface ComposeIntegrationRegistryOptions {
+    aliases?: Record<string, string>;
+    sourcePrecedence?: Record<string, number>;
+}
+declare function buildDefaultIntegrationRegistry(options?: {
+    includeSpecs?: boolean;
+    includeTangleCatalog?: boolean;
+    tangleCatalogRuntimeExecutable?: boolean;
+    /** @deprecated Use includeTangleCatalog. */
+    includeActivepieces?: boolean;
+}): IntegrationRegistry;
+declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
+declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
+declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
+declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
+
+type IntegrationAuditEventType = 'connection.created' | 'connection.updated' | 'connection.revoked' | 'grant.created' | 'grant.revoked' | 'capability.issued' | 'action.invoked' | 'action.failed' | 'trigger.subscribed' | 'trigger.received' | 'workflow.installed' | 'approval.requested' | 'approval.resolved' | 'healthcheck.completed';
+interface IntegrationAuditEvent {
+    id: string;
+    type: IntegrationAuditEventType;
+    occurredAt: string;
+    actor?: IntegrationActor;
+    connectionId?: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    risk?: IntegrationConnectorAction['risk'];
+    dataClass?: IntegrationDataClass;
+    ok?: boolean;
+    message?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationAuditSink {
+    record(event: IntegrationAuditEvent): Promise<void> | void;
+}
+interface IntegrationAuditStore extends IntegrationAuditSink {
+    list(filter?: IntegrationAuditFilter): Promise<IntegrationAuditEvent[]> | IntegrationAuditEvent[];
+}
+interface IntegrationAuditFilter {
+    type?: IntegrationAuditEventType;
+    actor?: IntegrationActor;
+    connectionId?: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+}
+declare class InMemoryIntegrationAuditStore implements IntegrationAuditStore {
+    private readonly events;
+    record(event: IntegrationAuditEvent): void;
+    list(filter?: IntegrationAuditFilter): IntegrationAuditEvent[];
+}
+declare function createIntegrationAuditEvent(input: Omit<IntegrationAuditEvent, 'id' | 'occurredAt'> & {
+    id?: string;
+    occurredAt?: string | Date;
+    now?: () => Date;
+}): IntegrationAuditEvent;
+declare function createAuditingActionGuard(options: {
+    sink: IntegrationAuditSink;
+    subject?: IntegrationActor;
+    now?: () => Date;
+    includeInputPreview?: boolean;
+}): IntegrationActionGuard;
+declare function sanitizeAuditConnection(connection: IntegrationConnection): Record<string, unknown>;
+
+type IntegrationApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired';
+interface IntegrationApprovalRecord {
+    id: string;
+    request: IntegrationApprovalRequest;
+    status: IntegrationApprovalStatus;
+    requestedAt: string;
+    resolvedAt?: string;
+    resolvedBy?: IntegrationActor;
+    reason?: string;
+    expiresAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationApprovalStore {
+    get(approvalId: string): Promise<IntegrationApprovalRecord | undefined> | IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): Promise<void> | void;
+    list(filter?: IntegrationApprovalFilter): Promise<IntegrationApprovalRecord[]> | IntegrationApprovalRecord[];
+}
+interface IntegrationApprovalFilter {
+    status?: IntegrationApprovalStatus;
+    connectionId?: string;
+    connectorId?: string;
+    action?: string;
+    actor?: IntegrationActor;
+}
+interface ApprovalBackedPolicyOptions {
+    base: IntegrationPolicyEngine;
+    store: IntegrationApprovalStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    approvalTtlMs?: number;
+}
+declare class InMemoryIntegrationApprovalStore implements IntegrationApprovalStore {
+    private readonly records;
+    get(approvalId: string): IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): void;
+    list(filter?: IntegrationApprovalFilter): IntegrationApprovalRecord[];
+}
+declare class ApprovalBackedPolicyEngine implements IntegrationPolicyEngine {
+    private readonly base;
+    private readonly store;
+    private readonly audit;
+    private readonly now;
+    private readonly approvalTtlMs;
+    constructor(options: ApprovalBackedPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: IntegrationActor;
+    }): Promise<IntegrationPolicyDecision>;
+    private findApprovedRecord;
+}
+declare function createApprovalBackedPolicyEngine(options: ApprovalBackedPolicyOptions): ApprovalBackedPolicyEngine;
+declare function resolveIntegrationApproval(input: {
+    store: IntegrationApprovalStore;
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: IntegrationActor;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationApprovalRecord>;
+
+declare const CANONICAL_INTEGRATION_ACTIONS: {
+    readonly googleCalendarEventsList: "google-calendar.events.list";
+    readonly googleCalendarEventsCreate: "google-calendar.events.create";
+    readonly gmailMessagesSearch: "gmail.messages.search";
+    readonly gmailMessagesSend: "gmail.messages.send";
+    readonly googleDriveFilesSearch: "google-drive.files.search";
+    readonly googleDriveFilesRead: "google-drive.files.read";
+    readonly githubRepositoriesGet: "github.repositories.get";
+    readonly githubIssuesSearch: "github.issues.search";
+    readonly githubIssuesCreate: "github.issues.create";
+    readonly githubPullRequestsComment: "github.pull-requests.comment";
+    readonly slackChannelsList: "slack.channels.list";
+    readonly slackMessagesSearch: "slack.messages.search";
+    readonly slackMessagesPost: "slack.messages.post";
+    readonly providerHttpRequest: "provider.http.request";
+};
+type CanonicalIntegrationActionId = typeof CANONICAL_INTEGRATION_ACTIONS[keyof typeof CANONICAL_INTEGRATION_ACTIONS];
+interface CanonicalLaunchConnectorOptions {
+    providerId?: string;
+    includeProviderPassthrough?: boolean;
+}
+declare function buildCanonicalLaunchConnectors(options?: CanonicalLaunchConnectorOptions): IntegrationConnector[];
+declare function canonicalActionConnectorId(actionId: string): string | undefined;
+
+interface IntegrationToolDefinition {
+    name: string;
+    title: string;
+    description: string;
+    providerId: string;
+    connectorId: string;
+    connectorTitle: string;
+    category: IntegrationConnectorCategory;
+    action: IntegrationConnectorAction;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    requiredScopes: string[];
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    tags: string[];
+}
+interface IntegrationToolSearchFilters {
+    providerId?: string;
+    connectorId?: string;
+    category?: IntegrationConnectorCategory;
+    maxRisk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+    limit?: number;
+}
+interface IntegrationToolSearchResult {
+    tool: IntegrationToolDefinition;
+    score: number;
+    matched: string[];
+}
+interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+}
+declare function integrationToolName(providerId: string, connectorId: string, actionId: string): string;
+declare function parseIntegrationToolName(name: string): {
+    providerId: string;
+    connectorId: string;
+    actionId: string;
+};
+declare function buildIntegrationToolCatalog(connectors: IntegrationConnector[]): IntegrationToolDefinition[];
+declare function searchIntegrationTools(catalog: IntegrationToolDefinition[], query: string, filters?: IntegrationToolSearchFilters): IntegrationToolSearchResult[];
+declare function toMcpTools(tools: IntegrationToolDefinition[]): McpToolDefinition[];
+
+type IntegrationRequirementMode = 'read' | 'write' | 'trigger';
+type IntegrationRequirementStatus = 'ready' | 'missing_connection' | 'not_executable' | 'unknown_connector';
+interface IntegrationRequirement {
+    id: string;
+    connectorId: string;
+    reason: string;
+    mode: IntegrationRequirementMode;
+    requiredActions?: string[];
+    requiredTriggers?: string[];
+    requiredScopes?: string[];
+    optional?: boolean;
+}
+interface IntegrationManifest {
+    id: string;
+    title?: string;
+    owner?: IntegrationActor;
+    requirements: IntegrationRequirement[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationRequirementResolution {
+    requirement: IntegrationRequirement;
+    status: IntegrationRequirementStatus;
+    connector?: IntegrationConnector;
+    registryEntry?: IntegrationRegistryEntry;
+    connection?: IntegrationConnection;
+    missingScopes: string[];
+    missingActions: string[];
+    missingTriggers: string[];
+    message: string;
+}
+interface IntegrationManifestResolution {
+    manifest: IntegrationManifest;
+    owner: IntegrationActor;
+    ready: IntegrationRequirementResolution[];
+    missing: IntegrationRequirementResolution[];
+    optionalMissing: IntegrationRequirementResolution[];
+}
+interface IntegrationGrant {
+    id: string;
+    manifestId: string;
+    requirementId: string;
+    owner: IntegrationActor;
+    grantee: IntegrationActor;
+    connectionId: string;
+    connectorId: string;
+    scopes: string[];
+    allowedActions: string[];
+    allowedTriggers: string[];
+    status: 'active' | 'revoked';
+    createdAt: string;
+    updatedAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationGrantStore {
+    get(grantId: string): Promise<IntegrationGrant | undefined> | IntegrationGrant | undefined;
+    put(grant: IntegrationGrant): Promise<void> | void;
+    listByManifest(manifestId: string, grantee?: IntegrationActor): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    listByGrantee(grantee: IntegrationActor): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    listByIds?(grantIds: string[]): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    delete?(grantId: string): Promise<void> | void;
+}
+interface IntegrationCapabilityBinding {
+    requirementId: string;
+    connectorId: string;
+    connectionId: string;
+    grantId: string;
+    scopes: string[];
+    allowedActions: string[];
+    allowedTriggers: string[];
+    capability: IssuedIntegrationCapability;
+}
+interface IntegrationSandboxBundle {
+    manifestId: string;
+    subject: IntegrationActor;
+    capabilities: IntegrationCapabilityBinding[];
+    connectors: IntegrationConnector[];
+    tools: IntegrationToolDefinition[];
+    expiresAt: string;
+}
+interface IntegrationRuntimeHub {
+    listRegistry(): Promise<IntegrationRegistry> | IntegrationRegistry;
+    listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]> | IntegrationConnection[];
+    issueCapability(input: {
+        subject: IntegrationActor;
+        connectionId: string;
+        scopes: string[];
+        allowedActions: string[];
+        ttlMs: number;
+        metadata?: Record<string, unknown>;
+    }): Promise<IssuedIntegrationCapability> | IssuedIntegrationCapability;
+}
+interface IntegrationRuntimeOptions {
+    hub: IntegrationRuntimeHub;
+    grants?: IntegrationGrantStore;
+    now?: () => Date;
+}
+declare class InMemoryIntegrationGrantStore implements IntegrationGrantStore {
+    private readonly grants;
+    get(grantId: string): IntegrationGrant | undefined;
+    put(grant: IntegrationGrant): void;
+    listByManifest(manifestId: string, grantee?: IntegrationActor): IntegrationGrant[];
+    listByGrantee(grantee: IntegrationActor): IntegrationGrant[];
+    listByIds(grantIds: string[]): IntegrationGrant[];
+    delete(grantId: string): void;
+}
+declare class IntegrationRuntime {
+    private readonly hub;
+    private readonly grants;
+    private readonly now;
+    constructor(options: IntegrationRuntimeOptions);
+    registry(): Promise<IntegrationRegistry>;
+    resolveManifest(manifest: IntegrationManifest, owner: IntegrationActor): Promise<IntegrationManifestResolution>;
+    createGrants(input: {
+        manifest: IntegrationManifest;
+        owner: IntegrationActor;
+        grantee: IntegrationActor;
+        metadata?: Record<string, unknown>;
+    }): Promise<IntegrationGrant[]>;
+    buildSandboxBundle(input: {
+        manifestId?: string;
+        grantIds?: string[];
+        subject: IntegrationActor;
+        ttlMs: number;
+        grantee?: IntegrationActor;
+    }): Promise<IntegrationSandboxBundle>;
+    private resolveBundleGrants;
+}
+declare function createIntegrationRuntime(options: IntegrationRuntimeOptions): IntegrationRuntime;
+
+declare const DEFAULT_INTEGRATION_BRIDGE_ENV = "TANGLE_INTEGRATION_BUNDLE";
+interface IntegrationBridgePayload {
+    version: 1;
+    manifestId: string;
+    subject: IntegrationSandboxBundle['subject'];
+    expiresAt: string;
+    tools: IntegrationBridgeToolBinding[];
+}
+interface IntegrationBridgeToolBinding {
+    name: string;
+    title: string;
+    connectorId: string;
+    connectionId: string;
+    action: string;
+    risk: string;
+    dataClass: string;
+    requiredScopes: string[];
+    capabilityToken: string;
+}
+declare function buildIntegrationBridgePayload(bundle: IntegrationSandboxBundle): IntegrationBridgePayload;
+declare function encodeIntegrationBridgePayload(payload: IntegrationBridgePayload): string;
+declare function decodeIntegrationBridgePayload(encoded: string): IntegrationBridgePayload;
+declare function buildIntegrationBridgeEnvironment(bundle: IntegrationSandboxBundle, options?: {
+    envVar?: string;
+}): Record<string, string>;
+declare function parseIntegrationBridgeEnvironment(env: Record<string, string | undefined>, options?: {
+    envVar?: string;
+}): IntegrationBridgePayload;
+declare function redactIntegrationBridgePayload(payload: IntegrationBridgePayload): IntegrationBridgePayload;
+
+interface TangleIntegrationsClientOptions {
+    endpoint: string;
+    bridge?: IntegrationBridgePayload;
+    env?: Record<string, string | undefined>;
+    envVar?: string;
+    fetchImpl?: typeof fetch;
+    getCapabilityToken?: (tool: IntegrationBridgeToolBinding) => string | Promise<string>;
+}
+interface TangleIntegrationInvokeInput<TInput = unknown> {
+    tool: string;
+    input?: TInput;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface TangleIntegrationInvokeResult<TOutput = unknown> {
+    status: 'ok' | 'approval_required' | 'failed';
+    action: string;
+    output?: TOutput;
+    approval?: unknown;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class TangleIntegrationsClient {
+    private readonly endpoint;
+    private readonly bridge;
+    private readonly fetchImpl;
+    private readonly getCapabilityToken;
+    constructor(options: TangleIntegrationsClientOptions);
+    tools(): IntegrationBridgeToolBinding[];
+    findTool(toolOrAction: string): IntegrationBridgeToolBinding;
+    invoke<TOutput = unknown, TInput = unknown>(input: TangleIntegrationInvokeInput<TInput>): Promise<TangleIntegrationInvokeResult<TOutput>>;
+}
+declare function createTangleIntegrationsClient(options: TangleIntegrationsClientOptions): TangleIntegrationsClient;
+
+interface ConsentSummary {
+    title: string;
+    body: string;
+    bullets: string[];
+    primaryAction: string;
+    risk: 'read' | 'write' | 'destructive';
+    connectorIds: string[];
+}
+interface RenderConsentOptions {
+    appName?: string;
+    connectors?: IntegrationConnector[];
+}
+declare function renderConsentSummary(manifestOrResolution: IntegrationManifest | IntegrationManifestResolution, options?: RenderConsentOptions): ConsentSummary;
+declare function renderApprovalCopy(input: {
+    appName: string;
+    connectorTitle: string;
+    action: IntegrationConnectorAction;
+    approvalId?: string;
+}): ConsentSummary;
+
+interface ConnectorAdapterProviderOptions {
+    id?: string;
+    kind?: IntegrationProviderKind;
+    adapters: ConnectorAdapter[];
+    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
+    now?: () => Date;
+}
+declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
+declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
+declare function createConnectorAdapterCatalogSource(options: {
+    id?: string;
+    providerId?: string;
+    adapters: ConnectorAdapter[];
+    precedence?: number;
+}): IntegrationCatalogSource;
+declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
+
+interface IntegrationSecretStore {
+    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
+    delete?(ref: SecretRef): Promise<void> | void;
+}
+interface ConnectionCredentialResolverOptions {
+    secrets: IntegrationSecretStore;
+    connections?: IntegrationConnectionStore;
+    adapters?: ConnectorAdapter[];
+    now?: () => Date;
+    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
+}
+declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
+    private readonly secrets;
+    get(ref: SecretRef): ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): void;
+    delete(ref: SecretRef): void;
+}
+declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
+declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
+declare function createCredentialBackedAdapterProvider(options: Omit<ConnectorAdapterProviderOptions, 'resolveDataSource'> & ConnectionCredentialResolverOptions): IntegrationProvider;
+declare function revokeConnection(input: {
+    connection: IntegrationConnection;
+    connections?: IntegrationConnectionStore;
+    secrets?: IntegrationSecretStore;
+    now?: () => Date;
+}): Promise<IntegrationConnection>;
+
+type IntegrationErrorCode = 'missing_connection' | 'missing_grant' | 'approval_required' | 'approval_denied' | 'connection_revoked' | 'connection_expired' | 'scope_missing' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'provider_rate_limited' | 'provider_auth_failed' | 'provider_unavailable' | 'provider_error' | 'capability_expired' | 'capability_invalid' | 'manifest_invalid' | 'passthrough_disabled' | 'input_invalid' | 'unknown';
+interface IntegrationUserAction {
+    type: 'connect' | 'reconnect' | 'approve' | 'retry' | 'contact_support' | 'change_request';
+    label: string;
+    connectorId?: string;
+    approvalId?: string;
+}
+declare class IntegrationRuntimeError extends Error {
+    readonly code: IntegrationErrorCode;
+    readonly status: number;
+    readonly userAction?: IntegrationUserAction;
+    readonly metadata?: Record<string, unknown>;
+    constructor(input: {
+        code: IntegrationErrorCode;
+        message: string;
+        status?: number;
+        userAction?: IntegrationUserAction;
+        metadata?: Record<string, unknown>;
+    });
+}
+interface NormalizedIntegrationError {
+    ok: false;
+    code: IntegrationErrorCode;
+    message: string;
+    status: number;
+    userAction?: IntegrationUserAction;
+    metadata?: Record<string, unknown>;
+}
+declare function normalizeIntegrationError(error: unknown): NormalizedIntegrationError;
+declare function statusForCode(code: IntegrationErrorCode): number;
+
+interface IntegrationWorkflowDefinition {
+    id: string;
+    title?: string;
+    manifest: IntegrationManifest;
+    trigger: {
+        requirementId: string;
+        triggerId: string;
+        targetUrl?: string;
+    };
+    metadata?: Record<string, unknown>;
+}
+interface InstalledIntegrationWorkflow {
+    id: string;
+    workflowId: string;
+    manifestId: string;
+    owner: IntegrationActor;
+    grantee: IntegrationActor;
+    triggerGrantId: string;
+    subscription: IntegrationTriggerSubscription;
+    status: 'active' | 'paused' | 'error';
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationWorkflowStore {
+    put(workflow: InstalledIntegrationWorkflow): Promise<void> | void;
+    get(id: string): Promise<InstalledIntegrationWorkflow | undefined> | InstalledIntegrationWorkflow | undefined;
+    list(): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+}
+interface IntegrationWorkflowRuntimeHub {
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+}
+interface IntegrationWorkflowRuntimeOptions {
+    runtime: IntegrationRuntime;
+    hub: IntegrationWorkflowRuntimeHub;
+    grants: IntegrationGrantStore;
+    store?: IntegrationWorkflowStore;
+    now?: () => Date;
+}
+declare class InMemoryIntegrationWorkflowStore implements IntegrationWorkflowStore {
+    private readonly workflows;
+    put(workflow: InstalledIntegrationWorkflow): void;
+    get(id: string): InstalledIntegrationWorkflow | undefined;
+    list(): InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): InstalledIntegrationWorkflow[];
+}
+declare class IntegrationWorkflowRuntime {
+    private readonly runtime;
+    private readonly hub;
+    private readonly grants;
+    private readonly store;
+    private readonly now;
+    constructor(options: IntegrationWorkflowRuntimeOptions);
+    install(input: {
+        workflow: IntegrationWorkflowDefinition;
+        owner: IntegrationActor;
+        grantee: IntegrationActor;
+    }): Promise<InstalledIntegrationWorkflow>;
+    dispatchEvent<T = unknown>(event: IntegrationTriggerEvent<T>, handler: (input: {
+        event: IntegrationTriggerEvent<T>;
+        workflows: InstalledIntegrationWorkflow[];
+    }) => Promise<void> | void): Promise<{
+        matched: InstalledIntegrationWorkflow[];
+    }>;
+}
+declare function createIntegrationWorkflowRuntime(options: IntegrationWorkflowRuntimeOptions): IntegrationWorkflowRuntime;
+
+interface StoredIntegrationEvent {
+    id: string;
+    sourceId: string;
+    connectorId: string;
+    eventType: string;
+    providerEventId?: string;
+    receivedAt: string;
+    payload: Record<string, unknown>;
+    dispatchedAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationEventStore {
+    put(event: StoredIntegrationEvent): Promise<void> | void;
+    hasProviderEvent(sourceId: string, providerEventId: string): Promise<boolean> | boolean;
+    list(): Promise<StoredIntegrationEvent[]> | StoredIntegrationEvent[];
+}
+interface IntegrationWebhookReceiverResult {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+    received: StoredIntegrationEvent[];
+    duplicates: StoredIntegrationEvent[];
+}
+declare class InMemoryIntegrationEventStore implements IntegrationEventStore {
+    private readonly events;
+    private readonly providerIds;
+    put(event: StoredIntegrationEvent): void;
+    hasProviderEvent(sourceId: string, providerEventId: string): boolean;
+    list(): StoredIntegrationEvent[];
+}
+declare function receiveIntegrationWebhook(input: {
+    adapter: ConnectorAdapter;
+    source: ResolvedDataSource;
+    rawBody: string;
+    headers: Record<string, string | string[] | undefined>;
+    store: IntegrationEventStore;
+    workflowRuntime?: IntegrationWorkflowRuntime;
+    now?: () => Date;
+}): Promise<IntegrationWebhookReceiverResult>;
+declare function storedEventToTriggerEvent(event: StoredIntegrationEvent, source: ResolvedDataSource): IntegrationTriggerEvent;
+
+interface IntegrationIdempotencyRecord {
+    key: string;
+    requestHash: string;
+    result: IntegrationActionResult;
+    createdAt: string;
+}
+interface IntegrationIdempotencyStore {
+    get(key: string): Promise<IntegrationIdempotencyRecord | undefined> | IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): Promise<void> | void;
+}
+interface IntegrationRateLimitDecision {
+    allowed: boolean;
+    retryAfterMs?: number;
+    reason?: string;
+}
+interface IntegrationRateLimiter {
+    check(ctx: IntegrationGuardContext): Promise<IntegrationRateLimitDecision> | IntegrationRateLimitDecision;
+}
+declare class InMemoryIntegrationIdempotencyStore implements IntegrationIdempotencyStore {
+    private readonly records;
+    get(key: string): IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): void;
+}
+declare class DefaultIntegrationActionGuard implements IntegrationActionGuard {
+    private readonly idempotency;
+    private readonly audit;
+    private readonly rateLimiter;
+    private readonly now;
+    constructor(options?: {
+        idempotency?: IntegrationIdempotencyStore;
+        audit?: IntegrationAuditSink;
+        rateLimiter?: IntegrationRateLimiter;
+        now?: () => Date;
+    });
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+    private writeIdempotency;
+}
+declare function createDefaultIntegrationActionGuard(options?: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0]): DefaultIntegrationActionGuard;
+
+type IntegrationHealthcheckStatus = 'healthy' | 'degraded' | 'unhealthy' | 'unknown';
+interface IntegrationHealthcheckCheck {
+    id: string;
+    status: IntegrationHealthcheckStatus;
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckResult {
+    connectionId: string;
+    providerId: string;
+    connectorId: string;
+    status: IntegrationHealthcheckStatus;
+    checkedAt: string;
+    checks: IntegrationHealthcheckCheck[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckStore {
+    put(result: IntegrationHealthcheckResult): Promise<void> | void;
+    get(connectionId: string): Promise<IntegrationHealthcheckResult | undefined> | IntegrationHealthcheckResult | undefined;
+    list(): Promise<IntegrationHealthcheckResult[]> | IntegrationHealthcheckResult[];
+}
+declare class InMemoryIntegrationHealthcheckStore implements IntegrationHealthcheckStore {
+    private readonly results;
+    put(result: IntegrationHealthcheckResult): void;
+    get(connectionId: string): IntegrationHealthcheckResult | undefined;
+    list(): IntegrationHealthcheckResult[];
+}
+declare function runIntegrationHealthcheck(input: {
+    connection: IntegrationConnection;
+    connector?: IntegrationConnector;
+    registry?: IntegrationRegistry;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationHealthcheckResult>;
+declare function runIntegrationHealthchecks(input: {
+    connections: IntegrationConnection[];
+    registry?: IntegrationRegistry;
+    store?: IntegrationHealthcheckStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+}): Promise<IntegrationHealthcheckResult[]>;
+declare function healthcheckRequest(action?: string): IntegrationActionRequest;
+
+interface ManifestValidationIssue {
+    path: string;
+    message: string;
+}
+interface ManifestValidationResult {
+    ok: boolean;
+    issues: ManifestValidationIssue[];
+}
+interface InferIntegrationRequirementsOptions {
+    manifestId: string;
+    title?: string;
+    tools: Array<string | {
+        action: string;
+        reason?: string;
+        mode?: IntegrationRequirementMode;
+        connectorId?: string;
+        scopes?: string[];
+    }>;
+    metadata?: Record<string, unknown>;
+}
+interface MissingRequirementExplanation {
+    requirementId: string;
+    connectorId: string;
+    status: string;
+    message: string;
+    userAction: 'connect' | 'enable' | 'ignore_optional';
+}
+declare function validateIntegrationManifest(manifest: IntegrationManifest): ManifestValidationResult;
+declare function assertValidIntegrationManifest(manifest: IntegrationManifest): void;
+declare function inferIntegrationManifestFromTools(options: InferIntegrationRequirementsOptions): IntegrationManifest;
+declare function explainMissingRequirements(resolution: IntegrationManifestResolution): MissingRequirementExplanation[];
+declare function calendarExercisePlannerManifest(id?: string): IntegrationManifest;
+
+interface ProviderHttpRequestInput {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    body?: unknown;
+}
+interface ProviderPassthroughPolicy {
+    enabled: boolean;
+    allowedMethods?: ProviderHttpRequestInput['method'][];
+    allowedPathPrefixes?: string[];
+    maxBodyBytes?: number;
+}
+declare const PROVIDER_PASSTHROUGH_ACTION: "provider.http.request";
+declare function validateProviderPassthroughRequest(input: ProviderHttpRequestInput, policy: ProviderPassthroughPolicy): void;
+
+type IntegrationPolicyEffect = 'allow' | 'require_approval' | 'deny';
+interface IntegrationPolicyRule {
+    id: string;
+    effect: IntegrationPolicyEffect;
+    reason: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    maxRisk?: IntegrationActionRisk;
+    risk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+}
+interface StaticIntegrationPolicyOptions {
+    rules?: IntegrationPolicyRule[];
+    defaultReadEffect?: IntegrationPolicyEffect;
+    defaultWriteEffect?: IntegrationPolicyEffect;
+    defaultDestructiveEffect?: IntegrationPolicyEffect;
+    now?: () => Date;
+}
+interface IntegrationApprovalResolution {
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: string;
+    resolvedAt: string;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class StaticIntegrationPolicyEngine implements IntegrationPolicyEngine {
+    private readonly rules;
+    private readonly defaultReadEffect;
+    private readonly defaultWriteEffect;
+    private readonly defaultDestructiveEffect;
+    private readonly now;
+    constructor(options?: StaticIntegrationPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: {
+            type: string;
+            id: string;
+        };
+    }): IntegrationPolicyDecision;
+    private defaultEffect;
+}
+declare function createDefaultIntegrationPolicyEngine(options?: Omit<StaticIntegrationPolicyOptions, 'rules'>): StaticIntegrationPolicyEngine;
+declare function buildApprovalRequest(ctx: IntegrationGuardContext & {
+    subject: {
+        type: string;
+        id: string;
+    };
+}, reason: string, requestedAt: Date): IntegrationApprovalRequest;
+declare function redactApprovalRequest(request: IntegrationApprovalRequest): IntegrationApprovalRequest;
+
+interface PlatformIntegrationPolicyPresetOptions extends Omit<StaticIntegrationPolicyOptions, 'defaultReadEffect' | 'defaultWriteEffect' | 'defaultDestructiveEffect'> {
+    allowWritesWithoutApproval?: boolean;
+    allowDestructiveActions?: boolean;
+    allowProviderPassthrough?: boolean;
+}
+declare function createPlatformIntegrationPolicyPreset(options?: PlatformIntegrationPolicyPresetOptions): StaticIntegrationPolicyEngine;
+
+interface CatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    action: IntegrationConnector['actions'][number];
+}
+interface CatalogExecutorProviderOptions {
+    id: string;
+    kind: IntegrationProviderKind;
+    connectors: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: CatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (connection: IntegrationConnection, trigger: NonNullable<IntegrationConnector['triggers']>[number], targetUrl?: string) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+declare function createCatalogExecutorProvider(options: CatalogExecutorProviderOptions): IntegrationProvider;
+
+interface IntegrationInvocationEnvelope {
+    kind: 'integration.invocation';
+    capabilityToken: string;
+    toolName: string;
+    action: string;
+    input?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationInvocationEnvelopeValidationOptions {
+    connectors?: IntegrationConnector[];
+    maxInputBytes?: number;
+    requireKnownTool?: boolean;
+}
+type NormalizedIntegrationResult = {
+    status: 'ok';
+    action: string;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'approval_required';
+    action: string;
+    approval: IntegrationApprovalRequest;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'failed';
+    action: string;
+    error: string;
+    metadata?: Record<string, unknown>;
+};
+interface IntegrationSandboxHostHub {
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+interface IntegrationSandboxHostOptions extends IntegrationInvocationEnvelopeValidationOptions {
+    hub: IntegrationSandboxHostHub;
+}
+declare function buildIntegrationInvocationEnvelope(input: {
+    capabilityToken: string;
+    toolName: string;
+    args?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}): IntegrationInvocationEnvelope;
+declare function invocationRequestFromEnvelope(envelope: IntegrationInvocationEnvelope): InvokeWithCapabilityRequest;
+declare function validateIntegrationInvocationEnvelope(envelope: IntegrationInvocationEnvelope, options?: IntegrationInvocationEnvelopeValidationOptions): void;
+declare function redactInvocationEnvelope(envelope: IntegrationInvocationEnvelope): Omit<IntegrationInvocationEnvelope, 'capabilityToken'> & {
+    capabilityToken: '[REDACTED]';
+};
+declare function redactCapability(capability: IntegrationCapability): IntegrationCapability;
+declare function normalizeIntegrationResult(result: IntegrationActionResult): NormalizedIntegrationResult;
+declare function dispatchIntegrationInvocation(envelope: IntegrationInvocationEnvelope, options: IntegrationSandboxHostOptions): Promise<NormalizedIntegrationResult>;
+declare class IntegrationSandboxHost {
+    private readonly options;
+    constructor(options: IntegrationSandboxHostOptions);
+    dispatch(envelope: IntegrationInvocationEnvelope): Promise<NormalizedIntegrationResult>;
+}
+
+interface ImportCatalogOptions {
+    providerId: string;
+    connectorId: string;
+    connectorTitle: string;
+    category?: IntegrationConnectorCategory;
+    auth?: IntegrationConnector['auth'];
+    scopes?: string[];
+    dataClass?: IntegrationDataClass;
+    defaultRisk?: IntegrationActionRisk;
+}
+interface OpenApiDocument {
+    openapi?: string;
+    swagger?: string;
+    info?: {
+        title?: string;
+    };
+    paths?: Record<string, Record<string, OpenApiOperation | unknown>>;
+}
+interface OpenApiOperation {
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: unknown;
+    security?: Array<Record<string, string[]>>;
+    tags?: string[];
+}
+interface GraphqlOperationSpec {
+    name: string;
+    kind: 'query' | 'mutation';
+    description?: string;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    requiredScopes?: string[];
+}
+interface McpCatalogTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        openWorldHint?: boolean;
+        title?: string;
+    };
+}
+interface McpCatalog {
+    tools: McpCatalogTool[];
+}
+declare function importOpenApiConnector(document: OpenApiDocument, options: ImportCatalogOptions): IntegrationConnector;
+declare function importGraphqlConnector(operations: GraphqlOperationSpec[], options: ImportCatalogOptions): IntegrationConnector;
+declare function importMcpConnector(catalog: McpCatalog, options: ImportCatalogOptions): IntegrationConnector;
+
+interface GatewayCatalogProviderOptions {
+    id: string;
+    kind: Extract<IntegrationProviderKind, 'nango' | 'pipedream' | 'activepieces' | 'tangle_catalog' | 'zapier' | 'executor' | 'custom'>;
+    fetchCatalog: () => Promise<GatewayCatalogEntry[]> | GatewayCatalogEntry[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    invokeAction?: (connection: IntegrationConnection, request: IntegrationActionRequest) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    cacheTtlMs?: number;
+    now?: () => Date;
+}
+interface GatewayCatalogEntry {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    category?: string;
+    auth?: 'oauth2' | 'api_key' | 'none' | 'custom' | string;
+    scopes?: string[];
+    actions?: GatewayCatalogAction[];
+    triggers?: GatewayCatalogTrigger[];
+    metadata?: Record<string, unknown>;
+}
+interface GatewayCatalogAction {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    risk?: 'read' | 'write' | 'destructive' | string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    approvalRequired?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+}
+interface GatewayCatalogTrigger {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    payloadSchema?: unknown;
+}
+declare function createGatewayCatalogProvider(options: GatewayCatalogProviderOptions): IntegrationProvider;
+declare function normalizeGatewayCatalog(entries: GatewayCatalogEntry[], options: {
+    providerId: string;
+    providerKind: IntegrationProviderKind;
+}): IntegrationConnector[];
+
+interface ActivepiecesCatalogEntry {
+    id: string;
+    title: string;
+    description: string;
+    npmPackage?: string;
+    version?: string;
+    category: IntegrationConnectorCategory;
+    auth: IntegrationConnector['auth'];
+    authFields?: ActivepiecesCatalogAuthField[];
+    domains: string[];
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationActionRisk;
+        upstreamName?: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName?: string;
+    }>;
+    source: {
+        repository: string;
+        path: string;
+        license: 'MIT';
+    };
+}
+interface ActivepiecesCatalogAuthField {
+    key: string;
+    label: string;
+    required: boolean;
+    secret: boolean;
+    kind: 'text' | 'number' | 'boolean' | 'select' | 'object' | 'unknown';
+    description?: string;
+}
+declare function listActivepiecesCatalogEntries(): ActivepiecesCatalogEntry[];
+declare function buildActivepiecesConnectors(options?: {
+    providerId?: string;
+    includeCatalogActions?: boolean;
+    executable?: boolean;
+}): IntegrationConnector[];
+
+interface ActivepiecesPieceOverride {
+    category?: IntegrationConnectorCategory;
+    actionRisks?: Record<string, IntegrationActionRisk>;
+    approvalRequired?: Record<string, boolean>;
+}
+declare const ACTIVEPIECES_OVERRIDES: Record<string, ActivepiecesPieceOverride>;
+declare function getActivepiecesOverride(id: string): ActivepiecesPieceOverride | undefined;
+
+interface ActivepiecesExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    catalogEntry: ActivepiecesCatalogEntry;
+    piece: {
+        id: string;
+        npmPackage?: string;
+        version?: string;
+        actionId: string;
+        upstreamActionName?: string;
+    };
+}
+interface ActivepiecesExecutorProviderOptions {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: ActivepiecesExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+declare function createActivepiecesExecutorProvider(options: ActivepiecesExecutorProviderOptions): IntegrationProvider;
+
+declare const ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER = "x-tangle-activepieces-signature";
+declare const TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER = "x-tangle-catalog-signature";
+interface TangleCatalogRuntimeActionRequest {
+    id: string;
+    input: unknown;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface TangleCatalogRuntimePiece {
+    id: string;
+    packageName?: string;
+    version?: string;
+    actionId: string;
+    upstreamActionName?: string;
+}
+interface TangleCatalogHttpExecutorOptions {
+    endpoint: string;
+    path?: string;
+    signatureHeader?: string;
+    secret?: string;
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    requestId?: () => string;
+}
+interface TangleCatalogHttpExecutorInvocation extends Omit<ActivepiecesExecutorInvocation, 'catalogEntry' | 'piece'> {
+    catalogEntry: unknown;
+    piece: TangleCatalogRuntimePiece;
+}
+/**
+ * @deprecated Use the Tangle catalog runtime types. This name is kept only for
+ * compatibility with the upstream catalog ingestion backend.
+ */
+interface ActivepiecesRuntimeRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connection: IntegrationConnection;
+    connector: Pick<IntegrationConnector, 'id' | 'title' | 'auth' | 'scopes' | 'metadata'>;
+    piece: ActivepiecesExecutorInvocation['piece'];
+    action: TangleCatalogRuntimeActionRequest;
+}
+/**
+ * @deprecated Use `TangleCatalogHttpExecutorOptions`.
+ */
+type ActivepiecesHttpExecutorOptions = TangleCatalogHttpExecutorOptions;
+/**
+ * @deprecated Use `createTangleCatalogHttpExecutor`.
+ */
+declare function createActivepiecesHttpExecutor(options: ActivepiecesHttpExecutorOptions): ActivepiecesExecutorProviderOptions['executeAction'];
+/**
+ * @deprecated Use `buildTangleCatalogRuntimeRequest`.
+ */
+declare function buildActivepiecesRuntimeRequest(invocation: ActivepiecesExecutorInvocation, requestId?: string): ActivepiecesRuntimeRequest;
+/**
+ * @deprecated Use `signTangleCatalogRuntimeRequest`.
+ */
+declare function signActivepiecesRuntimeRequest(serializedBody: string, secret: string): string;
+/**
+ * @deprecated Use `verifyTangleCatalogRuntimeSignature`.
+ */
+declare function verifyActivepiecesRuntimeSignature(serializedBody: string, signature: string | null | undefined, secret: string): boolean;
+interface TangleCatalogRuntimeRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connection: IntegrationConnection;
+    connector: Pick<IntegrationConnector, 'id' | 'title' | 'auth' | 'scopes' | 'metadata'>;
+    piece: TangleCatalogRuntimePiece;
+    action: TangleCatalogRuntimeActionRequest;
+}
+declare function createTangleCatalogHttpExecutor(options: TangleCatalogHttpExecutorOptions): (invocation: TangleCatalogHttpExecutorInvocation) => Promise<IntegrationActionResult>;
+declare function buildTangleCatalogRuntimeRequest(invocation: TangleCatalogHttpExecutorInvocation, requestId?: string): TangleCatalogRuntimeRequest;
+declare const signTangleCatalogRuntimeRequest: typeof signActivepiecesRuntimeRequest;
+declare const verifyTangleCatalogRuntimeSignature: typeof verifyActivepiecesRuntimeSignature;
+
+interface IntegrationCatalogFreshnessOptions {
+    liveActivepieces?: boolean;
+    minActivepiecesConnectors?: number;
+    staleConnectorDelta?: number;
+    fetchImpl?: typeof fetch;
+}
+interface IntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        activepiecesEntries: number;
+        activepiecesConnectors: number;
+        activepiecesActions: number;
+        activepiecesTriggers: number;
+        executableActivepiecesConnectors: number;
+        executableActivepiecesActions: number;
+        executableActivepiecesTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: IntegrationRegistrySummary;
+        conflictSamples: IntegrationRegistryConflict[];
+    };
+    upstream?: {
+        activepiecesPieces?: number;
+        activepiecesDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare const ACTIVEPIECES_PUBLIC_CATALOG_URL = "https://www.activepieces.com/pieces";
+declare function extractActivepiecesPublicPieceCount(html: string): number | undefined;
+declare function auditIntegrationCatalogFreshness(options?: IntegrationCatalogFreshnessOptions): Promise<IntegrationCatalogFreshnessResult>;
+
+declare const TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID = "tangle-catalog";
+declare const TANGLE_INTEGRATIONS_CATALOG_SOURCE = "tangle-integrations-catalog";
+type TangleIntegrationImplementationKind = 'native_adapter' | 'package_runtime';
+type TangleIntegrationContractStatus = 'contract_ready' | 'runtime_backed' | 'native_backed';
+interface TangleIntegrationCatalogEntry {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields?: ActivepiecesCatalogEntry['authFields'];
+    domains: string[];
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName?: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName?: string;
+    }>;
+}
+interface TangleIntegrationContract {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields: NonNullable<ActivepiecesCatalogEntry['authFields']>;
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName: string;
+    }>;
+    implementation: {
+        kind: TangleIntegrationImplementationKind;
+        runtimePackage?: string;
+        version?: string;
+    };
+    status: TangleIntegrationContractStatus;
+    quality: {
+        tangleContract: true;
+        authFieldsMapped: boolean;
+        actionNamesMapped: boolean;
+        triggerNamesMapped: boolean;
+        runtimePackageMapped: boolean;
+        nativeAdapter: boolean;
+    };
+}
+interface TangleCatalogRuntimePackageManifestOptions {
+    name?: string;
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+    additionalDependencies?: Record<string, string>;
+}
+interface TangleCatalogRuntimePackageManifest {
+    name: string;
+    private: true;
+    type: 'module';
+    dependencies: Record<string, string>;
+    tangle: {
+        integrationContracts: number;
+        packageRuntimeBackends: number;
+        generatedFrom: typeof TANGLE_INTEGRATIONS_CATALOG_SOURCE;
+    };
+}
+interface TangleCatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        actionId: string;
+        upstreamActionName?: string;
+    };
+}
+interface TangleCatalogTriggerInvocation {
+    connection: IntegrationConnection;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    trigger: NonNullable<IntegrationConnector['triggers']>[number];
+    targetUrl?: string;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        triggerId: string;
+        upstreamTriggerName?: string;
+    };
+}
+interface TangleCatalogExecutorProviderOptions {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: TangleCatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (invocation: TangleCatalogTriggerInvocation) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+type TangleIntegrationCatalogFreshnessOptions = IntegrationCatalogFreshnessOptions;
+interface TangleIntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        catalogEntries: number;
+        catalogConnectors: number;
+        catalogActions: number;
+        catalogTriggers: number;
+        executableCatalogConnectors: number;
+        executableCatalogActions: number;
+        executableCatalogTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['registrySummary'];
+        conflictSamples: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['conflictSamples'];
+    };
+    upstream?: {
+        externalEntries?: number;
+        externalDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare function listTangleIntegrationCatalogEntries(): TangleIntegrationCatalogEntry[];
+declare function listTangleIntegrationContracts(): TangleIntegrationContract[];
+declare function listTangleIntegrationCatalogRuntimePackages(): Array<{
+    connectorId: string;
+    packageName: string;
+    version?: string;
+}>;
+declare function buildTangleCatalogRuntimePackageManifest(options?: TangleCatalogRuntimePackageManifestOptions): TangleCatalogRuntimePackageManifest;
+declare function renderTangleCatalogRuntimePnpmAddCommand(options?: {
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+}): string;
+declare function buildTangleIntegrationCatalogConnectors(options?: {
+    providerId?: string;
+    includeCatalogActions?: boolean;
+    executable?: boolean;
+}): IntegrationConnector[];
+declare function createTangleCatalogExecutorProvider(options: TangleCatalogExecutorProviderOptions): IntegrationProvider;
+declare const extractExternalCatalogPublicCount: typeof extractActivepiecesPublicPieceCount;
+declare function auditTangleIntegrationCatalogFreshness(options?: TangleIntegrationCatalogFreshnessOptions): Promise<TangleIntegrationCatalogFreshnessResult>;
+
+interface TangleCatalogRuntimeInvocation {
+    request: TangleCatalogRuntimeRequest;
+    connection: IntegrationConnection;
+    connector: IntegrationConnector;
+    action: IntegrationConnectorAction;
+}
+interface TangleCatalogRuntimeHandlerOptions {
+    secret?: string;
+    requireSignature?: boolean;
+    signatureHeader?: string;
+    connectors?: IntegrationConnector[];
+    maxBodyBytes?: number;
+    executeAction: (invocation: TangleCatalogRuntimeInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+interface TangleCatalogInstalledPackageExecutorOptions {
+    moduleLoader?: (packageName: string) => Promise<unknown> | unknown;
+    actionAliases?: Record<string, Record<string, string>>;
+    allowFuzzyActionMatch?: boolean;
+    resolveAuth?: (connection: IntegrationConnection) => Promise<unknown> | unknown;
+    beforeRun?: (invocation: TangleCatalogRuntimeInvocation) => Promise<void> | void;
+}
+interface TangleCatalogAuthResolverOptions {
+    secrets: IntegrationSecretStore;
+    mapCredentials?: (input: {
+        connection: IntegrationConnection;
+        credentials: ConnectorCredentials;
+        connectorId: string;
+    }) => unknown;
+}
+interface TangleCatalogHttpAuthResolverOptions {
+    endpoint: string;
+    secret: string;
+    path?: string;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    requestId?: () => string;
+}
+interface TangleCatalogHttpAuthResolverRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connectorId: string;
+    connectionId: string;
+    secretRef?: IntegrationConnection['secretRef'];
+}
+interface TangleCatalogRuntimeModuleAction {
+    name?: string;
+    displayName?: string;
+    run?: (context: {
+        auth: unknown;
+        propsValue: unknown;
+        input: unknown;
+        connection: IntegrationConnection;
+        request: TangleCatalogRuntimeRequest;
+    }) => Promise<unknown> | unknown;
+}
+interface TangleCatalogRuntimeHttpRequest {
+    body: string | Uint8Array | TangleCatalogRuntimeRequest;
+    headers?: Headers | Record<string, string | string[] | undefined>;
+}
+interface TangleCatalogRuntimeHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: IntegrationActionResult | {
+        ok: false;
+        action: string;
+        output: {
+            code: string;
+            message: string;
+        };
+    };
+}
+interface TangleCatalogRuntimePackageCoverageRow {
+    connectorId: string;
+    packageName: string;
+    packageInstalled: boolean;
+    packageLoads: boolean;
+    pieceExportFound: boolean;
+    actionMappingsVerified: number;
+    actionMappingsTotal: number;
+    triggerMappingsFound: number;
+    triggerMappingsTotal: number;
+    triggerHostingSupported: boolean;
+    error?: string;
+}
+interface TangleCatalogRuntimePackageCoverageOptions {
+    connectorIds?: string[];
+    moduleLoader?: (packageName: string) => Promise<unknown> | unknown;
+}
+declare function createTangleCatalogRuntimeHandler(options: TangleCatalogRuntimeHandlerOptions): (input: TangleCatalogRuntimeHttpRequest) => Promise<TangleCatalogRuntimeHttpResponse>;
+declare function createTangleCatalogInstalledPackageExecutor(options?: TangleCatalogInstalledPackageExecutorOptions): TangleCatalogRuntimeHandlerOptions['executeAction'];
+declare function auditTangleCatalogRuntimePackages(options?: TangleCatalogRuntimePackageCoverageOptions): Promise<TangleCatalogRuntimePackageCoverageRow[]>;
+declare function createTangleCatalogCredentialAuthResolver(options: TangleCatalogAuthResolverOptions): (connection: IntegrationConnection) => Promise<unknown>;
+declare function createTangleCatalogHttpAuthResolver(options: TangleCatalogHttpAuthResolverOptions): (connection: IntegrationConnection) => Promise<unknown>;
+declare function tangleCatalogAuthValue(credentials: ConnectorCredentials): unknown;
+
+interface TangleCatalogRuntimeNodeServerOptions {
+    secret: string;
+    host?: string;
+    port?: number;
+    path?: string;
+    maxBodyBytes?: number;
+    requireSignature?: boolean;
+    authResolver?: false | TangleCatalogHttpAuthResolverOptions;
+    executor?: Omit<TangleCatalogInstalledPackageExecutorOptions, 'resolveAuth'> & {
+        resolveAuth?: TangleCatalogInstalledPackageExecutorOptions['resolveAuth'];
+    };
+    onLog?: (event: {
+        level: 'info' | 'warn' | 'error';
+        message: string;
+        metadata?: Record<string, unknown>;
+    }) => void;
+}
+interface StartedTangleCatalogRuntimeNodeServer {
+    server: Server;
+    url: string;
+    close: () => Promise<void>;
+}
+declare function createTangleCatalogRuntimeNodeRequestListener(options: TangleCatalogRuntimeNodeServerOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+declare function startTangleCatalogRuntimeNodeServer(options: TangleCatalogRuntimeNodeServerOptions): Promise<StartedTangleCatalogRuntimeNodeServer>;
+
+type IntegrationCoveragePriority = 'tier_0' | 'tier_1' | 'tier_2' | 'long_tail';
+interface IntegrationCoverageSpec {
+    id: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    auth: IntegrationConnector['auth'];
+    priority: IntegrationCoveragePriority;
+    providerKinds: IntegrationProviderKind[];
+    domains: string[];
+    actionPack: IntegrationActionPack;
+    scopes?: string[];
+}
+type IntegrationActionPack = 'email' | 'calendar' | 'chat' | 'crm' | 'storage' | 'docs' | 'database' | 'project' | 'support' | 'marketing' | 'sales' | 'commerce' | 'finance' | 'hr' | 'dev' | 'ai' | 'analytics' | 'workflow' | 'webhook';
+declare function listIntegrationCoverageSpecs(): IntegrationCoverageSpec[];
+declare function buildIntegrationCoverageConnectors(options?: {
+    providerId?: string;
+    priorities?: IntegrationCoveragePriority[];
+    categories?: IntegrationConnectorCategory[];
+    actionPacks?: IntegrationActionPack[];
+}): IntegrationConnector[];
+declare function integrationCoverageChecklistMarkdown(): string;
+
+type IntegrationAuthMode = 'oauth2' | 'api_key' | 'hmac' | 'none' | 'custom';
+type IntegrationSpecStatus = 'catalog' | 'executable' | 'deprecated';
+type IntegrationFamilyId = 'google' | 'microsoft-graph' | 'atlassian' | 'salesforce' | 'hubspot' | 'slack' | 'notion' | 'standard-oauth2' | 'api-key' | 'hmac' | 'none';
+type NormalizedPermission = `${string}.read` | `${string}.write` | `${string}.delete` | `${string}.admin`;
+interface IntegrationSpec {
+    kind: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    status: IntegrationSpecStatus;
+    family: IntegrationFamilyId;
+    auth: IntegrationAuthSpec;
+    permissions: PermissionDescriptor[];
+    actions: IntegrationConnectorAction[];
+    triggers?: IntegrationConnectorTrigger[];
+    setup: IntegrationSetupSpec;
+    lifecycle?: IntegrationLifecycleSpec;
+    plannerHints?: IntegrationPlannerHints;
+    metadata?: Record<string, unknown>;
+}
+type IntegrationAuthSpec = OAuth2AuthSpec | ApiKeyAuthSpec | HmacAuthSpec | NoneAuthSpec | CustomAuthSpec;
+interface OAuth2AuthSpec {
+    mode: 'oauth2';
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientIdEnv?: string;
+    clientSecretEnv?: string;
+    scopes: ScopeDescriptor[];
+    extraAuthParams?: Record<string, string>;
+    redirectUriTemplate: string;
+    pkce?: 'required' | 'supported' | 'unsupported';
+}
+interface ApiKeyAuthSpec {
+    mode: 'api_key';
+    credential: CredentialFieldSpec;
+    placement?: 'bearer' | 'header' | 'query' | 'basic';
+}
+interface HmacAuthSpec {
+    mode: 'hmac';
+    credential: CredentialFieldSpec;
+    signatureHeader?: string;
+}
+interface NoneAuthSpec {
+    mode: 'none';
+}
+interface CustomAuthSpec {
+    mode: 'custom';
+    description: string;
+}
+interface ScopeDescriptor {
+    normalized: NormalizedPermission;
+    providerScope: string;
+    title: string;
+    reason: string;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+}
+interface PermissionDescriptor {
+    normalized: NormalizedPermission;
+    providerScopes: string[];
+    title: string;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    reason: string;
+}
+interface CredentialFieldSpec {
+    label: string;
+    description: string;
+    env?: string;
+    example?: string;
+    regex?: string;
+    secret: boolean;
+}
+interface ConsoleStep {
+    id: string;
+    title: string;
+    detail: string;
+    copyValue?: string;
+}
+interface Quirk {
+    id: string;
+    severity: 'info' | 'warning' | 'critical';
+    message: string;
+}
+interface PostSetupCheck {
+    id: string;
+    title: string;
+    detail: string;
+}
+interface HealthcheckSpec {
+    id: string;
+    level: 'client_config' | 'connection' | 'webhook' | 'static';
+    method?: 'GET' | 'POST';
+    url?: string;
+    expectedStatus?: number[];
+    description: string;
+}
+interface IntegrationSetupSpec {
+    consoleUrl?: string;
+    consoleSteps: ConsoleStep[];
+    credentialFields: CredentialFieldSpec[];
+    redirectUriTemplate?: string;
+    knownQuirks?: Quirk[];
+    postSetup?: PostSetupCheck[];
+    healthcheck?: HealthcheckSpec;
+}
+interface IntegrationLifecycleSpec {
+    supportsRefresh: boolean;
+    supportsRevoke: boolean;
+    supportsIncrementalAuth: boolean;
+    recommendedHealthcheckIntervalHours?: number;
+    freshnessSloMinutes?: number;
+}
+interface IntegrationPlannerHints {
+    useFor: string[];
+    avoidFor?: string[];
+    dataFreshness: 'realtime' | 'near_realtime' | 'eventual' | 'manual';
+    writeRisk: 'low' | 'medium' | 'high';
+}
+interface IntegrationFamilySpec {
+    id: IntegrationFamilyId;
+    title: string;
+    authMode: IntegrationAuthMode;
+    consoleUrl?: string;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    redirectUriTemplate?: string;
+    credentialFields: CredentialFieldSpec[];
+    consoleSteps: ConsoleStep[];
+    knownQuirks?: Quirk[];
+    lifecycle: IntegrationLifecycleSpec;
+}
+interface IntegrationSpecValidationIssue {
+    path: string;
+    message: string;
+}
+interface IntegrationSpecValidationResult {
+    ok: boolean;
+    issues: IntegrationSpecValidationIssue[];
+}
+interface RenderSpecOptions {
+    host: string;
+    callbackPath?: string;
+}
+interface RenderedConsoleStep extends ConsoleStep {
+    detail: string;
+    copyValue?: string;
+}
+interface CredentialValidationInput {
+    field: CredentialFieldSpec;
+    value: string;
+}
+interface CredentialValidationResult {
+    ok: boolean;
+    field: string;
+    message?: string;
+}
+interface HealthcheckPlan {
+    kind: string;
+    healthcheck: HealthcheckSpec;
+    requires: Array<'client_id' | 'client_secret' | 'api_key' | 'hmac_secret' | 'connection_credentials'>;
+    message: string;
+}
+declare function specAuthToConnectorAuth(auth: IntegrationAuthSpec): IntegrationConnector['auth'];
+
+declare const INTEGRATION_FAMILIES: Record<IntegrationFamilyId, IntegrationFamilySpec>;
+declare function getIntegrationFamily(id: IntegrationFamilyId): IntegrationFamilySpec;
+
+declare function listIntegrationSpecs(): IntegrationSpec[];
+declare function getIntegrationSpec(kind: string): IntegrationSpec | undefined;
+declare function listExecutableIntegrationSpecs(): IntegrationSpec[];
+declare function integrationSpecToConnector(spec: IntegrationSpec, providerId?: string): IntegrationConnector;
+
+declare function renderConsoleSteps(spec: IntegrationSpec, options: RenderSpecOptions): RenderedConsoleStep[];
+declare function renderRunbookMarkdown(spec: IntegrationSpec, options: RenderSpecOptions): string;
+declare function renderAgentToolDescription(spec: IntegrationSpec): string;
+declare function buildHealthcheckPlan(spec: IntegrationSpec): HealthcheckPlan;
+declare function consoleStepsToText(steps: ConsoleStep[]): string;
+
+declare function validateIntegrationSpec(spec: IntegrationSpec): IntegrationSpecValidationResult;
+declare function assertValidIntegrationSpec(spec: IntegrationSpec): void;
+declare function validateCredentialFormat(field: CredentialFieldSpec, value: string): CredentialValidationResult;
+declare function validateCredentialSet(spec: IntegrationSpec, values: Record<string, string>): CredentialValidationResult[];
+
+type IntegrationProviderKind = 'first_party' | 'nango' | 'pipedream' | 'zapier' | 'activepieces' | 'tangle_catalog' | 'executor' | 'custom';
+type IntegrationConnectorCategory = 'email' | 'calendar' | 'chat' | 'crm' | 'storage' | 'docs' | 'database' | 'webhook' | 'workflow' | 'internal' | 'other';
+type IntegrationActionRisk = 'read' | 'write' | 'destructive';
+type IntegrationDataClass = 'public' | 'internal' | 'private' | 'sensitive' | 'secret';
+interface IntegrationActor {
+    type: 'user' | 'team' | 'app' | 'agent' | 'sandbox' | 'system';
+    id: string;
+}
+interface IntegrationConnectorAction {
+    id: string;
+    title: string;
+    risk: IntegrationActionRisk;
+    requiredScopes: string[];
+    dataClass: IntegrationDataClass;
+    description?: string;
+    approvalRequired?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+}
+interface IntegrationConnectorTrigger {
+    id: string;
+    title: string;
+    requiredScopes: string[];
+    dataClass: IntegrationDataClass;
+    description?: string;
+    payloadSchema?: unknown;
+}
+interface IntegrationConnector {
+    id: string;
+    providerId: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    auth: 'oauth2' | 'api_key' | 'none' | 'custom';
+    scopes: string[];
+    actions: IntegrationConnectorAction[];
+    triggers?: IntegrationConnectorTrigger[];
+    metadata?: Record<string, unknown>;
+}
+interface SecretRef {
+    provider: string;
+    id: string;
+    label?: string;
+}
+interface IntegrationConnection {
+    id: string;
+    owner: IntegrationActor;
+    providerId: string;
+    connectorId: string;
+    status: 'pending' | 'active' | 'expired' | 'revoked' | 'error';
+    grantedScopes: string[];
+    account?: {
+        id?: string;
+        email?: string;
+        displayName?: string;
+    };
+    secretRef?: SecretRef;
+    createdAt: string;
+    updatedAt: string;
+    expiresAt?: string;
+    lastUsedAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface StartAuthRequest {
+    connectorId: string;
+    owner: IntegrationActor;
+    requestedScopes: string[];
+    redirectUri: string;
+    state?: string;
+    metadata?: Record<string, unknown>;
+}
+interface StartAuthResult {
+    providerId: string;
+    connectorId: string;
+    authUrl: string;
+    state: string;
+    expiresAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface CompleteAuthRequest {
+    connectorId: string;
+    owner: IntegrationActor;
+    code?: string;
+    state: string;
+    redirectUri: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationActionRequest {
+    connectionId: string;
+    action: string;
+    input?: unknown;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationActionResult<T = unknown> {
+    ok: boolean;
+    action: string;
+    output?: T;
+    externalId?: string;
+    warnings?: string[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationTriggerSubscription {
+    id: string;
+    connectionId: string;
+    trigger: string;
+    targetUrl?: string;
+    status: 'active' | 'paused' | 'error';
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationTriggerEvent<T = unknown> {
+    id: string;
+    providerId: string;
+    connectorId: string;
+    connectionId: string;
+    trigger: string;
+    occurredAt: string;
+    payload: T;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationProvider {
+    id: string;
+    kind: IntegrationProviderKind;
+    listConnectors(): Promise<IntegrationConnector[]> | IntegrationConnector[];
+    startAuth?(request: StartAuthRequest): Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?(request: CompleteAuthRequest): Promise<IntegrationConnection> | IntegrationConnection;
+    invokeAction(connection: IntegrationConnection, request: IntegrationActionRequest): Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?(connection: IntegrationConnection, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?(subscriptionId: string): Promise<void> | void;
+    normalizeTriggerEvent?(raw: unknown): Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+interface IntegrationConnectionStore {
+    get(connectionId: string): Promise<IntegrationConnection | undefined> | IntegrationConnection | undefined;
+    put(connection: IntegrationConnection): Promise<void> | void;
+    listByOwner(owner: IntegrationActor): Promise<IntegrationConnection[]> | IntegrationConnection[];
+    delete?(connectionId: string): Promise<void> | void;
+}
+interface IssueCapabilityRequest {
+    subject: IntegrationActor;
+    connectionId: string;
+    scopes: string[];
+    allowedActions: string[];
+    ttlMs: number;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationCapability {
+    id: string;
+    subject: IntegrationActor;
+    connectionId: string;
+    scopes: string[];
+    allowedActions: string[];
+    issuedAt: string;
+    expiresAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IssuedIntegrationCapability {
+    capability: IntegrationCapability;
+    token: string;
+}
+/**
+ * Wraps every action invocation with cross-cutting discipline (idempotency,
+ * conflict detection, rate-limiting, audit logging). Optional. When set on
+ * the hub, runs BEFORE provider.invokeAction; can short-circuit (return a
+ * result directly) or pass through (call `proceed()` to invoke the provider).
+ *
+ * Why this hook exists: production deployments need conflict-resolution
+ * guarantees that span every provider, gateway, and webhook receiver. The
+ * canonical implementation is a "MutationGuard" that:
+ *   1. Short-circuits on a known idempotency key (returns recorded response).
+ *   2. Refuses same-key-different-args (drift detection).
+ *   3. Wraps `proceed()` and audit-logs the outcome.
+ *   4. Translates upstream conflict signals into a structured result with
+ *      alternatives the agent can act on.
+ *
+ * Implementations live in consumers (every product has different
+ * persistence + telemetry needs); this interface is the contract.
+ */
+interface IntegrationActionGuard {
+    /** Wrap an invokeAction call. Implementations MUST call `proceed()` to
+     *  invoke the underlying provider unless they're returning a cached or
+     *  short-circuited result.
+     *
+     *  @param ctx connection + request the hub is about to dispatch
+     *  @param proceed call to invoke the wrapped provider; returns the
+     *                 underlying IntegrationActionResult
+     *  @returns the result the hub should return to the caller
+     */
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+}
+interface IntegrationGuardContext {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    /** The action descriptor from the connector manifest, if discovered. */
+    action?: IntegrationConnectorAction;
+}
+type IntegrationPolicyDecision = {
+    decision: 'allow';
+    reason: string;
+    metadata?: Record<string, unknown>;
+} | {
+    decision: 'require_approval';
+    reason: string;
+    approval: IntegrationApprovalRequest;
+    metadata?: Record<string, unknown>;
+} | {
+    decision: 'deny';
+    reason: string;
+    metadata?: Record<string, unknown>;
+};
+interface IntegrationApprovalRequest {
+    id: string;
+    connectionId: string;
+    providerId: string;
+    connectorId: string;
+    action: string;
+    actor: IntegrationActor;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    reason: string;
+    requestedAt: string;
+    inputPreview?: unknown;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationPolicyEngine {
+    decide(ctx: IntegrationGuardContext & {
+        subject: IntegrationActor;
+    }): Promise<IntegrationPolicyDecision> | IntegrationPolicyDecision;
+}
+interface IntegrationHubOptions {
+    providers: IntegrationProvider[];
+    store: IntegrationConnectionStore;
+    capabilitySecret: string;
+    /** Optional cross-cutting guard. If provided, every invokeAction call
+     *  passes through it before reaching the provider. See {@link IntegrationActionGuard}. */
+    guard?: IntegrationActionGuard;
+    /** Optional policy engine. Runs after capability/scope checks and before
+     *  provider invocation. Use it to pause writes, deny destructive actions,
+     *  or apply tenant-specific allow rules. */
+    policy?: IntegrationPolicyEngine;
+    now?: () => Date;
+}
+interface HttpIntegrationProviderOptions {
+    id: string;
+    kind?: IntegrationProviderKind;
+    connectors: IntegrationConnector[];
+    baseUrl: string;
+    bearer?: string;
+    fetchImpl?: typeof fetch;
+}
+interface InvokeWithCapabilityRequest extends Omit<IntegrationActionRequest, 'connectionId'> {
+    connectionId?: never;
+}
+declare class IntegrationError extends Error {
+    readonly code: 'provider_not_found' | 'connector_not_found' | 'connection_not_found' | 'connection_not_active' | 'auth_not_supported' | 'capability_invalid' | 'capability_expired' | 'scope_denied' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'approval_required' | 'policy_denied';
+    constructor(message: string, code: 'provider_not_found' | 'connector_not_found' | 'connection_not_found' | 'connection_not_active' | 'auth_not_supported' | 'capability_invalid' | 'capability_expired' | 'scope_denied' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'approval_required' | 'policy_denied');
+}
+declare class InMemoryConnectionStore implements IntegrationConnectionStore {
+    private readonly connections;
+    get(connectionId: string): IntegrationConnection | undefined;
+    put(connection: IntegrationConnection): void;
+    listByOwner(owner: IntegrationActor): IntegrationConnection[];
+    delete(connectionId: string): void;
+}
+declare class IntegrationHub {
+    private readonly providers;
+    private readonly store;
+    private readonly capabilitySecret;
+    private readonly guard;
+    private readonly policy;
+    private readonly now;
+    constructor(options: IntegrationHubOptions);
+    listConnectors(): Promise<IntegrationConnector[]>;
+    listRegistry(options?: ComposeIntegrationRegistryOptions): Promise<IntegrationRegistry>;
+    startAuth(providerId: string, request: StartAuthRequest): Promise<StartAuthResult>;
+    completeAuth(providerId: string, request: CompleteAuthRequest): Promise<IntegrationConnection>;
+    upsertConnection(connection: IntegrationConnection): Promise<IntegrationConnection>;
+    listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]>;
+    issueCapability(request: IssueCapabilityRequest): Promise<IssuedIntegrationCapability>;
+    verifyCapability(token: string): IntegrationCapability;
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult>;
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription>;
+    private requireProvider;
+    private requireConnector;
+    private requireConnection;
+    private assertConnectionActive;
+}
+declare function sanitizeConnection(connection: IntegrationConnection): Record<string, unknown>;
+declare function createMockIntegrationProvider(options?: {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    onInvoke?: (connection: IntegrationConnection, request: IntegrationActionRequest) => IntegrationActionResult | Promise<IntegrationActionResult>;
+}): IntegrationProvider;
+declare function createHttpIntegrationProvider(options: HttpIntegrationProviderOptions): IntegrationProvider;
+declare function signCapability(capability: IntegrationCapability, secret: string): string;
+declare function verifyCapabilityToken(token: string, secret: string): IntegrationCapability;
+
+export { type IntegrationFamilyId as $, type TangleCatalogRuntimeHttpRequest as A, type TangleCatalogRuntimeHttpResponse as B, type TangleCatalogRuntimeInvocation as C, type ComposeIntegrationRegistryOptions, type TangleCatalogRuntimeModuleAction as D, type TangleCatalogRuntimePackageCoverageOptions as E, type TangleCatalogRuntimePackageCoverageRow as F, auditTangleCatalogRuntimePackages as G, createTangleCatalogCredentialAuthResolver as H, type IntegrationToolDefinition as I, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, createTangleCatalogHttpAuthResolver as J, createTangleCatalogInstalledPackageExecutor as K, createTangleCatalogRuntimeHandler as L, type McpToolDefinition as M, tangleCatalogAuthValue as N, type ApiKeyAuthSpec as O, type ConsoleStep as P, type CredentialFieldSpec as Q, type CredentialValidationInput as R, type CredentialValidationResult as S, type TangleCatalogAuthResolverOptions as T, type CustomAuthSpec as U, type HealthcheckPlan as V, type HealthcheckSpec as W, type HmacAuthSpec as X, INTEGRATION_FAMILIES as Y, type IntegrationAuthMode as Z, type IntegrationAuthSpec as _, type IntegrationToolSearchFilters as a, InMemoryIntegrationApprovalStore as a$, type IntegrationFamilySpec as a0, type IntegrationLifecycleSpec as a1, type IntegrationPlannerHints as a2, type IntegrationSetupSpec as a3, type IntegrationSpec as a4, type IntegrationSpecStatus as a5, type IntegrationSpecValidationIssue as a6, type IntegrationSpecValidationResult as a7, type NoneAuthSpec as a8, type NormalizedPermission as a9, type ActivepiecesCatalogEntry as aA, type ActivepiecesExecutorInvocation as aB, type ActivepiecesExecutorProviderOptions as aC, type ActivepiecesHttpExecutorOptions as aD, type ActivepiecesPieceOverride as aE, type ActivepiecesRuntimeRequest as aF, ApprovalBackedPolicyEngine as aG, type ApprovalBackedPolicyOptions as aH, CANONICAL_INTEGRATION_ACTIONS as aI, type CanonicalIntegrationActionId as aJ, type CanonicalLaunchConnectorOptions as aK, type CatalogExecutorInvocation as aL, type CatalogExecutorProviderOptions as aM, type CompleteAuthRequest as aN, type ConnectionCredentialResolverOptions as aO, type ConnectorAdapterProviderOptions as aP, type ConsentSummary as aQ, DEFAULT_INTEGRATION_BRIDGE_ENV as aR, DefaultIntegrationActionGuard as aS, type GatewayCatalogAction as aT, type GatewayCatalogEntry as aU, type GatewayCatalogProviderOptions as aV, type GatewayCatalogTrigger as aW, type GraphqlOperationSpec as aX, type HttpIntegrationProviderOptions as aY, type ImportCatalogOptions as aZ, InMemoryConnectionStore as a_, type OAuth2AuthSpec as aa, type PermissionDescriptor as ab, type PostSetupCheck as ac, type Quirk as ad, type RenderSpecOptions as ae, type RenderedConsoleStep as af, type ScopeDescriptor as ag, assertValidIntegrationSpec as ah, buildHealthcheckPlan as ai, consoleStepsToText as aj, getIntegrationFamily as ak, getIntegrationSpec as al, integrationSpecToConnector as am, listExecutableIntegrationSpecs as an, listIntegrationSpecs as ao, renderAgentToolDescription as ap, renderConsoleSteps as aq, renderRunbookMarkdown as ar, specAuthToConnectorAuth as as, validateCredentialFormat as at, validateCredentialSet as au, validateIntegrationSpec as av, ACTIVEPIECES_OVERRIDES as aw, ACTIVEPIECES_PUBLIC_CATALOG_URL as ax, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as ay, type ActivepiecesCatalogAuthField as az, type IntegrationToolSearchResult as b, type IntegrationSandboxHostHub as b$, InMemoryIntegrationAuditStore as b0, InMemoryIntegrationEventStore as b1, InMemoryIntegrationHealthcheckStore as b2, InMemoryIntegrationIdempotencyStore as b3, InMemoryIntegrationSecretStore as b4, InMemoryIntegrationWorkflowStore as b5, type InferIntegrationRequirementsOptions as b6, type InstalledIntegrationWorkflow as b7, type IntegrationActionGuard as b8, type IntegrationActionPack as b9, type IntegrationCoveragePriority as bA, type IntegrationCoverageSpec as bB, type IntegrationDataClass as bC, IntegrationError as bD, type IntegrationErrorCode as bE, type IntegrationEventStore as bF, type IntegrationGuardContext as bG, type IntegrationHealthcheckCheck as bH, type IntegrationHealthcheckResult as bI, type IntegrationHealthcheckStatus as bJ, type IntegrationHealthcheckStore as bK, IntegrationHub as bL, type IntegrationHubOptions as bM, type IntegrationIdempotencyRecord as bN, type IntegrationIdempotencyStore as bO, type IntegrationInvocationEnvelope as bP, type IntegrationInvocationEnvelopeValidationOptions as bQ, type IntegrationPolicyDecision as bR, type IntegrationPolicyEffect as bS, type IntegrationPolicyEngine as bT, type IntegrationPolicyRule as bU, type IntegrationProvider as bV, type IntegrationProviderKind as bW, type IntegrationRateLimitDecision as bX, type IntegrationRateLimiter as bY, IntegrationRuntimeError as bZ, IntegrationSandboxHost as b_, type IntegrationActionRequest as ba, type IntegrationActionResult as bb, type IntegrationActionRisk as bc, type IntegrationActor as bd, type IntegrationApprovalFilter as be, type IntegrationApprovalRecord as bf, type IntegrationApprovalRequest as bg, type IntegrationApprovalResolution as bh, type IntegrationApprovalStatus as bi, type IntegrationApprovalStore as bj, type IntegrationAuditEvent as bk, type IntegrationAuditEventType as bl, type IntegrationAuditFilter as bm, type IntegrationAuditSink as bn, type IntegrationAuditStore as bo, type IntegrationBridgePayload as bp, type IntegrationBridgeToolBinding as bq, type IntegrationCapability as br, type IntegrationCatalogFreshnessOptions as bs, type IntegrationCatalogFreshnessResult as bt, type IntegrationConnection as bu, buildDefaultIntegrationRegistry, type IntegrationConnectionStore as bv, type IntegrationConnector as bw, type IntegrationConnectorAction as bx, type IntegrationConnectorCategory as by, type IntegrationConnectorTrigger as bz, buildIntegrationToolCatalog as c, buildActivepiecesConnectors as c$, type IntegrationSandboxHostOptions as c0, type IntegrationSecretStore as c1, type IntegrationTriggerEvent as c2, type IntegrationTriggerSubscription as c3, type IntegrationUserAction as c4, type IntegrationWebhookReceiverResult as c5, type IntegrationWorkflowDefinition as c6, IntegrationWorkflowRuntime as c7, type IntegrationWorkflowRuntimeHub as c8, type IntegrationWorkflowRuntimeOptions as c9, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cA, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cB, type TangleCatalogExecutorInvocation as cC, type TangleCatalogExecutorProviderOptions as cD, type TangleCatalogHttpExecutorInvocation as cE, type TangleCatalogHttpExecutorOptions as cF, type TangleCatalogRuntimeActionRequest as cG, type TangleCatalogRuntimeNodeServerOptions as cH, type TangleCatalogRuntimePackageManifest as cI, type TangleCatalogRuntimePackageManifestOptions as cJ, type TangleCatalogRuntimePiece as cK, type TangleCatalogRuntimeRequest as cL, type TangleCatalogTriggerInvocation as cM, type TangleIntegrationCatalogEntry as cN, type TangleIntegrationCatalogFreshnessOptions as cO, type TangleIntegrationCatalogFreshnessResult as cP, type TangleIntegrationContract as cQ, type TangleIntegrationContractStatus as cR, type TangleIntegrationImplementationKind as cS, type TangleIntegrationInvokeInput as cT, type TangleIntegrationInvokeResult as cU, TangleIntegrationsClient as cV, type TangleIntegrationsClientOptions as cW, adapterManifestsToConnectors as cX, assertValidIntegrationManifest as cY, auditIntegrationCatalogFreshness as cZ, auditTangleIntegrationCatalogFreshness as c_, type IntegrationWorkflowStore as ca, canonicalConnectorId, type InvokeWithCapabilityRequest as cb, type IssueCapabilityRequest as cc, type IssuedIntegrationCapability as cd, type ManifestValidationIssue as ce, type ManifestValidationResult as cf, type McpCatalog as cg, type McpCatalogTool as ch, type MissingRequirementExplanation as ci, type NormalizedIntegrationError as cj, type NormalizedIntegrationResult as ck, type OpenApiDocument as cl, type OpenApiOperation as cm, PROVIDER_PASSTHROUGH_ACTION as cn, type PlatformIntegrationPolicyPresetOptions as co, composeIntegrationRegistry, type ProviderHttpRequestInput as cp, type ProviderPassthroughPolicy as cq, type RenderConsentOptions as cr, type SecretRef as cs, type StartAuthRequest as ct, type StartAuthResult as cu, type StartedTangleCatalogRuntimeNodeServer as cv, StaticIntegrationPolicyEngine as cw, type StaticIntegrationPolicyOptions as cx, type StoredIntegrationEvent as cy, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as cz, InMemoryIntegrationGrantStore as d, renderApprovalCopy as d$, buildActivepiecesRuntimeRequest as d0, buildApprovalRequest as d1, buildCanonicalLaunchConnectors as d2, buildIntegrationBridgeEnvironment as d3, buildIntegrationBridgePayload as d4, buildIntegrationCoverageConnectors as d5, buildIntegrationInvocationEnvelope as d6, buildTangleCatalogRuntimePackageManifest as d7, buildTangleCatalogRuntimeRequest as d8, buildTangleIntegrationCatalogConnectors as d9, encodeIntegrationBridgePayload as dA, explainMissingRequirements as dB, extractActivepiecesPublicPieceCount as dC, extractExternalCatalogPublicCount as dD, getActivepiecesOverride as dE, healthcheckRequest as dF, importGraphqlConnector as dG, importMcpConnector as dH, importOpenApiConnector as dI, inferIntegrationManifestFromTools as dJ, integrationCoverageChecklistMarkdown as dK, invocationRequestFromEnvelope as dL, listActivepiecesCatalogEntries as dM, listIntegrationCoverageSpecs as dN, listTangleIntegrationCatalogEntries as dO, listTangleIntegrationCatalogRuntimePackages as dP, listTangleIntegrationContracts as dQ, manifestToConnector as dR, normalizeGatewayCatalog as dS, normalizeIntegrationError as dT, normalizeIntegrationResult as dU, parseIntegrationBridgeEnvironment as dV, receiveIntegrationWebhook as dW, redactApprovalRequest as dX, redactCapability as dY, redactIntegrationBridgePayload as dZ, redactInvocationEnvelope as d_, calendarExercisePlannerManifest as da, canonicalActionConnectorId as db, createActivepiecesExecutorProvider as dc, createActivepiecesHttpExecutor as dd, createApprovalBackedPolicyEngine as de, createAuditingActionGuard as df, createCatalogExecutorProvider as dg, createConnectionCredentialResolver as dh, createConnectorAdapterCatalogSource as di, createConnectorAdapterProvider as dj, createCredentialBackedAdapterProvider as dk, createDefaultIntegrationActionGuard as dl, createDefaultIntegrationPolicyEngine as dm, createGatewayCatalogProvider as dn, createHttpIntegrationProvider as dp, createIntegrationAuditEvent as dq, createIntegrationWorkflowRuntime as dr, createMockIntegrationProvider as ds, createPlatformIntegrationPolicyPreset as dt, createTangleCatalogExecutorProvider as du, createTangleCatalogHttpExecutor as dv, createTangleCatalogRuntimeNodeRequestListener as dw, createTangleIntegrationsClient as dx, decodeIntegrationBridgePayload as dy, dispatchIntegrationInvocation as dz, type IntegrationCapabilityBinding as e, renderConsentSummary as e0, renderTangleCatalogRuntimePnpmAddCommand as e1, resolveConnectionCredentials as e2, resolveIntegrationApproval as e3, revokeConnection as e4, runIntegrationHealthcheck as e5, runIntegrationHealthchecks as e6, sanitizeAuditConnection as e7, sanitizeConnection as e8, signActivepiecesRuntimeRequest as e9, signCapability as ea, signTangleCatalogRuntimeRequest as eb, startTangleCatalogRuntimeNodeServer as ec, statusForCode as ed, storedEventToTriggerEvent as ee, validateIntegrationInvocationEnvelope as ef, validateIntegrationManifest as eg, validateProviderPassthroughRequest as eh, verifyActivepiecesRuntimeSignature as ei, verifyCapabilityToken as ej, verifyTangleCatalogRuntimeSignature as ek, type IntegrationGrant as f, type IntegrationGrantStore as g, type IntegrationManifest as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationManifestResolution as j, type IntegrationRequirement as k, type IntegrationRequirementMode as l, type IntegrationRequirementResolution as m, type IntegrationRequirementStatus as n, IntegrationRuntime as o, parseIntegrationToolName as p, type IntegrationRuntimeHub as q, type IntegrationRuntimeOptions as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationSandboxBundle as u, createIntegrationRuntime as v, type TangleCatalogHttpAuthResolverOptions as w, type TangleCatalogHttpAuthResolverRequest as x, type TangleCatalogInstalledPackageExecutorOptions as y, type TangleCatalogRuntimeHandlerOptions as z };