@tangle-network/agent-integrations 0.25.2 → 0.25.4

package/dist/registry.d.ts

@@ -0,0 +1,1982 @@
+import { C as ConnectorAdapter, R as ResolvedDataSource, a as ConnectorCredentials } from './index-BNb1A0Id.js';
+import './connectors/index.js';
+import { Server, IncomingMessage, ServerResponse } from 'node:http';
+
+type IntegrationSupportTier = 'catalogOnly' | 'setupReady' | 'gatewayExecutable' | 'firstPartyExecutable' | 'sandboxExecutable';
+interface IntegrationCatalogSource {
+    id: string;
+    connectors: IntegrationConnector[];
+    precedence?: number;
+}
+interface IntegrationRegistrySourceRef {
+    sourceId: string;
+    providerId: string;
+    connectorId: string;
+    supportTier: IntegrationSupportTier;
+    actionCount: number;
+    triggerCount: number;
+}
+interface IntegrationRegistryConflict {
+    field: 'auth' | 'category';
+    values: Array<{
+        value: string;
+        sourceId: string;
+        connectorId: string;
+    }>;
+}
+interface IntegrationRegistryEntry {
+    canonicalId: string;
+    connector: IntegrationConnector;
+    aliases: string[];
+    supportTier: IntegrationSupportTier;
+    sources: IntegrationRegistrySourceRef[];
+    conflicts: IntegrationRegistryConflict[];
+}
+interface IntegrationRegistry {
+    entries: IntegrationRegistryEntry[];
+    connectors: IntegrationConnector[];
+    byId: Map<string, IntegrationRegistryEntry>;
+}
+interface IntegrationRegistrySummary {
+    totalEntries: number;
+    totalSources: number;
+    toolBindableEntries: number;
+    conflictEntries: number;
+    bySupportTier: Record<IntegrationSupportTier, number>;
+}
+interface ComposeIntegrationRegistryOptions {
+    aliases?: Record<string, string>;
+    sourcePrecedence?: Record<string, number>;
+}
+declare function buildDefaultIntegrationRegistry(options?: {
+    includeSpecs?: boolean;
+    includeTangleCatalog?: boolean;
+    tangleCatalogRuntimeExecutable?: boolean;
+    /** @deprecated Use includeTangleCatalog. */
+    includeActivepieces?: boolean;
+}): IntegrationRegistry;
+declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
+declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
+declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
+declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
+
+type IntegrationAuditEventType = 'connection.created' | 'connection.updated' | 'connection.revoked' | 'grant.created' | 'grant.revoked' | 'capability.issued' | 'action.invoked' | 'action.failed' | 'trigger.subscribed' | 'trigger.received' | 'workflow.installed' | 'approval.requested' | 'approval.resolved' | 'healthcheck.completed';
+interface IntegrationAuditEvent {
+    id: string;
+    type: IntegrationAuditEventType;
+    occurredAt: string;
+    actor?: IntegrationActor;
+    connectionId?: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    risk?: IntegrationConnectorAction['risk'];
+    dataClass?: IntegrationDataClass;
+    ok?: boolean;
+    message?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationAuditSink {
+    record(event: IntegrationAuditEvent): Promise<void> | void;
+}
+interface IntegrationAuditStore extends IntegrationAuditSink {
+    list(filter?: IntegrationAuditFilter): Promise<IntegrationAuditEvent[]> | IntegrationAuditEvent[];
+}
+interface IntegrationAuditFilter {
+    type?: IntegrationAuditEventType;
+    actor?: IntegrationActor;
+    connectionId?: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+}
+declare class InMemoryIntegrationAuditStore implements IntegrationAuditStore {
+    private readonly events;
+    record(event: IntegrationAuditEvent): void;
+    list(filter?: IntegrationAuditFilter): IntegrationAuditEvent[];
+}
+declare function createIntegrationAuditEvent(input: Omit<IntegrationAuditEvent, 'id' | 'occurredAt'> & {
+    id?: string;
+    occurredAt?: string | Date;
+    now?: () => Date;
+}): IntegrationAuditEvent;
+declare function createAuditingActionGuard(options: {
+    sink: IntegrationAuditSink;
+    subject?: IntegrationActor;
+    now?: () => Date;
+    includeInputPreview?: boolean;
+}): IntegrationActionGuard;
+declare function sanitizeAuditConnection(connection: IntegrationConnection): Record<string, unknown>;
+
+type IntegrationApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired';
+interface IntegrationApprovalRecord {
+    id: string;
+    request: IntegrationApprovalRequest;
+    status: IntegrationApprovalStatus;
+    requestedAt: string;
+    resolvedAt?: string;
+    resolvedBy?: IntegrationActor;
+    reason?: string;
+    expiresAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationApprovalStore {
+    get(approvalId: string): Promise<IntegrationApprovalRecord | undefined> | IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): Promise<void> | void;
+    list(filter?: IntegrationApprovalFilter): Promise<IntegrationApprovalRecord[]> | IntegrationApprovalRecord[];
+}
+interface IntegrationApprovalFilter {
+    status?: IntegrationApprovalStatus;
+    connectionId?: string;
+    connectorId?: string;
+    action?: string;
+    actor?: IntegrationActor;
+}
+interface ApprovalBackedPolicyOptions {
+    base: IntegrationPolicyEngine;
+    store: IntegrationApprovalStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    approvalTtlMs?: number;
+}
+declare class InMemoryIntegrationApprovalStore implements IntegrationApprovalStore {
+    private readonly records;
+    get(approvalId: string): IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): void;
+    list(filter?: IntegrationApprovalFilter): IntegrationApprovalRecord[];
+}
+declare class ApprovalBackedPolicyEngine implements IntegrationPolicyEngine {
+    private readonly base;
+    private readonly store;
+    private readonly audit;
+    private readonly now;
+    private readonly approvalTtlMs;
+    constructor(options: ApprovalBackedPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: IntegrationActor;
+    }): Promise<IntegrationPolicyDecision>;
+    private findApprovedRecord;
+}
+declare function createApprovalBackedPolicyEngine(options: ApprovalBackedPolicyOptions): ApprovalBackedPolicyEngine;
+declare function resolveIntegrationApproval(input: {
+    store: IntegrationApprovalStore;
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: IntegrationActor;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationApprovalRecord>;
+
+declare const CANONICAL_INTEGRATION_ACTIONS: {
+    readonly googleCalendarEventsList: "google-calendar.events.list";
+    readonly googleCalendarEventsCreate: "google-calendar.events.create";
+    readonly gmailMessagesSearch: "gmail.messages.search";
+    readonly gmailMessagesSend: "gmail.messages.send";
+    readonly googleDriveFilesSearch: "google-drive.files.search";
+    readonly googleDriveFilesRead: "google-drive.files.read";
+    readonly githubRepositoriesGet: "github.repositories.get";
+    readonly githubIssuesSearch: "github.issues.search";
+    readonly githubIssuesCreate: "github.issues.create";
+    readonly githubPullRequestsComment: "github.pull-requests.comment";
+    readonly slackChannelsList: "slack.channels.list";
+    readonly slackMessagesSearch: "slack.messages.search";
+    readonly slackMessagesPost: "slack.messages.post";
+    readonly providerHttpRequest: "provider.http.request";
+};
+type CanonicalIntegrationActionId = typeof CANONICAL_INTEGRATION_ACTIONS[keyof typeof CANONICAL_INTEGRATION_ACTIONS];
+interface CanonicalLaunchConnectorOptions {
+    providerId?: string;
+    includeProviderPassthrough?: boolean;
+}
+declare function buildCanonicalLaunchConnectors(options?: CanonicalLaunchConnectorOptions): IntegrationConnector[];
+declare function canonicalActionConnectorId(actionId: string): string | undefined;
+
+interface IntegrationToolDefinition {
+    name: string;
+    title: string;
+    description: string;
+    providerId: string;
+    connectorId: string;
+    connectorTitle: string;
+    category: IntegrationConnectorCategory;
+    action: IntegrationConnectorAction;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    requiredScopes: string[];
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    tags: string[];
+}
+interface IntegrationToolSearchFilters {
+    providerId?: string;
+    connectorId?: string;
+    category?: IntegrationConnectorCategory;
+    maxRisk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+    limit?: number;
+}
+interface IntegrationToolSearchResult {
+    tool: IntegrationToolDefinition;
+    score: number;
+    matched: string[];
+}
+interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+}
+declare function integrationToolName(providerId: string, connectorId: string, actionId: string): string;
+declare function parseIntegrationToolName(name: string): {
+    providerId: string;
+    connectorId: string;
+    actionId: string;
+};
+declare function buildIntegrationToolCatalog(connectors: IntegrationConnector[]): IntegrationToolDefinition[];
+declare function searchIntegrationTools(catalog: IntegrationToolDefinition[], query: string, filters?: IntegrationToolSearchFilters): IntegrationToolSearchResult[];
+declare function toMcpTools(tools: IntegrationToolDefinition[]): McpToolDefinition[];
+
+type IntegrationRequirementMode = 'read' | 'write' | 'trigger';
+type IntegrationRequirementStatus = 'ready' | 'missing_connection' | 'not_executable' | 'unknown_connector';
+interface IntegrationRequirement {
+    id: string;
+    connectorId: string;
+    reason: string;
+    mode: IntegrationRequirementMode;
+    requiredActions?: string[];
+    requiredTriggers?: string[];
+    requiredScopes?: string[];
+    optional?: boolean;
+}
+interface IntegrationManifest {
+    id: string;
+    title?: string;
+    owner?: IntegrationActor;
+    requirements: IntegrationRequirement[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationRequirementResolution {
+    requirement: IntegrationRequirement;
+    status: IntegrationRequirementStatus;
+    connector?: IntegrationConnector;
+    registryEntry?: IntegrationRegistryEntry;
+    connection?: IntegrationConnection;
+    missingScopes: string[];
+    missingActions: string[];
+    missingTriggers: string[];
+    message: string;
+}
+interface IntegrationManifestResolution {
+    manifest: IntegrationManifest;
+    owner: IntegrationActor;
+    ready: IntegrationRequirementResolution[];
+    missing: IntegrationRequirementResolution[];
+    optionalMissing: IntegrationRequirementResolution[];
+}
+interface IntegrationGrant {
+    id: string;
+    manifestId: string;
+    requirementId: string;
+    owner: IntegrationActor;
+    grantee: IntegrationActor;
+    connectionId: string;
+    connectorId: string;
+    scopes: string[];
+    allowedActions: string[];
+    allowedTriggers: string[];
+    status: 'active' | 'revoked';
+    createdAt: string;
+    updatedAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationGrantStore {
+    get(grantId: string): Promise<IntegrationGrant | undefined> | IntegrationGrant | undefined;
+    put(grant: IntegrationGrant): Promise<void> | void;
+    listByManifest(manifestId: string, grantee?: IntegrationActor): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    listByGrantee(grantee: IntegrationActor): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    listByIds?(grantIds: string[]): Promise<IntegrationGrant[]> | IntegrationGrant[];
+    delete?(grantId: string): Promise<void> | void;
+}
+interface IntegrationCapabilityBinding {
+    requirementId: string;
+    connectorId: string;
+    connectionId: string;
+    grantId: string;
+    scopes: string[];
+    allowedActions: string[];
+    allowedTriggers: string[];
+    capability: IssuedIntegrationCapability;
+}
+interface IntegrationSandboxBundle {
+    manifestId: string;
+    subject: IntegrationActor;
+    capabilities: IntegrationCapabilityBinding[];
+    connectors: IntegrationConnector[];
+    tools: IntegrationToolDefinition[];
+    expiresAt: string;
+}
+interface IntegrationRuntimeHub {
+    listRegistry(): Promise<IntegrationRegistry> | IntegrationRegistry;
+    listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]> | IntegrationConnection[];
+    issueCapability(input: {
+        subject: IntegrationActor;
+        connectionId: string;
+        scopes: string[];
+        allowedActions: string[];
+        ttlMs: number;
+        metadata?: Record<string, unknown>;
+    }): Promise<IssuedIntegrationCapability> | IssuedIntegrationCapability;
+}
+interface IntegrationRuntimeOptions {
+    hub: IntegrationRuntimeHub;
+    grants?: IntegrationGrantStore;
+    now?: () => Date;
+}
+declare class InMemoryIntegrationGrantStore implements IntegrationGrantStore {
+    private readonly grants;
+    get(grantId: string): IntegrationGrant | undefined;
+    put(grant: IntegrationGrant): void;
+    listByManifest(manifestId: string, grantee?: IntegrationActor): IntegrationGrant[];
+    listByGrantee(grantee: IntegrationActor): IntegrationGrant[];
+    listByIds(grantIds: string[]): IntegrationGrant[];
+    delete(grantId: string): void;
+}
+declare class IntegrationRuntime {
+    private readonly hub;
+    private readonly grants;
+    private readonly now;
+    constructor(options: IntegrationRuntimeOptions);
+    registry(): Promise<IntegrationRegistry>;
+    resolveManifest(manifest: IntegrationManifest, owner: IntegrationActor): Promise<IntegrationManifestResolution>;
+    createGrants(input: {
+        manifest: IntegrationManifest;
+        owner: IntegrationActor;
+        grantee: IntegrationActor;
+        metadata?: Record<string, unknown>;
+    }): Promise<IntegrationGrant[]>;
+    buildSandboxBundle(input: {
+        manifestId?: string;
+        grantIds?: string[];
+        subject: IntegrationActor;
+        ttlMs: number;
+        grantee?: IntegrationActor;
+    }): Promise<IntegrationSandboxBundle>;
+    private resolveBundleGrants;
+}
+declare function createIntegrationRuntime(options: IntegrationRuntimeOptions): IntegrationRuntime;
+
+declare const DEFAULT_INTEGRATION_BRIDGE_ENV = "TANGLE_INTEGRATION_BUNDLE";
+interface IntegrationBridgePayload {
+    version: 1;
+    manifestId: string;
+    subject: IntegrationSandboxBundle['subject'];
+    expiresAt: string;
+    tools: IntegrationBridgeToolBinding[];
+}
+interface IntegrationBridgeToolBinding {
+    name: string;
+    title: string;
+    connectorId: string;
+    connectionId: string;
+    action: string;
+    risk: string;
+    dataClass: string;
+    requiredScopes: string[];
+    capabilityToken: string;
+}
+declare function buildIntegrationBridgePayload(bundle: IntegrationSandboxBundle): IntegrationBridgePayload;
+declare function encodeIntegrationBridgePayload(payload: IntegrationBridgePayload): string;
+declare function decodeIntegrationBridgePayload(encoded: string): IntegrationBridgePayload;
+declare function buildIntegrationBridgeEnvironment(bundle: IntegrationSandboxBundle, options?: {
+    envVar?: string;
+}): Record<string, string>;
+declare function parseIntegrationBridgeEnvironment(env: Record<string, string | undefined>, options?: {
+    envVar?: string;
+}): IntegrationBridgePayload;
+declare function redactIntegrationBridgePayload(payload: IntegrationBridgePayload): IntegrationBridgePayload;
+
+interface TangleIntegrationsClientOptions {
+    endpoint: string;
+    bridge?: IntegrationBridgePayload;
+    env?: Record<string, string | undefined>;
+    envVar?: string;
+    fetchImpl?: typeof fetch;
+    getCapabilityToken?: (tool: IntegrationBridgeToolBinding) => string | Promise<string>;
+}
+interface TangleIntegrationInvokeInput<TInput = unknown> {
+    tool: string;
+    input?: TInput;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface TangleIntegrationInvokeResult<TOutput = unknown> {
+    status: 'ok' | 'approval_required' | 'failed';
+    action: string;
+    output?: TOutput;
+    approval?: unknown;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class TangleIntegrationsClient {
+    private readonly endpoint;
+    private readonly bridge;
+    private readonly fetchImpl;
+    private readonly getCapabilityToken;
+    constructor(options: TangleIntegrationsClientOptions);
+    tools(): IntegrationBridgeToolBinding[];
+    findTool(toolOrAction: string): IntegrationBridgeToolBinding;
+    invoke<TOutput = unknown, TInput = unknown>(input: TangleIntegrationInvokeInput<TInput>): Promise<TangleIntegrationInvokeResult<TOutput>>;
+}
+declare function createTangleIntegrationsClient(options: TangleIntegrationsClientOptions): TangleIntegrationsClient;
+
+interface ConsentSummary {
+    title: string;
+    body: string;
+    bullets: string[];
+    primaryAction: string;
+    risk: 'read' | 'write' | 'destructive';
+    connectorIds: string[];
+}
+interface RenderConsentOptions {
+    appName?: string;
+    connectors?: IntegrationConnector[];
+}
+declare function renderConsentSummary(manifestOrResolution: IntegrationManifest | IntegrationManifestResolution, options?: RenderConsentOptions): ConsentSummary;
+declare function renderApprovalCopy(input: {
+    appName: string;
+    connectorTitle: string;
+    action: IntegrationConnectorAction;
+    approvalId?: string;
+}): ConsentSummary;
+
+interface ConnectorAdapterProviderOptions {
+    id?: string;
+    kind?: IntegrationProviderKind;
+    adapters: ConnectorAdapter[];
+    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
+    now?: () => Date;
+}
+declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
+declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
+declare function createConnectorAdapterCatalogSource(options: {
+    id?: string;
+    providerId?: string;
+    adapters: ConnectorAdapter[];
+    precedence?: number;
+}): IntegrationCatalogSource;
+declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
+
+interface IntegrationSecretStore {
+    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
+    delete?(ref: SecretRef): Promise<void> | void;
+}
+interface ConnectionCredentialResolverOptions {
+    secrets: IntegrationSecretStore;
+    connections?: IntegrationConnectionStore;
+    adapters?: ConnectorAdapter[];
+    now?: () => Date;
+    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
+}
+declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
+    private readonly secrets;
+    get(ref: SecretRef): ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): void;
+    delete(ref: SecretRef): void;
+}
+declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
+declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
+declare function createCredentialBackedAdapterProvider(options: Omit<ConnectorAdapterProviderOptions, 'resolveDataSource'> & ConnectionCredentialResolverOptions): IntegrationProvider;
+declare function revokeConnection(input: {
+    connection: IntegrationConnection;
+    connections?: IntegrationConnectionStore;
+    secrets?: IntegrationSecretStore;
+    now?: () => Date;
+}): Promise<IntegrationConnection>;
+
+type IntegrationErrorCode = 'missing_connection' | 'missing_grant' | 'approval_required' | 'approval_denied' | 'connection_revoked' | 'connection_expired' | 'scope_missing' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'provider_rate_limited' | 'provider_auth_failed' | 'provider_unavailable' | 'provider_error' | 'capability_expired' | 'capability_invalid' | 'manifest_invalid' | 'passthrough_disabled' | 'input_invalid' | 'unknown';
+interface IntegrationUserAction {
+    type: 'connect' | 'reconnect' | 'approve' | 'retry' | 'contact_support' | 'change_request';
+    label: string;
+    connectorId?: string;
+    approvalId?: string;
+}
+declare class IntegrationRuntimeError extends Error {
+    readonly code: IntegrationErrorCode;
+    readonly status: number;
+    readonly userAction?: IntegrationUserAction;
+    readonly metadata?: Record<string, unknown>;
+    constructor(input: {
+        code: IntegrationErrorCode;
+        message: string;
+        status?: number;
+        userAction?: IntegrationUserAction;
+        metadata?: Record<string, unknown>;
+    });
+}
+interface NormalizedIntegrationError {
+    ok: false;
+    code: IntegrationErrorCode;
+    message: string;
+    status: number;
+    userAction?: IntegrationUserAction;
+    metadata?: Record<string, unknown>;
+}
+declare function normalizeIntegrationError(error: unknown): NormalizedIntegrationError;
+declare function statusForCode(code: IntegrationErrorCode): number;
+
+interface IntegrationWorkflowDefinition {
+    id: string;
+    title?: string;
+    manifest: IntegrationManifest;
+    trigger: {
+        requirementId: string;
+        triggerId: string;
+        targetUrl?: string;
+    };
+    metadata?: Record<string, unknown>;
+}
+interface InstalledIntegrationWorkflow {
+    id: string;
+    workflowId: string;
+    manifestId: string;
+    owner: IntegrationActor;
+    grantee: IntegrationActor;
+    triggerGrantId: string;
+    subscription: IntegrationTriggerSubscription;
+    status: 'active' | 'paused' | 'error';
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationWorkflowStore {
+    put(workflow: InstalledIntegrationWorkflow): Promise<void> | void;
+    get(id: string): Promise<InstalledIntegrationWorkflow | undefined> | InstalledIntegrationWorkflow | undefined;
+    list(): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+}
+interface IntegrationWorkflowRuntimeHub {
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+}
+interface IntegrationWorkflowRuntimeOptions {
+    runtime: IntegrationRuntime;
+    hub: IntegrationWorkflowRuntimeHub;
+    grants: IntegrationGrantStore;
+    store?: IntegrationWorkflowStore;
+    now?: () => Date;
+}
+declare class InMemoryIntegrationWorkflowStore implements IntegrationWorkflowStore {
+    private readonly workflows;
+    put(workflow: InstalledIntegrationWorkflow): void;
+    get(id: string): InstalledIntegrationWorkflow | undefined;
+    list(): InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): InstalledIntegrationWorkflow[];
+}
+declare class IntegrationWorkflowRuntime {
+    private readonly runtime;
+    private readonly hub;
+    private readonly grants;
+    private readonly store;
+    private readonly now;
+    constructor(options: IntegrationWorkflowRuntimeOptions);
+    install(input: {
+        workflow: IntegrationWorkflowDefinition;
+        owner: IntegrationActor;
+        grantee: IntegrationActor;
+    }): Promise<InstalledIntegrationWorkflow>;
+    dispatchEvent<T = unknown>(event: IntegrationTriggerEvent<T>, handler: (input: {
+        event: IntegrationTriggerEvent<T>;
+        workflows: InstalledIntegrationWorkflow[];
+    }) => Promise<void> | void): Promise<{
+        matched: InstalledIntegrationWorkflow[];
+    }>;
+}
+declare function createIntegrationWorkflowRuntime(options: IntegrationWorkflowRuntimeOptions): IntegrationWorkflowRuntime;
+
+interface StoredIntegrationEvent {
+    id: string;
+    sourceId: string;
+    connectorId: string;
+    eventType: string;
+    providerEventId?: string;
+    receivedAt: string;
+    payload: Record<string, unknown>;
+    dispatchedAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationEventStore {
+    put(event: StoredIntegrationEvent): Promise<void> | void;
+    hasProviderEvent(sourceId: string, providerEventId: string): Promise<boolean> | boolean;
+    list(): Promise<StoredIntegrationEvent[]> | StoredIntegrationEvent[];
+}
+interface IntegrationWebhookReceiverResult {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+    received: StoredIntegrationEvent[];
+    duplicates: StoredIntegrationEvent[];
+}
+declare class InMemoryIntegrationEventStore implements IntegrationEventStore {
+    private readonly events;
+    private readonly providerIds;
+    put(event: StoredIntegrationEvent): void;
+    hasProviderEvent(sourceId: string, providerEventId: string): boolean;
+    list(): StoredIntegrationEvent[];
+}
+declare function receiveIntegrationWebhook(input: {
+    adapter: ConnectorAdapter;
+    source: ResolvedDataSource;
+    rawBody: string;
+    headers: Record<string, string | string[] | undefined>;
+    store: IntegrationEventStore;
+    workflowRuntime?: IntegrationWorkflowRuntime;
+    now?: () => Date;
+}): Promise<IntegrationWebhookReceiverResult>;
+declare function storedEventToTriggerEvent(event: StoredIntegrationEvent, source: ResolvedDataSource): IntegrationTriggerEvent;
+
+interface IntegrationIdempotencyRecord {
+    key: string;
+    requestHash: string;
+    result: IntegrationActionResult;
+    createdAt: string;
+}
+interface IntegrationIdempotencyStore {
+    get(key: string): Promise<IntegrationIdempotencyRecord | undefined> | IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): Promise<void> | void;
+}
+interface IntegrationRateLimitDecision {
+    allowed: boolean;
+    retryAfterMs?: number;
+    reason?: string;
+}
+interface IntegrationRateLimiter {
+    check(ctx: IntegrationGuardContext): Promise<IntegrationRateLimitDecision> | IntegrationRateLimitDecision;
+}
+declare class InMemoryIntegrationIdempotencyStore implements IntegrationIdempotencyStore {
+    private readonly records;
+    get(key: string): IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): void;
+}
+declare class DefaultIntegrationActionGuard implements IntegrationActionGuard {
+    private readonly idempotency;
+    private readonly audit;
+    private readonly rateLimiter;
+    private readonly now;
+    constructor(options?: {
+        idempotency?: IntegrationIdempotencyStore;
+        audit?: IntegrationAuditSink;
+        rateLimiter?: IntegrationRateLimiter;
+        now?: () => Date;
+    });
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+    private writeIdempotency;
+}
+declare function createDefaultIntegrationActionGuard(options?: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0]): DefaultIntegrationActionGuard;
+
+type IntegrationHealthcheckStatus = 'healthy' | 'degraded' | 'unhealthy' | 'unknown';
+interface IntegrationHealthcheckCheck {
+    id: string;
+    status: IntegrationHealthcheckStatus;
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckResult {
+    connectionId: string;
+    providerId: string;
+    connectorId: string;
+    status: IntegrationHealthcheckStatus;
+    checkedAt: string;
+    checks: IntegrationHealthcheckCheck[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckStore {
+    put(result: IntegrationHealthcheckResult): Promise<void> | void;
+    get(connectionId: string): Promise<IntegrationHealthcheckResult | undefined> | IntegrationHealthcheckResult | undefined;
+    list(): Promise<IntegrationHealthcheckResult[]> | IntegrationHealthcheckResult[];
+}
+declare class InMemoryIntegrationHealthcheckStore implements IntegrationHealthcheckStore {
+    private readonly results;
+    put(result: IntegrationHealthcheckResult): void;
+    get(connectionId: string): IntegrationHealthcheckResult | undefined;
+    list(): IntegrationHealthcheckResult[];
+}
+declare function runIntegrationHealthcheck(input: {
+    connection: IntegrationConnection;
+    connector?: IntegrationConnector;
+    registry?: IntegrationRegistry;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationHealthcheckResult>;
+declare function runIntegrationHealthchecks(input: {
+    connections: IntegrationConnection[];
+    registry?: IntegrationRegistry;
+    store?: IntegrationHealthcheckStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+}): Promise<IntegrationHealthcheckResult[]>;
+declare function healthcheckRequest(action?: string): IntegrationActionRequest;
+
+interface ManifestValidationIssue {
+    path: string;
+    message: string;
+}
+interface ManifestValidationResult {
+    ok: boolean;
+    issues: ManifestValidationIssue[];
+}
+interface InferIntegrationRequirementsOptions {
+    manifestId: string;
+    title?: string;
+    tools: Array<string | {
+        action: string;
+        reason?: string;
+        mode?: IntegrationRequirementMode;
+        connectorId?: string;
+        scopes?: string[];
+    }>;
+    metadata?: Record<string, unknown>;
+}
+interface MissingRequirementExplanation {
+    requirementId: string;
+    connectorId: string;
+    status: string;
+    message: string;
+    userAction: 'connect' | 'enable' | 'ignore_optional';
+}
+declare function validateIntegrationManifest(manifest: IntegrationManifest): ManifestValidationResult;
+declare function assertValidIntegrationManifest(manifest: IntegrationManifest): void;
+declare function inferIntegrationManifestFromTools(options: InferIntegrationRequirementsOptions): IntegrationManifest;
+declare function explainMissingRequirements(resolution: IntegrationManifestResolution): MissingRequirementExplanation[];
+declare function calendarExercisePlannerManifest(id?: string): IntegrationManifest;
+
+interface ProviderHttpRequestInput {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    body?: unknown;
+}
+interface ProviderPassthroughPolicy {
+    enabled: boolean;
+    allowedMethods?: ProviderHttpRequestInput['method'][];
+    allowedPathPrefixes?: string[];
+    maxBodyBytes?: number;
+}
+declare const PROVIDER_PASSTHROUGH_ACTION: "provider.http.request";
+declare function validateProviderPassthroughRequest(input: ProviderHttpRequestInput, policy: ProviderPassthroughPolicy): void;
+
+type IntegrationPolicyEffect = 'allow' | 'require_approval' | 'deny';
+interface IntegrationPolicyRule {
+    id: string;
+    effect: IntegrationPolicyEffect;
+    reason: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    maxRisk?: IntegrationActionRisk;
+    risk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+}
+interface StaticIntegrationPolicyOptions {
+    rules?: IntegrationPolicyRule[];
+    defaultReadEffect?: IntegrationPolicyEffect;
+    defaultWriteEffect?: IntegrationPolicyEffect;
+    defaultDestructiveEffect?: IntegrationPolicyEffect;
+    now?: () => Date;
+}
+interface IntegrationApprovalResolution {
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: string;
+    resolvedAt: string;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class StaticIntegrationPolicyEngine implements IntegrationPolicyEngine {
+    private readonly rules;
+    private readonly defaultReadEffect;
+    private readonly defaultWriteEffect;
+    private readonly defaultDestructiveEffect;
+    private readonly now;
+    constructor(options?: StaticIntegrationPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: {
+            type: string;
+            id: string;
+        };
+    }): IntegrationPolicyDecision;
+    private defaultEffect;
+}
+declare function createDefaultIntegrationPolicyEngine(options?: Omit<StaticIntegrationPolicyOptions, 'rules'>): StaticIntegrationPolicyEngine;
+declare function buildApprovalRequest(ctx: IntegrationGuardContext & {
+    subject: {
+        type: string;
+        id: string;
+    };
+}, reason: string, requestedAt: Date): IntegrationApprovalRequest;
+declare function redactApprovalRequest(request: IntegrationApprovalRequest): IntegrationApprovalRequest;
+
+interface PlatformIntegrationPolicyPresetOptions extends Omit<StaticIntegrationPolicyOptions, 'defaultReadEffect' | 'defaultWriteEffect' | 'defaultDestructiveEffect'> {
+    allowWritesWithoutApproval?: boolean;
+    allowDestructiveActions?: boolean;
+    allowProviderPassthrough?: boolean;
+}
+declare function createPlatformIntegrationPolicyPreset(options?: PlatformIntegrationPolicyPresetOptions): StaticIntegrationPolicyEngine;
+
+interface CatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    action: IntegrationConnector['actions'][number];
+}
+interface CatalogExecutorProviderOptions {
+    id: string;
+    kind: IntegrationProviderKind;
+    connectors: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: CatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (connection: IntegrationConnection, trigger: NonNullable<IntegrationConnector['triggers']>[number], targetUrl?: string) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+declare function createCatalogExecutorProvider(options: CatalogExecutorProviderOptions): IntegrationProvider;
+
+interface IntegrationInvocationEnvelope {
+    kind: 'integration.invocation';
+    capabilityToken: string;
+    toolName: string;
+    action: string;
+    input?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationInvocationEnvelopeValidationOptions {
+    connectors?: IntegrationConnector[];
+    maxInputBytes?: number;
+    requireKnownTool?: boolean;
+}
+type NormalizedIntegrationResult = {
+    status: 'ok';
+    action: string;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'approval_required';
+    action: string;
+    approval: IntegrationApprovalRequest;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'failed';
+    action: string;
+    error: string;
+    metadata?: Record<string, unknown>;
+};
+interface IntegrationSandboxHostHub {
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+interface IntegrationSandboxHostOptions extends IntegrationInvocationEnvelopeValidationOptions {
+    hub: IntegrationSandboxHostHub;
+}
+declare function buildIntegrationInvocationEnvelope(input: {
+    capabilityToken: string;
+    toolName: string;
+    args?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}): IntegrationInvocationEnvelope;
+declare function invocationRequestFromEnvelope(envelope: IntegrationInvocationEnvelope): InvokeWithCapabilityRequest;
+declare function validateIntegrationInvocationEnvelope(envelope: IntegrationInvocationEnvelope, options?: IntegrationInvocationEnvelopeValidationOptions): void;
+declare function redactInvocationEnvelope(envelope: IntegrationInvocationEnvelope): Omit<IntegrationInvocationEnvelope, 'capabilityToken'> & {
+    capabilityToken: '[REDACTED]';
+};
+declare function redactCapability(capability: IntegrationCapability): IntegrationCapability;
+declare function normalizeIntegrationResult(result: IntegrationActionResult): NormalizedIntegrationResult;
+declare function dispatchIntegrationInvocation(envelope: IntegrationInvocationEnvelope, options: IntegrationSandboxHostOptions): Promise<NormalizedIntegrationResult>;
+declare class IntegrationSandboxHost {
+    private readonly options;
+    constructor(options: IntegrationSandboxHostOptions);
+    dispatch(envelope: IntegrationInvocationEnvelope): Promise<NormalizedIntegrationResult>;
+}
+
+interface ImportCatalogOptions {
+    providerId: string;
+    connectorId: string;
+    connectorTitle: string;
+    category?: IntegrationConnectorCategory;
+    auth?: IntegrationConnector['auth'];
+    scopes?: string[];
+    dataClass?: IntegrationDataClass;
+    defaultRisk?: IntegrationActionRisk;
+}
+interface OpenApiDocument {
+    openapi?: string;
+    swagger?: string;
+    info?: {
+        title?: string;
+    };
+    paths?: Record<string, Record<string, OpenApiOperation | unknown>>;
+}
+interface OpenApiOperation {
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: unknown;
+    security?: Array<Record<string, string[]>>;
+    tags?: string[];
+}
+interface GraphqlOperationSpec {
+    name: string;
+    kind: 'query' | 'mutation';
+    description?: string;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    requiredScopes?: string[];
+}
+interface McpCatalogTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        openWorldHint?: boolean;
+        title?: string;
+    };
+}
+interface McpCatalog {
+    tools: McpCatalogTool[];
+}
+declare function importOpenApiConnector(document: OpenApiDocument, options: ImportCatalogOptions): IntegrationConnector;
+declare function importGraphqlConnector(operations: GraphqlOperationSpec[], options: ImportCatalogOptions): IntegrationConnector;
+declare function importMcpConnector(catalog: McpCatalog, options: ImportCatalogOptions): IntegrationConnector;
+
+interface GatewayCatalogProviderOptions {
+    id: string;
+    kind: Extract<IntegrationProviderKind, 'nango' | 'pipedream' | 'activepieces' | 'tangle_catalog' | 'zapier' | 'executor' | 'custom'>;
+    fetchCatalog: () => Promise<GatewayCatalogEntry[]> | GatewayCatalogEntry[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    invokeAction?: (connection: IntegrationConnection, request: IntegrationActionRequest) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    cacheTtlMs?: number;
+    now?: () => Date;
+}
+interface GatewayCatalogEntry {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    category?: string;
+    auth?: 'oauth2' | 'api_key' | 'none' | 'custom' | string;
+    scopes?: string[];
+    actions?: GatewayCatalogAction[];
+    triggers?: GatewayCatalogTrigger[];
+    metadata?: Record<string, unknown>;
+}
+interface GatewayCatalogAction {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    risk?: 'read' | 'write' | 'destructive' | string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    approvalRequired?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+}
+interface GatewayCatalogTrigger {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    payloadSchema?: unknown;
+}
+declare function createGatewayCatalogProvider(options: GatewayCatalogProviderOptions): IntegrationProvider;
+declare function normalizeGatewayCatalog(entries: GatewayCatalogEntry[], options: {
+    providerId: string;
+    providerKind: IntegrationProviderKind;
+}): IntegrationConnector[];
+
+interface ActivepiecesCatalogEntry {
+    id: string;
+    title: string;
+    description: string;
+    npmPackage?: string;
+    version?: string;
+    category: IntegrationConnectorCategory;
+    auth: IntegrationConnector['auth'];
+    authFields?: ActivepiecesCatalogAuthField[];
+    domains: string[];
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationActionRisk;
+        upstreamName?: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName?: string;
+    }>;
+    source: {
+        repository: string;
+        path: string;
+        license: 'MIT';
+    };
+}
+interface ActivepiecesCatalogAuthField {
+    key: string;
+    label: string;
+    required: boolean;
+    secret: boolean;
+    kind: 'text' | 'number' | 'boolean' | 'select' | 'object' | 'unknown';
+    description?: string;
+}
+declare function listActivepiecesCatalogEntries(): ActivepiecesCatalogEntry[];
+declare function buildActivepiecesConnectors(options?: {
+    providerId?: string;
+    includeCatalogActions?: boolean;
+    executable?: boolean;
+}): IntegrationConnector[];
+
+interface ActivepiecesPieceOverride {
+    category?: IntegrationConnectorCategory;
+    actionRisks?: Record<string, IntegrationActionRisk>;
+    approvalRequired?: Record<string, boolean>;
+}
+declare const ACTIVEPIECES_OVERRIDES: Record<string, ActivepiecesPieceOverride>;
+declare function getActivepiecesOverride(id: string): ActivepiecesPieceOverride | undefined;
+
+interface ActivepiecesExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    catalogEntry: ActivepiecesCatalogEntry;
+    piece: {
+        id: string;
+        npmPackage?: string;
+        version?: string;
+        actionId: string;
+        upstreamActionName?: string;
+    };
+}
+interface ActivepiecesExecutorProviderOptions {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: ActivepiecesExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+declare function createActivepiecesExecutorProvider(options: ActivepiecesExecutorProviderOptions): IntegrationProvider;
+
+declare const ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER = "x-tangle-activepieces-signature";
+declare const TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER = "x-tangle-catalog-signature";
+interface TangleCatalogRuntimeActionRequest {
+    id: string;
+    input: unknown;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface TangleCatalogRuntimePiece {
+    id: string;
+    packageName?: string;
+    version?: string;
+    actionId: string;
+    upstreamActionName?: string;
+}
+interface TangleCatalogHttpExecutorOptions {
+    endpoint: string;
+    path?: string;
+    signatureHeader?: string;
+    secret?: string;
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    requestId?: () => string;
+}
+interface TangleCatalogHttpExecutorInvocation extends Omit<ActivepiecesExecutorInvocation, 'catalogEntry' | 'piece'> {
+    catalogEntry: unknown;
+    piece: TangleCatalogRuntimePiece;
+}
+/**
+ * @deprecated Use the Tangle catalog runtime types. This name is kept only for
+ * compatibility with the upstream catalog ingestion backend.
+ */
+interface ActivepiecesRuntimeRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connection: IntegrationConnection;
+    connector: Pick<IntegrationConnector, 'id' | 'title' | 'auth' | 'scopes' | 'metadata'>;
+    piece: ActivepiecesExecutorInvocation['piece'];
+    action: TangleCatalogRuntimeActionRequest;
+}
+/**
+ * @deprecated Use `TangleCatalogHttpExecutorOptions`.
+ */
+type ActivepiecesHttpExecutorOptions = TangleCatalogHttpExecutorOptions;
+/**
+ * @deprecated Use `createTangleCatalogHttpExecutor`.
+ */
+declare function createActivepiecesHttpExecutor(options: ActivepiecesHttpExecutorOptions): ActivepiecesExecutorProviderOptions['executeAction'];
+/**
+ * @deprecated Use `buildTangleCatalogRuntimeRequest`.
+ */
+declare function buildActivepiecesRuntimeRequest(invocation: ActivepiecesExecutorInvocation, requestId?: string): ActivepiecesRuntimeRequest;
+/**
+ * @deprecated Use `signTangleCatalogRuntimeRequest`.
+ */
+declare function signActivepiecesRuntimeRequest(serializedBody: string, secret: string): string;
+/**
+ * @deprecated Use `verifyTangleCatalogRuntimeSignature`.
+ */
+declare function verifyActivepiecesRuntimeSignature(serializedBody: string, signature: string | null | undefined, secret: string): boolean;
+interface TangleCatalogRuntimeRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connection: IntegrationConnection;
+    connector: Pick<IntegrationConnector, 'id' | 'title' | 'auth' | 'scopes' | 'metadata'>;
+    piece: TangleCatalogRuntimePiece;
+    action: TangleCatalogRuntimeActionRequest;
+}
+declare function createTangleCatalogHttpExecutor(options: TangleCatalogHttpExecutorOptions): (invocation: TangleCatalogHttpExecutorInvocation) => Promise<IntegrationActionResult>;
+declare function buildTangleCatalogRuntimeRequest(invocation: TangleCatalogHttpExecutorInvocation, requestId?: string): TangleCatalogRuntimeRequest;
+declare const signTangleCatalogRuntimeRequest: typeof signActivepiecesRuntimeRequest;
+declare const verifyTangleCatalogRuntimeSignature: typeof verifyActivepiecesRuntimeSignature;
+
+interface IntegrationCatalogFreshnessOptions {
+    liveActivepieces?: boolean;
+    minActivepiecesConnectors?: number;
+    staleConnectorDelta?: number;
+    fetchImpl?: typeof fetch;
+}
+interface IntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        activepiecesEntries: number;
+        activepiecesConnectors: number;
+        activepiecesActions: number;
+        activepiecesTriggers: number;
+        executableActivepiecesConnectors: number;
+        executableActivepiecesActions: number;
+        executableActivepiecesTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: IntegrationRegistrySummary;
+        conflictSamples: IntegrationRegistryConflict[];
+    };
+    upstream?: {
+        activepiecesPieces?: number;
+        activepiecesDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare const ACTIVEPIECES_PUBLIC_CATALOG_URL = "https://www.activepieces.com/pieces";
+declare function extractActivepiecesPublicPieceCount(html: string): number | undefined;
+declare function auditIntegrationCatalogFreshness(options?: IntegrationCatalogFreshnessOptions): Promise<IntegrationCatalogFreshnessResult>;
+
+declare const TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID = "tangle-catalog";
+declare const TANGLE_INTEGRATIONS_CATALOG_SOURCE = "tangle-integrations-catalog";
+type TangleIntegrationImplementationKind = 'native_adapter' | 'package_runtime';
+type TangleIntegrationContractStatus = 'contract_ready' | 'runtime_backed' | 'native_backed';
+interface TangleIntegrationCatalogEntry {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields?: ActivepiecesCatalogEntry['authFields'];
+    domains: string[];
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName?: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName?: string;
+    }>;
+}
+interface TangleIntegrationContract {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields: NonNullable<ActivepiecesCatalogEntry['authFields']>;
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName: string;
+    }>;
+    implementation: {
+        kind: TangleIntegrationImplementationKind;
+        runtimePackage?: string;
+        version?: string;
+    };
+    status: TangleIntegrationContractStatus;
+    quality: {
+        tangleContract: true;
+        authFieldsMapped: boolean;
+        actionNamesMapped: boolean;
+        triggerNamesMapped: boolean;
+        runtimePackageMapped: boolean;
+        nativeAdapter: boolean;
+    };
+}
+interface TangleCatalogRuntimePackageManifestOptions {
+    name?: string;
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+    additionalDependencies?: Record<string, string>;
+}
+interface TangleCatalogRuntimePackageManifest {
+    name: string;
+    private: true;
+    type: 'module';
+    dependencies: Record<string, string>;
+    tangle: {
+        integrationContracts: number;
+        packageRuntimeBackends: number;
+        generatedFrom: typeof TANGLE_INTEGRATIONS_CATALOG_SOURCE;
+    };
+}
+interface TangleCatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        actionId: string;
+        upstreamActionName?: string;
+    };
+}
+interface TangleCatalogTriggerInvocation {
+    connection: IntegrationConnection;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    trigger: NonNullable<IntegrationConnector['triggers']>[number];
+    targetUrl?: string;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        triggerId: string;
+        upstreamTriggerName?: string;
+    };
+}
+interface TangleCatalogExecutorProviderOptions {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: TangleCatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (invocation: TangleCatalogTriggerInvocation) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+type TangleIntegrationCatalogFreshnessOptions = IntegrationCatalogFreshnessOptions;
+interface TangleIntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        catalogEntries: number;
+        catalogConnectors: number;
+        catalogActions: number;
+        catalogTriggers: number;
+        executableCatalogConnectors: number;
+        executableCatalogActions: number;
+        executableCatalogTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['registrySummary'];
+        conflictSamples: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['conflictSamples'];
+    };
+    upstream?: {
+        externalEntries?: number;
+        externalDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare function listTangleIntegrationCatalogEntries(): TangleIntegrationCatalogEntry[];
+declare function listTangleIntegrationContracts(): TangleIntegrationContract[];
+declare function listTangleIntegrationCatalogRuntimePackages(): Array<{
+    connectorId: string;
+    packageName: string;
+    version?: string;
+}>;
+declare function buildTangleCatalogRuntimePackageManifest(options?: TangleCatalogRuntimePackageManifestOptions): TangleCatalogRuntimePackageManifest;
+declare function renderTangleCatalogRuntimePnpmAddCommand(options?: {
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+}): string;
+declare function buildTangleIntegrationCatalogConnectors(options?: {
+    providerId?: string;
+    includeCatalogActions?: boolean;
+    executable?: boolean;
+}): IntegrationConnector[];
+declare function createTangleCatalogExecutorProvider(options: TangleCatalogExecutorProviderOptions): IntegrationProvider;
+declare const extractExternalCatalogPublicCount: typeof extractActivepiecesPublicPieceCount;
+declare function auditTangleIntegrationCatalogFreshness(options?: TangleIntegrationCatalogFreshnessOptions): Promise<TangleIntegrationCatalogFreshnessResult>;
+
+interface TangleCatalogRuntimeInvocation {
+    request: TangleCatalogRuntimeRequest;
+    connection: IntegrationConnection;
+    connector: IntegrationConnector;
+    action: IntegrationConnectorAction;
+}
+interface TangleCatalogRuntimeHandlerOptions {
+    secret?: string;
+    requireSignature?: boolean;
+    signatureHeader?: string;
+    connectors?: IntegrationConnector[];
+    maxBodyBytes?: number;
+    executeAction: (invocation: TangleCatalogRuntimeInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+interface TangleCatalogInstalledPackageExecutorOptions {
+    moduleLoader?: (packageName: string) => Promise<unknown> | unknown;
+    actionAliases?: Record<string, Record<string, string>>;
+    allowFuzzyActionMatch?: boolean;
+    resolveAuth?: (connection: IntegrationConnection) => Promise<unknown> | unknown;
+    beforeRun?: (invocation: TangleCatalogRuntimeInvocation) => Promise<void> | void;
+}
+interface TangleCatalogAuthResolverOptions {
+    secrets: IntegrationSecretStore;
+    mapCredentials?: (input: {
+        connection: IntegrationConnection;
+        credentials: ConnectorCredentials;
+        connectorId: string;
+    }) => unknown;
+}
+interface TangleCatalogHttpAuthResolverOptions {
+    endpoint: string;
+    secret: string;
+    path?: string;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    requestId?: () => string;
+}
+interface TangleCatalogHttpAuthResolverRequest {
+    version: 1;
+    requestId: string;
+    providerId: string;
+    connectorId: string;
+    connectionId: string;
+    secretRef?: IntegrationConnection['secretRef'];
+}
+interface TangleCatalogRuntimeModuleAction {
+    name?: string;
+    displayName?: string;
+    run?: (context: {
+        auth: unknown;
+        propsValue: unknown;
+        input: unknown;
+        connection: IntegrationConnection;
+        request: TangleCatalogRuntimeRequest;
+    }) => Promise<unknown> | unknown;
+}
+interface TangleCatalogRuntimeHttpRequest {
+    body: string | Uint8Array | TangleCatalogRuntimeRequest;
+    headers?: Headers | Record<string, string | string[] | undefined>;
+}
+interface TangleCatalogRuntimeHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: IntegrationActionResult | {
+        ok: false;
+        action: string;
+        output: {
+            code: string;
+            message: string;
+        };
+    };
+}
+interface TangleCatalogRuntimePackageCoverageRow {
+    connectorId: string;
+    packageName: string;
+    packageInstalled: boolean;
+    packageLoads: boolean;
+    pieceExportFound: boolean;
+    actionMappingsVerified: number;
+    actionMappingsTotal: number;
+    triggerMappingsFound: number;
+    triggerMappingsTotal: number;
+    triggerHostingSupported: boolean;
+    error?: string;
+}
+interface TangleCatalogRuntimePackageCoverageOptions {
+    connectorIds?: string[];
+    moduleLoader?: (packageName: string) => Promise<unknown> | unknown;
+}
+declare function createTangleCatalogRuntimeHandler(options: TangleCatalogRuntimeHandlerOptions): (input: TangleCatalogRuntimeHttpRequest) => Promise<TangleCatalogRuntimeHttpResponse>;
+declare function createTangleCatalogInstalledPackageExecutor(options?: TangleCatalogInstalledPackageExecutorOptions): TangleCatalogRuntimeHandlerOptions['executeAction'];
+declare function auditTangleCatalogRuntimePackages(options?: TangleCatalogRuntimePackageCoverageOptions): Promise<TangleCatalogRuntimePackageCoverageRow[]>;
+declare function createTangleCatalogCredentialAuthResolver(options: TangleCatalogAuthResolverOptions): (connection: IntegrationConnection) => Promise<unknown>;
+declare function createTangleCatalogHttpAuthResolver(options: TangleCatalogHttpAuthResolverOptions): (connection: IntegrationConnection) => Promise<unknown>;
+declare function tangleCatalogAuthValue(credentials: ConnectorCredentials): unknown;
+
+interface TangleCatalogRuntimeNodeServerOptions {
+    secret: string;
+    host?: string;
+    port?: number;
+    path?: string;
+    maxBodyBytes?: number;
+    requireSignature?: boolean;
+    authResolver?: false | TangleCatalogHttpAuthResolverOptions;
+    executor?: Omit<TangleCatalogInstalledPackageExecutorOptions, 'resolveAuth'> & {
+        resolveAuth?: TangleCatalogInstalledPackageExecutorOptions['resolveAuth'];
+    };
+    onLog?: (event: {
+        level: 'info' | 'warn' | 'error';
+        message: string;
+        metadata?: Record<string, unknown>;
+    }) => void;
+}
+interface StartedTangleCatalogRuntimeNodeServer {
+    server: Server;
+    url: string;
+    close: () => Promise<void>;
+}
+declare function createTangleCatalogRuntimeNodeRequestListener(options: TangleCatalogRuntimeNodeServerOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+declare function startTangleCatalogRuntimeNodeServer(options: TangleCatalogRuntimeNodeServerOptions): Promise<StartedTangleCatalogRuntimeNodeServer>;
+
+type IntegrationCoveragePriority = 'tier_0' | 'tier_1' | 'tier_2' | 'long_tail';
+interface IntegrationCoverageSpec {
+    id: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    auth: IntegrationConnector['auth'];
+    priority: IntegrationCoveragePriority;
+    providerKinds: IntegrationProviderKind[];
+    domains: string[];
+    actionPack: IntegrationActionPack;
+    scopes?: string[];
+}
+type IntegrationActionPack = 'email' | 'calendar' | 'chat' | 'crm' | 'storage' | 'docs' | 'database' | 'project' | 'support' | 'marketing' | 'sales' | 'commerce' | 'finance' | 'hr' | 'dev' | 'ai' | 'analytics' | 'workflow' | 'webhook';
+declare function listIntegrationCoverageSpecs(): IntegrationCoverageSpec[];
+declare function buildIntegrationCoverageConnectors(options?: {
+    providerId?: string;
+    priorities?: IntegrationCoveragePriority[];
+    categories?: IntegrationConnectorCategory[];
+    actionPacks?: IntegrationActionPack[];
+}): IntegrationConnector[];
+declare function integrationCoverageChecklistMarkdown(): string;
+
+type IntegrationAuthMode = 'oauth2' | 'api_key' | 'hmac' | 'none' | 'custom';
+type IntegrationSpecStatus = 'catalog' | 'executable' | 'deprecated';
+type IntegrationFamilyId = 'google' | 'microsoft-graph' | 'atlassian' | 'salesforce' | 'hubspot' | 'slack' | 'notion' | 'standard-oauth2' | 'api-key' | 'hmac' | 'none';
+type NormalizedPermission = `${string}.read` | `${string}.write` | `${string}.delete` | `${string}.admin`;
+interface IntegrationSpec {
+    kind: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    status: IntegrationSpecStatus;
+    family: IntegrationFamilyId;
+    auth: IntegrationAuthSpec;
+    permissions: PermissionDescriptor[];
+    actions: IntegrationConnectorAction[];
+    triggers?: IntegrationConnectorTrigger[];
+    setup: IntegrationSetupSpec;
+    lifecycle?: IntegrationLifecycleSpec;
+    plannerHints?: IntegrationPlannerHints;
+    metadata?: Record<string, unknown>;
+}
+type IntegrationAuthSpec = OAuth2AuthSpec | ApiKeyAuthSpec | HmacAuthSpec | NoneAuthSpec | CustomAuthSpec;
+interface OAuth2AuthSpec {
+    mode: 'oauth2';
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientIdEnv?: string;
+    clientSecretEnv?: string;
+    scopes: ScopeDescriptor[];
+    extraAuthParams?: Record<string, string>;
+    redirectUriTemplate: string;
+    pkce?: 'required' | 'supported' | 'unsupported';
+}
+interface ApiKeyAuthSpec {
+    mode: 'api_key';
+    credential: CredentialFieldSpec;
+    placement?: 'bearer' | 'header' | 'query' | 'basic';
+}
+interface HmacAuthSpec {
+    mode: 'hmac';
+    credential: CredentialFieldSpec;
+    signatureHeader?: string;
+}
+interface NoneAuthSpec {
+    mode: 'none';
+}
+interface CustomAuthSpec {
+    mode: 'custom';
+    description: string;
+}
+interface ScopeDescriptor {
+    normalized: NormalizedPermission;
+    providerScope: string;
+    title: string;
+    reason: string;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+}
+interface PermissionDescriptor {
+    normalized: NormalizedPermission;
+    providerScopes: string[];
+    title: string;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    reason: string;
+}
+interface CredentialFieldSpec {
+    label: string;
+    description: string;
+    env?: string;
+    example?: string;
+    regex?: string;
+    secret: boolean;
+}
+interface ConsoleStep {
+    id: string;
+    title: string;
+    detail: string;
+    copyValue?: string;
+}
+interface Quirk {
+    id: string;
+    severity: 'info' | 'warning' | 'critical';
+    message: string;
+}
+interface PostSetupCheck {
+    id: string;
+    title: string;
+    detail: string;
+}
+interface HealthcheckSpec {
+    id: string;
+    level: 'client_config' | 'connection' | 'webhook' | 'static';
+    method?: 'GET' | 'POST';
+    url?: string;
+    expectedStatus?: number[];
+    description: string;
+}
+interface IntegrationSetupSpec {
+    consoleUrl?: string;
+    consoleSteps: ConsoleStep[];
+    credentialFields: CredentialFieldSpec[];
+    redirectUriTemplate?: string;
+    knownQuirks?: Quirk[];
+    postSetup?: PostSetupCheck[];
+    healthcheck?: HealthcheckSpec;
+}
+interface IntegrationLifecycleSpec {
+    supportsRefresh: boolean;
+    supportsRevoke: boolean;
+    supportsIncrementalAuth: boolean;
+    recommendedHealthcheckIntervalHours?: number;
+    freshnessSloMinutes?: number;
+}
+interface IntegrationPlannerHints {
+    useFor: string[];
+    avoidFor?: string[];
+    dataFreshness: 'realtime' | 'near_realtime' | 'eventual' | 'manual';
+    writeRisk: 'low' | 'medium' | 'high';
+}
+interface IntegrationFamilySpec {
+    id: IntegrationFamilyId;
+    title: string;
+    authMode: IntegrationAuthMode;
+    consoleUrl?: string;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    redirectUriTemplate?: string;
+    credentialFields: CredentialFieldSpec[];
+    consoleSteps: ConsoleStep[];
+    knownQuirks?: Quirk[];
+    lifecycle: IntegrationLifecycleSpec;
+}
+interface IntegrationSpecValidationIssue {
+    path: string;
+    message: string;
+}
+interface IntegrationSpecValidationResult {
+    ok: boolean;
+    issues: IntegrationSpecValidationIssue[];
+}
+interface RenderSpecOptions {
+    host: string;
+    callbackPath?: string;
+}
+interface RenderedConsoleStep extends ConsoleStep {
+    detail: string;
+    copyValue?: string;
+}
+interface CredentialValidationInput {
+    field: CredentialFieldSpec;
+    value: string;
+}
+interface CredentialValidationResult {
+    ok: boolean;
+    field: string;
+    message?: string;
+}
+interface HealthcheckPlan {
+    kind: string;
+    healthcheck: HealthcheckSpec;
+    requires: Array<'client_id' | 'client_secret' | 'api_key' | 'hmac_secret' | 'connection_credentials'>;
+    message: string;
+}
+declare function specAuthToConnectorAuth(auth: IntegrationAuthSpec): IntegrationConnector['auth'];
+
+declare const INTEGRATION_FAMILIES: Record<IntegrationFamilyId, IntegrationFamilySpec>;
+declare function getIntegrationFamily(id: IntegrationFamilyId): IntegrationFamilySpec;
+
+declare function listIntegrationSpecs(): IntegrationSpec[];
+declare function getIntegrationSpec(kind: string): IntegrationSpec | undefined;
+declare function listExecutableIntegrationSpecs(): IntegrationSpec[];
+declare function integrationSpecToConnector(spec: IntegrationSpec, providerId?: string): IntegrationConnector;
+
+declare function renderConsoleSteps(spec: IntegrationSpec, options: RenderSpecOptions): RenderedConsoleStep[];
+declare function renderRunbookMarkdown(spec: IntegrationSpec, options: RenderSpecOptions): string;
+declare function renderAgentToolDescription(spec: IntegrationSpec): string;
+declare function buildHealthcheckPlan(spec: IntegrationSpec): HealthcheckPlan;
+declare function consoleStepsToText(steps: ConsoleStep[]): string;
+
+declare function validateIntegrationSpec(spec: IntegrationSpec): IntegrationSpecValidationResult;
+declare function assertValidIntegrationSpec(spec: IntegrationSpec): void;
+declare function validateCredentialFormat(field: CredentialFieldSpec, value: string): CredentialValidationResult;
+declare function validateCredentialSet(spec: IntegrationSpec, values: Record<string, string>): CredentialValidationResult[];
+
+type IntegrationProviderKind = 'first_party' | 'nango' | 'pipedream' | 'zapier' | 'activepieces' | 'tangle_catalog' | 'executor' | 'custom';
+type IntegrationConnectorCategory = 'email' | 'calendar' | 'chat' | 'crm' | 'storage' | 'docs' | 'database' | 'webhook' | 'workflow' | 'internal' | 'other';
+type IntegrationActionRisk = 'read' | 'write' | 'destructive';
+type IntegrationDataClass = 'public' | 'internal' | 'private' | 'sensitive' | 'secret';
+interface IntegrationActor {
+    type: 'user' | 'team' | 'app' | 'agent' | 'sandbox' | 'system';
+    id: string;
+}
+interface IntegrationConnectorAction {
+    id: string;
+    title: string;
+    risk: IntegrationActionRisk;
+    requiredScopes: string[];
+    dataClass: IntegrationDataClass;
+    description?: string;
+    approvalRequired?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+}
+interface IntegrationConnectorTrigger {
+    id: string;
+    title: string;
+    requiredScopes: string[];
+    dataClass: IntegrationDataClass;
+    description?: string;
+    payloadSchema?: unknown;
+}
+interface IntegrationConnector {
+    id: string;
+    providerId: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    auth: 'oauth2' | 'api_key' | 'none' | 'custom';
+    scopes: string[];
+    actions: IntegrationConnectorAction[];
+    triggers?: IntegrationConnectorTrigger[];
+    metadata?: Record<string, unknown>;
+}
+interface SecretRef {
+    provider: string;
+    id: string;
+    label?: string;
+}
+interface IntegrationConnection {
+    id: string;
+    owner: IntegrationActor;
+    providerId: string;
+    connectorId: string;
+    status: 'pending' | 'active' | 'expired' | 'revoked' | 'error';
+    grantedScopes: string[];
+    account?: {
+        id?: string;
+        email?: string;
+        displayName?: string;
+    };
+    secretRef?: SecretRef;
+    createdAt: string;
+    updatedAt: string;
+    expiresAt?: string;
+    lastUsedAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface StartAuthRequest {
+    connectorId: string;
+    owner: IntegrationActor;
+    requestedScopes: string[];
+    redirectUri: string;
+    state?: string;
+    metadata?: Record<string, unknown>;
+}
+interface StartAuthResult {
+    providerId: string;
+    connectorId: string;
+    authUrl: string;
+    state: string;
+    expiresAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface CompleteAuthRequest {
+    connectorId: string;
+    owner: IntegrationActor;
+    code?: string;
+    state: string;
+    redirectUri: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationActionRequest {
+    connectionId: string;
+    action: string;
+    input?: unknown;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationActionResult<T = unknown> {
+    ok: boolean;
+    action: string;
+    output?: T;
+    externalId?: string;
+    warnings?: string[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationTriggerSubscription {
+    id: string;
+    connectionId: string;
+    trigger: string;
+    targetUrl?: string;
+    status: 'active' | 'paused' | 'error';
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationTriggerEvent<T = unknown> {
+    id: string;
+    providerId: string;
+    connectorId: string;
+    connectionId: string;
+    trigger: string;
+    occurredAt: string;
+    payload: T;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationProvider {
+    id: string;
+    kind: IntegrationProviderKind;
+    listConnectors(): Promise<IntegrationConnector[]> | IntegrationConnector[];
+    startAuth?(request: StartAuthRequest): Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?(request: CompleteAuthRequest): Promise<IntegrationConnection> | IntegrationConnection;
+    invokeAction(connection: IntegrationConnection, request: IntegrationActionRequest): Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?(connection: IntegrationConnection, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?(subscriptionId: string): Promise<void> | void;
+    normalizeTriggerEvent?(raw: unknown): Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+interface IntegrationConnectionStore {
+    get(connectionId: string): Promise<IntegrationConnection | undefined> | IntegrationConnection | undefined;
+    put(connection: IntegrationConnection): Promise<void> | void;
+    listByOwner(owner: IntegrationActor): Promise<IntegrationConnection[]> | IntegrationConnection[];
+    delete?(connectionId: string): Promise<void> | void;
+}
+interface IssueCapabilityRequest {
+    subject: IntegrationActor;
+    connectionId: string;
+    scopes: string[];
+    allowedActions: string[];
+    ttlMs: number;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationCapability {
+    id: string;
+    subject: IntegrationActor;
+    connectionId: string;
+    scopes: string[];
+    allowedActions: string[];
+    issuedAt: string;
+    expiresAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IssuedIntegrationCapability {
+    capability: IntegrationCapability;
+    token: string;
+}
+/**
+ * Wraps every action invocation with cross-cutting discipline (idempotency,
+ * conflict detection, rate-limiting, audit logging). Optional. When set on
+ * the hub, runs BEFORE provider.invokeAction; can short-circuit (return a
+ * result directly) or pass through (call `proceed()` to invoke the provider).
+ *
+ * Why this hook exists: production deployments need conflict-resolution
+ * guarantees that span every provider, gateway, and webhook receiver. The
+ * canonical implementation is a "MutationGuard" that:
+ *   1. Short-circuits on a known idempotency key (returns recorded response).
+ *   2. Refuses same-key-different-args (drift detection).
+ *   3. Wraps `proceed()` and audit-logs the outcome.
+ *   4. Translates upstream conflict signals into a structured result with
+ *      alternatives the agent can act on.
+ *
+ * Implementations live in consumers (every product has different
+ * persistence + telemetry needs); this interface is the contract.
+ */
+interface IntegrationActionGuard {
+    /** Wrap an invokeAction call. Implementations MUST call `proceed()` to
+     *  invoke the underlying provider unless they're returning a cached or
+     *  short-circuited result.
+     *
+     *  @param ctx connection + request the hub is about to dispatch
+     *  @param proceed call to invoke the wrapped provider; returns the
+     *                 underlying IntegrationActionResult
+     *  @returns the result the hub should return to the caller
+     */
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+}
+interface IntegrationGuardContext {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    /** The action descriptor from the connector manifest, if discovered. */
+    action?: IntegrationConnectorAction;
+}
+type IntegrationPolicyDecision = {
+    decision: 'allow';
+    reason: string;
+    metadata?: Record<string, unknown>;
+} | {
+    decision: 'require_approval';
+    reason: string;
+    approval: IntegrationApprovalRequest;
+    metadata?: Record<string, unknown>;
+} | {
+    decision: 'deny';
+    reason: string;
+    metadata?: Record<string, unknown>;
+};
+interface IntegrationApprovalRequest {
+    id: string;
+    connectionId: string;
+    providerId: string;
+    connectorId: string;
+    action: string;
+    actor: IntegrationActor;
+    risk: IntegrationActionRisk;
+    dataClass: IntegrationDataClass;
+    reason: string;
+    requestedAt: string;
+    inputPreview?: unknown;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationPolicyEngine {
+    decide(ctx: IntegrationGuardContext & {
+        subject: IntegrationActor;
+    }): Promise<IntegrationPolicyDecision> | IntegrationPolicyDecision;
+}
+interface IntegrationHubOptions {
+    providers: IntegrationProvider[];
+    store: IntegrationConnectionStore;
+    capabilitySecret: string;
+    /** Optional cross-cutting guard. If provided, every invokeAction call
+     *  passes through it before reaching the provider. See {@link IntegrationActionGuard}. */
+    guard?: IntegrationActionGuard;
+    /** Optional policy engine. Runs after capability/scope checks and before
+     *  provider invocation. Use it to pause writes, deny destructive actions,
+     *  or apply tenant-specific allow rules. */
+    policy?: IntegrationPolicyEngine;
+    now?: () => Date;
+}
+interface HttpIntegrationProviderOptions {
+    id: string;
+    kind?: IntegrationProviderKind;
+    connectors: IntegrationConnector[];
+    baseUrl: string;
+    bearer?: string;
+    fetchImpl?: typeof fetch;
+}
+interface InvokeWithCapabilityRequest extends Omit<IntegrationActionRequest, 'connectionId'> {
+    connectionId?: never;
+}
+declare class IntegrationError extends Error {
+    readonly code: 'provider_not_found' | 'connector_not_found' | 'connection_not_found' | 'connection_not_active' | 'auth_not_supported' | 'capability_invalid' | 'capability_expired' | 'scope_denied' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'approval_required' | 'policy_denied';
+    constructor(message: string, code: 'provider_not_found' | 'connector_not_found' | 'connection_not_found' | 'connection_not_active' | 'auth_not_supported' | 'capability_invalid' | 'capability_expired' | 'scope_denied' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'approval_required' | 'policy_denied');
+}
+declare class InMemoryConnectionStore implements IntegrationConnectionStore {
+    private readonly connections;
+    get(connectionId: string): IntegrationConnection | undefined;
+    put(connection: IntegrationConnection): void;
+    listByOwner(owner: IntegrationActor): IntegrationConnection[];
+    delete(connectionId: string): void;
+}
+declare class IntegrationHub {
+    private readonly providers;
+    private readonly store;
+    private readonly capabilitySecret;
+    private readonly guard;
+    private readonly policy;
+    private readonly now;
+    constructor(options: IntegrationHubOptions);
+    listConnectors(): Promise<IntegrationConnector[]>;
+    listRegistry(options?: ComposeIntegrationRegistryOptions): Promise<IntegrationRegistry>;
+    startAuth(providerId: string, request: StartAuthRequest): Promise<StartAuthResult>;
+    completeAuth(providerId: string, request: CompleteAuthRequest): Promise<IntegrationConnection>;
+    upsertConnection(connection: IntegrationConnection): Promise<IntegrationConnection>;
+    listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]>;
+    issueCapability(request: IssueCapabilityRequest): Promise<IssuedIntegrationCapability>;
+    verifyCapability(token: string): IntegrationCapability;
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult>;
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription>;
+    private requireProvider;
+    private requireConnector;
+    private requireConnection;
+    private assertConnectionActive;
+}
+declare function sanitizeConnection(connection: IntegrationConnection): Record<string, unknown>;
+declare function createMockIntegrationProvider(options?: {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    onInvoke?: (connection: IntegrationConnection, request: IntegrationActionRequest) => IntegrationActionResult | Promise<IntegrationActionResult>;
+}): IntegrationProvider;
+declare function createHttpIntegrationProvider(options: HttpIntegrationProviderOptions): IntegrationProvider;
+declare function signCapability(capability: IntegrationCapability, secret: string): string;
+declare function verifyCapabilityToken(token: string, secret: string): IntegrationCapability;
+
+export { INTEGRATION_FAMILIES as $, type TangleCatalogRuntimeHandlerOptions as A, type TangleCatalogRuntimeHttpRequest as B, type TangleCatalogRuntimeHttpResponse as C, type ComposeIntegrationRegistryOptions, type TangleCatalogRuntimeInvocation as D, type TangleCatalogRuntimeModuleAction as E, type TangleCatalogRuntimePackageCoverageOptions as F, type TangleCatalogRuntimePackageCoverageRow as G, auditTangleCatalogRuntimePackages as H, type IntegrationToolDefinition as I, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, createTangleCatalogCredentialAuthResolver as J, createTangleCatalogHttpAuthResolver as K, createTangleCatalogInstalledPackageExecutor as L, type McpToolDefinition as M, createTangleCatalogRuntimeHandler as N, signTangleCatalogRuntimeRequest as O, tangleCatalogAuthValue as P, verifyTangleCatalogRuntimeSignature as Q, type ApiKeyAuthSpec as R, type ConsoleStep as S, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as T, type CredentialFieldSpec as U, type CredentialValidationInput as V, type CredentialValidationResult as W, type CustomAuthSpec as X, type HealthcheckPlan as Y, type HealthcheckSpec as Z, type HmacAuthSpec as _, type IntegrationToolSearchFilters as a, type HttpIntegrationProviderOptions as a$, type IntegrationAuthMode as a0, type IntegrationAuthSpec as a1, type IntegrationFamilyId as a2, type IntegrationFamilySpec as a3, type IntegrationLifecycleSpec as a4, type IntegrationPlannerHints as a5, type IntegrationSetupSpec as a6, type IntegrationSpec as a7, type IntegrationSpecStatus as a8, type IntegrationSpecValidationIssue as a9, ACTIVEPIECES_PUBLIC_CATALOG_URL as aA, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as aB, type ActivepiecesCatalogAuthField as aC, type ActivepiecesCatalogEntry as aD, type ActivepiecesExecutorInvocation as aE, type ActivepiecesExecutorProviderOptions as aF, type ActivepiecesHttpExecutorOptions as aG, type ActivepiecesPieceOverride as aH, type ActivepiecesRuntimeRequest as aI, ApprovalBackedPolicyEngine as aJ, type ApprovalBackedPolicyOptions as aK, CANONICAL_INTEGRATION_ACTIONS as aL, type CanonicalIntegrationActionId as aM, type CanonicalLaunchConnectorOptions as aN, type CatalogExecutorInvocation as aO, type CatalogExecutorProviderOptions as aP, type CompleteAuthRequest as aQ, type ConnectionCredentialResolverOptions as aR, type ConnectorAdapterProviderOptions as aS, type ConsentSummary as aT, DEFAULT_INTEGRATION_BRIDGE_ENV as aU, DefaultIntegrationActionGuard as aV, type GatewayCatalogAction as aW, type GatewayCatalogEntry as aX, type GatewayCatalogProviderOptions as aY, type GatewayCatalogTrigger as aZ, type GraphqlOperationSpec as a_, type IntegrationSpecValidationResult as aa, type NoneAuthSpec as ab, type NormalizedPermission as ac, type OAuth2AuthSpec as ad, type PermissionDescriptor as ae, type PostSetupCheck as af, type Quirk as ag, type RenderSpecOptions as ah, type RenderedConsoleStep as ai, type ScopeDescriptor as aj, assertValidIntegrationSpec as ak, buildHealthcheckPlan as al, consoleStepsToText as am, getIntegrationFamily as an, getIntegrationSpec as ao, integrationSpecToConnector as ap, listExecutableIntegrationSpecs as aq, listIntegrationSpecs as ar, renderAgentToolDescription as as, renderConsoleSteps as at, renderRunbookMarkdown as au, specAuthToConnectorAuth as av, validateCredentialFormat as aw, validateCredentialSet as ax, validateIntegrationSpec as ay, ACTIVEPIECES_OVERRIDES as az, type IntegrationToolSearchResult as b, type IntegrationRateLimiter as b$, type ImportCatalogOptions as b0, InMemoryConnectionStore as b1, InMemoryIntegrationApprovalStore as b2, InMemoryIntegrationAuditStore as b3, InMemoryIntegrationEventStore as b4, InMemoryIntegrationHealthcheckStore as b5, InMemoryIntegrationIdempotencyStore as b6, InMemoryIntegrationSecretStore as b7, InMemoryIntegrationWorkflowStore as b8, type InferIntegrationRequirementsOptions as b9, type IntegrationConnectorAction as bA, type IntegrationConnectorCategory as bB, type IntegrationConnectorTrigger as bC, type IntegrationCoveragePriority as bD, type IntegrationCoverageSpec as bE, type IntegrationDataClass as bF, IntegrationError as bG, type IntegrationErrorCode as bH, type IntegrationEventStore as bI, type IntegrationGuardContext as bJ, type IntegrationHealthcheckCheck as bK, type IntegrationHealthcheckResult as bL, type IntegrationHealthcheckStatus as bM, type IntegrationHealthcheckStore as bN, IntegrationHub as bO, type IntegrationHubOptions as bP, type IntegrationIdempotencyRecord as bQ, type IntegrationIdempotencyStore as bR, type IntegrationInvocationEnvelope as bS, type IntegrationInvocationEnvelopeValidationOptions as bT, type IntegrationPolicyDecision as bU, type IntegrationPolicyEffect as bV, type IntegrationPolicyEngine as bW, type IntegrationPolicyRule as bX, type IntegrationProvider as bY, type IntegrationProviderKind as bZ, type IntegrationRateLimitDecision as b_, type InstalledIntegrationWorkflow as ba, type IntegrationActionGuard as bb, type IntegrationActionPack as bc, type IntegrationActionRequest as bd, type IntegrationActionResult as be, type IntegrationActionRisk as bf, type IntegrationActor as bg, type IntegrationApprovalFilter as bh, type IntegrationApprovalRecord as bi, type IntegrationApprovalRequest as bj, type IntegrationApprovalResolution as bk, type IntegrationApprovalStatus as bl, type IntegrationApprovalStore as bm, type IntegrationAuditEvent as bn, type IntegrationAuditEventType as bo, type IntegrationAuditFilter as bp, type IntegrationAuditSink as bq, type IntegrationAuditStore as br, type IntegrationBridgePayload as bs, type IntegrationBridgeToolBinding as bt, type IntegrationCapability as bu, buildDefaultIntegrationRegistry, type IntegrationCatalogFreshnessOptions as bv, type IntegrationCatalogFreshnessResult as bw, type IntegrationConnection as bx, type IntegrationConnectionStore as by, type IntegrationConnector as bz, buildIntegrationToolCatalog as c, auditIntegrationCatalogFreshness as c$, IntegrationRuntimeError as c0, IntegrationSandboxHost as c1, type IntegrationSandboxHostHub as c2, type IntegrationSandboxHostOptions as c3, type IntegrationSecretStore as c4, type IntegrationTriggerEvent as c5, type IntegrationTriggerSubscription as c6, type IntegrationUserAction as c7, type IntegrationWebhookReceiverResult as c8, type IntegrationWorkflowDefinition as c9, type StaticIntegrationPolicyOptions as cA, type StoredIntegrationEvent as cB, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cC, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cD, type TangleCatalogExecutorInvocation as cE, type TangleCatalogExecutorProviderOptions as cF, type TangleCatalogHttpExecutorInvocation as cG, type TangleCatalogHttpExecutorOptions as cH, type TangleCatalogRuntimeActionRequest as cI, type TangleCatalogRuntimeNodeServerOptions as cJ, type TangleCatalogRuntimePackageManifest as cK, type TangleCatalogRuntimePackageManifestOptions as cL, type TangleCatalogRuntimePiece as cM, type TangleCatalogRuntimeRequest as cN, type TangleCatalogTriggerInvocation as cO, type TangleIntegrationCatalogEntry as cP, type TangleIntegrationCatalogFreshnessOptions as cQ, type TangleIntegrationCatalogFreshnessResult as cR, type TangleIntegrationContract as cS, type TangleIntegrationContractStatus as cT, type TangleIntegrationImplementationKind as cU, type TangleIntegrationInvokeInput as cV, type TangleIntegrationInvokeResult as cW, TangleIntegrationsClient as cX, type TangleIntegrationsClientOptions as cY, adapterManifestsToConnectors as cZ, assertValidIntegrationManifest as c_, IntegrationWorkflowRuntime as ca, canonicalConnectorId, type IntegrationWorkflowRuntimeHub as cb, type IntegrationWorkflowRuntimeOptions as cc, type IntegrationWorkflowStore as cd, type InvokeWithCapabilityRequest as ce, type IssueCapabilityRequest as cf, type IssuedIntegrationCapability as cg, type ManifestValidationIssue as ch, type ManifestValidationResult as ci, type McpCatalog as cj, type McpCatalogTool as ck, type MissingRequirementExplanation as cl, type NormalizedIntegrationError as cm, type NormalizedIntegrationResult as cn, type OpenApiDocument as co, composeIntegrationRegistry, type OpenApiOperation as cp, PROVIDER_PASSTHROUGH_ACTION as cq, type PlatformIntegrationPolicyPresetOptions as cr, type ProviderHttpRequestInput as cs, type ProviderPassthroughPolicy as ct, type RenderConsentOptions as cu, type SecretRef as cv, type StartAuthRequest as cw, type StartAuthResult as cx, type StartedTangleCatalogRuntimeNodeServer as cy, StaticIntegrationPolicyEngine as cz, InMemoryIntegrationGrantStore as d, redactIntegrationBridgePayload as d$, auditTangleIntegrationCatalogFreshness as d0, buildActivepiecesConnectors as d1, buildActivepiecesRuntimeRequest as d2, buildApprovalRequest as d3, buildCanonicalLaunchConnectors as d4, buildIntegrationBridgeEnvironment as d5, buildIntegrationBridgePayload as d6, buildIntegrationCoverageConnectors as d7, buildIntegrationInvocationEnvelope as d8, buildTangleCatalogRuntimePackageManifest as d9, decodeIntegrationBridgePayload as dA, dispatchIntegrationInvocation as dB, encodeIntegrationBridgePayload as dC, explainMissingRequirements as dD, extractActivepiecesPublicPieceCount as dE, extractExternalCatalogPublicCount as dF, getActivepiecesOverride as dG, healthcheckRequest as dH, importGraphqlConnector as dI, importMcpConnector as dJ, importOpenApiConnector as dK, inferIntegrationManifestFromTools as dL, integrationCoverageChecklistMarkdown as dM, invocationRequestFromEnvelope as dN, listActivepiecesCatalogEntries as dO, listIntegrationCoverageSpecs as dP, listTangleIntegrationCatalogEntries as dQ, listTangleIntegrationCatalogRuntimePackages as dR, listTangleIntegrationContracts as dS, manifestToConnector as dT, normalizeGatewayCatalog as dU, normalizeIntegrationError as dV, normalizeIntegrationResult as dW, parseIntegrationBridgeEnvironment as dX, receiveIntegrationWebhook as dY, redactApprovalRequest as dZ, redactCapability as d_, buildTangleCatalogRuntimeRequest as da, buildTangleIntegrationCatalogConnectors as db, calendarExercisePlannerManifest as dc, canonicalActionConnectorId as dd, createActivepiecesExecutorProvider as de, createActivepiecesHttpExecutor as df, createApprovalBackedPolicyEngine as dg, createAuditingActionGuard as dh, createCatalogExecutorProvider as di, createConnectionCredentialResolver as dj, createConnectorAdapterCatalogSource as dk, createConnectorAdapterProvider as dl, createCredentialBackedAdapterProvider as dm, createDefaultIntegrationActionGuard as dn, createDefaultIntegrationPolicyEngine as dp, createGatewayCatalogProvider as dq, createHttpIntegrationProvider as dr, createIntegrationAuditEvent as ds, createIntegrationWorkflowRuntime as dt, createMockIntegrationProvider as du, createPlatformIntegrationPolicyPreset as dv, createTangleCatalogExecutorProvider as dw, createTangleCatalogHttpExecutor as dx, createTangleCatalogRuntimeNodeRequestListener as dy, createTangleIntegrationsClient as dz, type IntegrationCapabilityBinding as e, redactInvocationEnvelope as e0, renderApprovalCopy as e1, renderConsentSummary as e2, renderTangleCatalogRuntimePnpmAddCommand as e3, resolveConnectionCredentials as e4, resolveIntegrationApproval as e5, revokeConnection as e6, runIntegrationHealthcheck as e7, runIntegrationHealthchecks as e8, sanitizeAuditConnection as e9, sanitizeConnection as ea, signActivepiecesRuntimeRequest as eb, signCapability as ec, startTangleCatalogRuntimeNodeServer as ed, statusForCode as ee, storedEventToTriggerEvent as ef, validateIntegrationInvocationEnvelope as eg, validateIntegrationManifest as eh, validateProviderPassthroughRequest as ei, verifyActivepiecesRuntimeSignature as ej, verifyCapabilityToken as ek, type IntegrationGrant as f, type IntegrationGrantStore as g, type IntegrationManifest as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationManifestResolution as j, type IntegrationRequirement as k, type IntegrationRequirementMode as l, type IntegrationRequirementResolution as m, type IntegrationRequirementStatus as n, IntegrationRuntime as o, parseIntegrationToolName as p, type IntegrationRuntimeHub as q, type IntegrationRuntimeOptions as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationSandboxBundle as u, createIntegrationRuntime as v, type TangleCatalogAuthResolverOptions as w, type TangleCatalogHttpAuthResolverOptions as x, type TangleCatalogHttpAuthResolverRequest as y, type TangleCatalogInstalledPackageExecutorOptions as z };