@tangle-network/agent-integrations 0.25.4 → 0.25.6

package/dist/bin/tangle-catalog-runtime.js

@@ -4,12 +4,10 @@ import {
   buildTangleCatalogRuntimePackageManifest,
   renderTangleCatalogRuntimePnpmAddCommand,
   startTangleCatalogRuntimeNodeServer
-} from "../chunk-IOO75SJH.js";
-import "../chunk-FQAT4IEE.js";
-import "../chunk-6KWCC42J.js";
+} from "../chunk-S54DPRDU.js";
 import "../chunk-4JQ754PA.js";
 import "../chunk-376UBTNB.js";
-import "../chunk-IDX3KIPA.js";
+import "../chunk-WC63AI4Q.js";
 
 // src/bin/tangle-catalog-runtime.ts
 var args = new Set(process.argv.slice(2));

package/dist/bin/tangle-catalog-runtime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/bin/tangle-catalog-runtime.ts"],"sourcesContent":["#!/usr/bin/env node\nimport {\n  buildTangleCatalogRuntimePackageManifest,\n  renderTangleCatalogRuntimePnpmAddCommand,\n} from '../tangle-catalog.js'\nimport { auditTangleCatalogRuntimePackages } from '../tangle-catalog-runtime.js'\nimport { startTangleCatalogRuntimeNodeServer } from '../tangle-catalog-runtime-server.js'\n\nconst args = new Set(process.argv.slice(2))\nif (args.has('--print-package-json')) {\n  console.log(JSON.stringify(buildTangleCatalogRuntimePackageManifest({\n    agentIntegrationsVersion: process.env.TANGLE_AGENT_INTEGRATIONS_VERSION,\n  }), null, 2))\n  process.exit(0)\n}\n\nif (args.has('--print-pnpm-add')) {\n  console.log(renderTangleCatalogRuntimePnpmAddCommand({\n    agentIntegrationsVersion: process.env.TANGLE_AGENT_INTEGRATIONS_VERSION,\n  }))\n  process.exit(0)\n}\n\nif (args.has('--audit-packages')) {\n  const connectorIds = process.env.TANGLE_CATALOG_AUDIT_CONNECTORS\n    ?.split(',')\n    .map((id) => id.trim())\n    .filter(Boolean)\n  console.log(JSON.stringify(await auditTangleCatalogRuntimePackages({ connectorIds }), null, 2))\n  process.exit(0)\n}\n\nconst secret = process.env.TANGLE_CATALOG_RUNTIME_SECRET\nif (!secret || secret.length < 32) {\n  console.error('TANGLE_CATALOG_RUNTIME_SECRET must be set to at least 32 characters.')\n  process.exit(1)\n}\n\nconst authResolverUrl = process.env.TANGLE_CATALOG_AUTH_RESOLVER_URL\nconst authResolverSecret = process.env.TANGLE_CATALOG_AUTH_RESOLVER_SECRET\nif (Boolean(authResolverUrl) !== Boolean(authResolverSecret)) {\n  console.error('TANGLE_CATALOG_AUTH_RESOLVER_URL and TANGLE_CATALOG_AUTH_RESOLVER_SECRET must be set together.')\n  process.exit(1)\n}\n\nconst port = Number(process.env.PORT ?? process.env.TANGLE_CATALOG_RUNTIME_PORT ?? 4109)\nif (!Number.isInteger(port) || port < 1 || port > 65_535) {\n  console.error('PORT must be an integer between 1 and 65535.')\n  process.exit(1)\n}\n\nconst server = await startTangleCatalogRuntimeNodeServer({\n  secret,\n  host: process.env.HOST ?? process.env.TANGLE_CATALOG_RUNTIME_HOST ?? '0.0.0.0',\n  port,\n  authResolver: authResolverUrl && authResolverSecret\n    ? {\n        endpoint: authResolverUrl,\n        secret: authResolverSecret,\n      }\n    : false,\n  onLog: (event) => {\n    const line = JSON.stringify({\n      level: event.level,\n      message: event.message,\n      ...event.metadata,\n    })\n    if (event.level === 'error') console.error(line)\n    else console.log(line)\n  },\n})\n\nconsole.log(JSON.stringify({\n  level: 'info',\n  message: 'Tangle catalog runtime listening.',\n  url: server.url,\n}))\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.once(signal, async () => {\n    await server.close()\n    process.exit(0)\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,IAAM,OAAO,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC1C,IAAI,KAAK,IAAI,sBAAsB,GAAG;AACpC,UAAQ,IAAI,KAAK,UAAU,yCAAyC;AAAA,IAClE,0BAA0B,QAAQ,IAAI;AAAA,EACxC,CAAC,GAAG,MAAM,CAAC,CAAC;AACZ,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAI,KAAK,IAAI,kBAAkB,GAAG;AAChC,UAAQ,IAAI,yCAAyC;AAAA,IACnD,0BAA0B,QAAQ,IAAI;AAAA,EACxC,CAAC,CAAC;AACF,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAI,KAAK,IAAI,kBAAkB,GAAG;AAChC,QAAM,eAAe,QAAQ,IAAI,iCAC7B,MAAM,GAAG,EACV,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AACjB,UAAQ,IAAI,KAAK,UAAU,MAAM,kCAAkC,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,CAAC;AAC9F,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,QAAQ,IAAI;AAC3B,IAAI,CAAC,UAAU,OAAO,SAAS,IAAI;AACjC,UAAQ,MAAM,sEAAsE;AACpF,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,kBAAkB,QAAQ,IAAI;AACpC,IAAM,qBAAqB,QAAQ,IAAI;AACvC,IAAI,QAAQ,eAAe,MAAM,QAAQ,kBAAkB,GAAG;AAC5D,UAAQ,MAAM,gGAAgG;AAC9G,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,OAAO,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,+BAA+B,IAAI;AACvF,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAQ;AACxD,UAAQ,MAAM,8CAA8C;AAC5D,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,MAAM,oCAAoC;AAAA,EACvD;AAAA,EACA,MAAM,QAAQ,IAAI,QAAQ,QAAQ,IAAI,+BAA+B;AAAA,EACrE;AAAA,EACA,cAAc,mBAAmB,qBAC7B;AAAA,IACE,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,IACA;AAAA,EACJ,OAAO,CAAC,UAAU;AAChB,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,GAAG,MAAM;AAAA,IACX,CAAC;AACD,QAAI,MAAM,UAAU,QAAS,SAAQ,MAAM,IAAI;AAAA,QAC1C,SAAQ,IAAI,IAAI;AAAA,EACvB;AACF,CAAC;AAED,QAAQ,IAAI,KAAK,UAAU;AAAA,EACzB,OAAO;AAAA,EACP,SAAS;AAAA,EACT,KAAK,OAAO;AACd,CAAC,CAAC;AAEF,WAAW,UAAU,CAAC,UAAU,SAAS,GAAY;AACnD,UAAQ,KAAK,QAAQ,YAAY;AAC/B,UAAM,OAAO,MAAM;AACnB,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/bin/tangle-catalog-runtime.ts"],"sourcesContent":["#!/usr/bin/env node\nimport {\n  buildTangleCatalogRuntimePackageManifest,\n  renderTangleCatalogRuntimePnpmAddCommand,\n} from '../tangle-catalog.js'\nimport { auditTangleCatalogRuntimePackages } from '../tangle-catalog-runtime.js'\nimport { startTangleCatalogRuntimeNodeServer } from '../tangle-catalog-runtime-server.js'\n\nconst args = new Set(process.argv.slice(2))\nif (args.has('--print-package-json')) {\n  console.log(JSON.stringify(buildTangleCatalogRuntimePackageManifest({\n    agentIntegrationsVersion: process.env.TANGLE_AGENT_INTEGRATIONS_VERSION,\n  }), null, 2))\n  process.exit(0)\n}\n\nif (args.has('--print-pnpm-add')) {\n  console.log(renderTangleCatalogRuntimePnpmAddCommand({\n    agentIntegrationsVersion: process.env.TANGLE_AGENT_INTEGRATIONS_VERSION,\n  }))\n  process.exit(0)\n}\n\nif (args.has('--audit-packages')) {\n  const connectorIds = process.env.TANGLE_CATALOG_AUDIT_CONNECTORS\n    ?.split(',')\n    .map((id) => id.trim())\n    .filter(Boolean)\n  console.log(JSON.stringify(await auditTangleCatalogRuntimePackages({ connectorIds }), null, 2))\n  process.exit(0)\n}\n\nconst secret = process.env.TANGLE_CATALOG_RUNTIME_SECRET\nif (!secret || secret.length < 32) {\n  console.error('TANGLE_CATALOG_RUNTIME_SECRET must be set to at least 32 characters.')\n  process.exit(1)\n}\n\nconst authResolverUrl = process.env.TANGLE_CATALOG_AUTH_RESOLVER_URL\nconst authResolverSecret = process.env.TANGLE_CATALOG_AUTH_RESOLVER_SECRET\nif (Boolean(authResolverUrl) !== Boolean(authResolverSecret)) {\n  console.error('TANGLE_CATALOG_AUTH_RESOLVER_URL and TANGLE_CATALOG_AUTH_RESOLVER_SECRET must be set together.')\n  process.exit(1)\n}\n\nconst port = Number(process.env.PORT ?? process.env.TANGLE_CATALOG_RUNTIME_PORT ?? 4109)\nif (!Number.isInteger(port) || port < 1 || port > 65_535) {\n  console.error('PORT must be an integer between 1 and 65535.')\n  process.exit(1)\n}\n\nconst server = await startTangleCatalogRuntimeNodeServer({\n  secret,\n  host: process.env.HOST ?? process.env.TANGLE_CATALOG_RUNTIME_HOST ?? '0.0.0.0',\n  port,\n  authResolver: authResolverUrl && authResolverSecret\n    ? {\n        endpoint: authResolverUrl,\n        secret: authResolverSecret,\n      }\n    : false,\n  onLog: (event) => {\n    const line = JSON.stringify({\n      level: event.level,\n      message: event.message,\n      ...event.metadata,\n    })\n    if (event.level === 'error') console.error(line)\n    else console.log(line)\n  },\n})\n\nconsole.log(JSON.stringify({\n  level: 'info',\n  message: 'Tangle catalog runtime listening.',\n  url: server.url,\n}))\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.once(signal, async () => {\n    await server.close()\n    process.exit(0)\n  })\n}\n"],"mappings":";;;;;;;;;;;;AAQA,IAAM,OAAO,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC1C,IAAI,KAAK,IAAI,sBAAsB,GAAG;AACpC,UAAQ,IAAI,KAAK,UAAU,yCAAyC;AAAA,IAClE,0BAA0B,QAAQ,IAAI;AAAA,EACxC,CAAC,GAAG,MAAM,CAAC,CAAC;AACZ,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAI,KAAK,IAAI,kBAAkB,GAAG;AAChC,UAAQ,IAAI,yCAAyC;AAAA,IACnD,0BAA0B,QAAQ,IAAI;AAAA,EACxC,CAAC,CAAC;AACF,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAI,KAAK,IAAI,kBAAkB,GAAG;AAChC,QAAM,eAAe,QAAQ,IAAI,iCAC7B,MAAM,GAAG,EACV,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AACjB,UAAQ,IAAI,KAAK,UAAU,MAAM,kCAAkC,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,CAAC;AAC9F,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,QAAQ,IAAI;AAC3B,IAAI,CAAC,UAAU,OAAO,SAAS,IAAI;AACjC,UAAQ,MAAM,sEAAsE;AACpF,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,kBAAkB,QAAQ,IAAI;AACpC,IAAM,qBAAqB,QAAQ,IAAI;AACvC,IAAI,QAAQ,eAAe,MAAM,QAAQ,kBAAkB,GAAG;AAC5D,UAAQ,MAAM,gGAAgG;AAC9G,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,OAAO,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,+BAA+B,IAAI;AACvF,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAQ;AACxD,UAAQ,MAAM,8CAA8C;AAC5D,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,SAAS,MAAM,oCAAoC;AAAA,EACvD;AAAA,EACA,MAAM,QAAQ,IAAI,QAAQ,QAAQ,IAAI,+BAA+B;AAAA,EACrE;AAAA,EACA,cAAc,mBAAmB,qBAC7B;AAAA,IACE,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,IACA;AAAA,EACJ,OAAO,CAAC,UAAU;AAChB,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM;AAAA,MACf,GAAG,MAAM;AAAA,IACX,CAAC;AACD,QAAI,MAAM,UAAU,QAAS,SAAQ,MAAM,IAAI;AAAA,QAC1C,SAAQ,IAAI,IAAI;AAAA,EACvB;AACF,CAAC;AAED,QAAQ,IAAI,KAAK,UAAU;AAAA,EACzB,OAAO;AAAA,EACP,SAAS;AAAA,EACT,KAAK,OAAO;AACd,CAAC,CAAC;AAEF,WAAW,UAAU,CAAC,UAAU,SAAS,GAAY;AACnD,UAAQ,KAAK,QAAQ,YAAY;AAC/B,UAAM,OAAO,MAAM;AACnB,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;","names":[]}

package/dist/catalog.d.ts

@@ -1,4 +1,4 @@
-export { I as IntegrationToolDefinition, a as IntegrationToolSearchFilters, b as IntegrationToolSearchResult, M as McpToolDefinition, c as buildIntegrationToolCatalog, i as integrationToolName, p as parseIntegrationToolName, s as searchIntegrationTools, t as toMcpTools } from './registry.js';
-import './index-BNb1A0Id.js';
+export { I as IntegrationCatalogView, a as IntegrationToolDefinition, b as IntegrationToolSearchFilters, c as IntegrationToolSearchResult, M as McpToolDefinition, d as buildIntegrationCatalogView, e as buildIntegrationToolCatalog, i as integrationToolName, p as parseIntegrationToolName, s as searchIntegrationTools, t as toMcpTools } from './registry.js';
+import './index-BQY5ry2s.js';
 import './connectors/index.js';
 import 'node:http';

package/dist/catalog.js

@@ -1,11 +1,16 @@
 import {
+  buildIntegrationCatalogView,
   buildIntegrationToolCatalog,
   integrationToolName,
   parseIntegrationToolName,
   searchIntegrationTools,
   toMcpTools
-} from "./chunk-6KWCC42J.js";
+} from "./chunk-S54DPRDU.js";
+import "./chunk-4JQ754PA.js";
+import "./chunk-376UBTNB.js";
+import "./chunk-WC63AI4Q.js";
 export {
+  buildIntegrationCatalogView,
   buildIntegrationToolCatalog,
   integrationToolName,
   parseIntegrationToolName,

package/dist/{chunk-IOO75SJH.js → chunk-S54DPRDU.js}

@@ -1,7 +1,3 @@
-import {
-  buildIntegrationToolCatalog,
-  parseIntegrationToolName
-} from "./chunk-6KWCC42J.js";
 import {
   integrationSpecToConnector,
   listIntegrationSpecs
@@ -1222,6 +1218,9 @@ async function receiveIntegrationWebhook(input) {
   if (!input.adapter.handleInboundEvent) {
     return { status: 405, body: { ok: false, error: "Connector does not support inbound webhooks." }, received: [], duplicates: [] };
   }
+  if (!input.adapter.verifySignature && !input.allowUnsignedWebhook) {
+    return { status: 401, body: { ok: false, error: "Webhook signature verification is required." }, received: [], duplicates: [] };
+  }
   const signature = input.adapter.verifySignature?.({
     rawBody: input.rawBody,
     headers: input.headers,
@@ -1305,16 +1304,28 @@ var DefaultIntegrationActionGuard = class {
   idempotency;
   audit;
   rateLimiter;
+  requireIdempotencyForMutations;
   now;
   constructor(options = {}) {
     this.idempotency = options.idempotency;
     this.audit = options.audit;
     this.rateLimiter = options.rateLimiter;
+    this.requireIdempotencyForMutations = options.requireIdempotencyForMutations ?? false;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
   }
   async invokeAction(ctx, proceed) {
     const idempotencyKey = ctx.request.idempotencyKey;
     const requestHash = hashRequest(ctx);
+    if (this.requireIdempotencyForMutations && ctx.action?.risk !== "read" && !idempotencyKey) {
+      return {
+        ok: false,
+        action: ctx.request.action,
+        output: {
+          idempotencyRequired: true,
+          message: "State-changing integration actions require an idempotency key."
+        }
+      };
+    }
     if (idempotencyKey && this.idempotency) {
       const existing = await this.idempotency.get(idempotencyKey);
       if (existing) {
@@ -2934,6 +2945,263 @@ async function checkActivepiecesPublicCatalog(input) {
   }
 }
 
+// src/runtime.ts
+var InMemoryIntegrationGrantStore = class {
+  grants = /* @__PURE__ */ new Map();
+  get(grantId) {
+    return this.grants.get(grantId);
+  }
+  put(grant) {
+    this.grants.set(grant.id, grant);
+  }
+  listByManifest(manifestId, grantee) {
+    return [...this.grants.values()].filter(
+      (grant) => grant.manifestId === manifestId && (!grantee || sameActor(grant.grantee, grantee))
+    );
+  }
+  listByGrantee(grantee) {
+    return [...this.grants.values()].filter((grant) => sameActor(grant.grantee, grantee));
+  }
+  listByIds(grantIds) {
+    const wanted = new Set(grantIds);
+    return [...this.grants.values()].filter((grant) => wanted.has(grant.id));
+  }
+  delete(grantId) {
+    this.grants.delete(grantId);
+  }
+};
+var IntegrationRuntime = class {
+  hub;
+  grants;
+  now;
+  constructor(options) {
+    this.hub = options.hub;
+    this.grants = options.grants ?? new InMemoryIntegrationGrantStore();
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async registry() {
+    return this.hub.listRegistry();
+  }
+  async resolveManifest(manifest, owner) {
+    const registry = await this.registry();
+    const connections = await this.hub.listConnections(owner);
+    const resolutions = manifest.requirements.map(
+      (requirement) => resolveRequirement(requirement, owner, registry, connections)
+    );
+    return {
+      manifest,
+      owner,
+      ready: resolutions.filter((resolution) => resolution.status === "ready"),
+      missing: resolutions.filter((resolution) => resolution.status !== "ready" && !resolution.requirement.optional),
+      optionalMissing: resolutions.filter((resolution) => resolution.status !== "ready" && resolution.requirement.optional === true)
+    };
+  }
+  async createGrants(input) {
+    const resolution = await this.resolveManifest(input.manifest, input.owner);
+    if (resolution.missing.length > 0) {
+      throw new Error(`Cannot create integration grants; missing requirements: ${resolution.missing.map((r) => r.requirement.id).join(", ")}`);
+    }
+    const now = this.now().toISOString();
+    const grants = resolution.ready.map((ready) => ({
+      id: `grant_${input.manifest.id}_${ready.requirement.id}_${ready.connection.id}`,
+      manifestId: input.manifest.id,
+      requirementId: ready.requirement.id,
+      owner: input.owner,
+      grantee: input.grantee,
+      connectionId: ready.connection.id,
+      connectorId: ready.connector.id,
+      scopes: requiredScopes(ready.requirement, ready.connector),
+      allowedActions: requiredActions(ready.requirement, ready.connector),
+      allowedTriggers: requiredTriggers(ready.requirement, ready.connector),
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+      metadata: input.metadata
+    }));
+    for (const grant of grants) await this.grants.put(grant);
+    return grants;
+  }
+  async buildSandboxBundle(input) {
+    const grants = await this.resolveBundleGrants(input);
+    if (grants.length === 0) {
+      throw new Error("Cannot build integration bundle; no active integration grants matched the request.");
+    }
+    const registry = await this.registry();
+    const bindings = [];
+    const connectors = [];
+    let expiresAt = "";
+    for (const grant of grants) {
+      const connection = await this.hub.getConnection(grant.connectionId);
+      if (!connection) {
+        throw new Error(`Cannot build integration bundle; connection ${grant.connectionId} not found.`);
+      }
+      if (!sameActor(connection.owner, input.owner)) {
+        throw new Error(`Cannot build integration bundle; connection ${connection.id} belongs to a different owner.`);
+      }
+      if (connection.status !== "active") {
+        throw new Error(`Cannot build integration bundle; connection ${connection.id} is ${connection.status}.`);
+      }
+      const entry = registry.byId.get(grant.connectorId);
+      if (!entry) continue;
+      const connector = {
+        ...entry.connector,
+        actions: entry.connector.actions.filter((action) => grant.allowedActions.includes(action.id)),
+        triggers: entry.connector.triggers?.filter((trigger2) => grant.allowedTriggers.includes(trigger2.id)),
+        scopes: entry.connector.scopes.filter((scope) => grant.scopes.includes(scope))
+      };
+      const capability = await this.hub.issueCapability({
+        subject: input.subject,
+        connectionId: grant.connectionId,
+        scopes: grant.scopes,
+        allowedActions: grant.allowedActions,
+        ttlMs: input.ttlMs,
+        metadata: {
+          manifestId: grant.manifestId,
+          grantId: grant.id,
+          requirementId: grant.requirementId
+        }
+      });
+      bindings.push({
+        requirementId: grant.requirementId,
+        connectorId: grant.connectorId,
+        connectionId: grant.connectionId,
+        grantId: grant.id,
+        scopes: grant.scopes,
+        allowedActions: grant.allowedActions,
+        allowedTriggers: grant.allowedTriggers,
+        capability
+      });
+      connectors.push(connector);
+      expiresAt = capability.capability.expiresAt;
+    }
+    return {
+      manifestId: input.manifestId ?? grants[0]?.manifestId ?? "explicit-grants",
+      subject: input.subject,
+      capabilities: bindings,
+      connectors,
+      tools: buildIntegrationToolCatalog(connectors),
+      expiresAt
+    };
+  }
+  async resolveBundleGrants(input) {
+    if (input.grantIds?.length) {
+      const uniqueGrantIds = unique5(input.grantIds);
+      const grants = this.grants.listByIds ? await this.grants.listByIds(uniqueGrantIds) : await Promise.all(uniqueGrantIds.map((grantId) => this.grants.get(grantId)));
+      const found = grants.filter((grant) => Boolean(grant));
+      const foundIds = new Set(found.map((grant) => grant.id));
+      const missing2 = uniqueGrantIds.filter((grantId) => !foundIds.has(grantId));
+      if (missing2.length > 0) {
+        throw new Error(`Cannot build integration bundle; unknown grant id(s): ${missing2.join(", ")}`);
+      }
+      const badOwner = found.find((grant) => !sameActor(grant.owner, input.owner));
+      if (badOwner) {
+        throw new Error(`Cannot build integration bundle; grant ${badOwner.id} belongs to a different owner.`);
+      }
+      const badGrantee = input.grantee ? found.find((grant) => !sameActor(grant.grantee, input.grantee)) : void 0;
+      if (badGrantee) {
+        throw new Error(`Cannot build integration bundle; grant ${badGrantee.id} belongs to a different grantee.`);
+      }
+      const badManifest = input.manifestId ? found.find((grant) => grant.manifestId !== input.manifestId) : void 0;
+      if (badManifest) {
+        throw new Error(`Cannot build integration bundle; grant ${badManifest.id} is not for manifest ${input.manifestId}.`);
+      }
+      const inactive = found.find((grant) => grant.status !== "active");
+      if (inactive) {
+        throw new Error(`Cannot build integration bundle; grant ${inactive.id} is ${inactive.status}.`);
+      }
+      return found;
+    }
+    if (!input.manifestId) {
+      throw new Error("Cannot build integration bundle; manifestId or grantIds is required.");
+    }
+    return (await this.grants.listByManifest(input.manifestId, input.grantee)).filter((grant) => sameActor(grant.owner, input.owner)).filter((grant) => grant.status === "active");
+  }
+};
+function createIntegrationRuntime(options) {
+  return new IntegrationRuntime(options);
+}
+function resolveRequirement(requirement, owner, registry, connections) {
+  const entry = registry.byId.get(requirement.connectorId);
+  if (!entry) {
+    return missing(requirement, "unknown_connector", `Unknown connector ${requirement.connectorId}.`);
+  }
+  const connector = entry.connector;
+  if (connector.actions.length === 0 && (connector.triggers?.length ?? 0) === 0) {
+    return missing(requirement, "not_executable", `${connector.title} is catalog-only and cannot be invoked yet.`, connector, entry);
+  }
+  const scopes = requiredScopes(requirement, connector);
+  const actions = requiredActions(requirement, connector);
+  const triggers = requiredTriggers(requirement, connector);
+  const connection = connections.find(
+    (candidate) => sameActor(candidate.owner, owner) && candidate.status === "active" && (candidate.connectorId === connector.id || entry.aliases.includes(candidate.connectorId)) && scopes.every((scope) => candidate.grantedScopes.includes(scope))
+  );
+  if (!connection) {
+    return {
+      requirement,
+      status: "missing_connection",
+      connector,
+      registryEntry: entry,
+      missingScopes: scopes,
+      missingActions: actions,
+      missingTriggers: triggers,
+      message: `${connector.title} needs an active user connection with the required scopes.`
+    };
+  }
+  return {
+    requirement,
+    status: "ready",
+    connector,
+    registryEntry: entry,
+    connection,
+    missingScopes: [],
+    missingActions: [],
+    missingTriggers: [],
+    message: `${connector.title} is ready.`
+  };
+}
+function missing(requirement, status, message, connector, registryEntry2) {
+  return {
+    requirement,
+    status,
+    connector,
+    registryEntry: registryEntry2,
+    missingScopes: [],
+    missingActions: [],
+    missingTriggers: [],
+    message
+  };
+}
+function requiredActions(requirement, connector) {
+  if (requirement.mode === "trigger") return [];
+  if (requirement.requiredActions?.length) return unique5(requirement.requiredActions);
+  const actions = connector.actions.filter((action) => {
+    if (requirement.mode === "read") return action.risk === "read";
+    if (requirement.mode === "write") return action.risk === "write";
+    return false;
+  });
+  return unique5(actions.map((action) => action.id));
+}
+function requiredTriggers(requirement, connector) {
+  if (requirement.requiredTriggers?.length) return unique5(requirement.requiredTriggers);
+  if (requirement.mode !== "trigger") return [];
+  return unique5((connector.triggers ?? []).map((trigger2) => trigger2.id));
+}
+function requiredScopes(requirement, connector) {
+  if (requirement.requiredScopes?.length) return unique5(requirement.requiredScopes);
+  const actionIds = new Set(requiredActions(requirement, connector));
+  const triggerIds = new Set(requiredTriggers(requirement, connector));
+  return unique5([
+    ...connector.actions.filter((action) => actionIds.has(action.id)).flatMap((action) => action.requiredScopes),
+    ...(connector.triggers ?? []).filter((trigger2) => triggerIds.has(trigger2.id)).flatMap((trigger2) => trigger2.requiredScopes)
+  ]);
+}
+function sameActor(a, b) {
+  return a.type === b.type && a.id === b.id;
+}
+function unique5(values) {
+  return [...new Set(values)];
+}
+
 // src/workflow.ts
 var InMemoryIntegrationWorkflowStore = class {
   workflows = /* @__PURE__ */ new Map();
@@ -2950,7 +3218,7 @@ var InMemoryIntegrationWorkflowStore = class {
     return [...this.workflows.values()].filter((workflow) => workflow.workflowId === workflowId);
   }
   listByOwner(owner) {
-    return [...this.workflows.values()].filter((workflow) => sameActor(workflow.owner, owner));
+    return [...this.workflows.values()].filter((workflow) => sameActor2(workflow.owner, owner));
   }
 };
 var IntegrationWorkflowRuntime = class {
@@ -3012,7 +3280,7 @@ function findTriggerGrant(grants, requirementId, triggerId) {
   if (!grant) throw new Error(`Missing trigger grant ${requirementId}/${triggerId}.`);
   return grant;
 }
-function sameActor(a, b) {
+function sameActor2(a, b) {
   return a.type === b.type && a.id === b.id;
 }
 
@@ -3091,6 +3359,9 @@ var IntegrationHub = class {
   async listConnections(owner) {
     return this.store.listByOwner(owner);
   }
+  async getConnection(connectionId) {
+    return this.store.get(connectionId);
+  }
   async issueCapability(request) {
     const connection = await this.requireConnection(request.connectionId);
     this.assertConnectionActive(connection);
@@ -3100,8 +3371,8 @@ var IntegrationHub = class {
       id: `cap_${randomUUID5()}`,
       subject: request.subject,
       connectionId: request.connectionId,
-      scopes: unique5(request.scopes),
-      allowedActions: unique5(request.allowedActions),
+      scopes: unique6(request.scopes),
+      allowedActions: unique6(request.allowedActions),
       issuedAt: now.toISOString(),
       expiresAt: new Date(now.getTime() + request.ttlMs).toISOString(),
       metadata: request.metadata
@@ -3329,9 +3600,9 @@ async function postJson(fetcher, url, body, bearer) {
   if (!response.ok) throw new IntegrationError(`Integration provider returned HTTP ${response.status}.`, "provider_not_found");
   return response.json();
 }
-function assertScopes(connection, requiredScopes) {
-  const missing = requiredScopes.filter((scope) => !connection.grantedScopes.includes(scope));
-  if (missing.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing.join(", ")}`, "scope_denied");
+function assertScopes(connection, requiredScopes2) {
+  const missing2 = requiredScopes2.filter((scope) => !connection.grantedScopes.includes(scope));
+  if (missing2.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing2.join(", ")}`, "scope_denied");
 }
 function hmac(payload, secret) {
   return createHmac2("sha256", secret).update(payload).digest("base64url");
@@ -3347,7 +3618,7 @@ function base64UrlEncode(value) {
 function base64UrlDecode(value) {
   return Buffer.from(value, "base64url").toString("utf8");
 }
-function unique5(values) {
+function unique6(values) {
   return [...new Set(values)];
 }
 
@@ -3770,12 +4041,12 @@ function registryEntry(canonicalId, candidates, precedence, aliases) {
   const primary = ordered[0];
   const actions = mergeActions(ordered);
   const triggers = mergeTriggers(ordered);
-  const scopes = unique6(toolBindableCandidates(ordered).flatMap((candidate) => candidate.connector.scopes ?? []));
+  const scopes = unique7(toolBindableCandidates(ordered).flatMap((candidate) => candidate.connector.scopes ?? []));
   const supportTier = ordered.reduce(
     (best, candidate) => SUPPORT_RANK[candidate.supportTier] > SUPPORT_RANK[best] ? candidate.supportTier : best,
     primary.supportTier
   );
-  const aliasesForEntry = unique6([
+  const aliasesForEntry = unique7([
     ...ordered.map((candidate) => candidate.connector.id),
     ...Object.entries(aliases).filter(([, target]) => canonicalConnectorId(target, aliases) === canonicalId).map(([alias]) => alias)
   ].map(slug2).filter((id) => id && id !== canonicalId)).sort();
@@ -3871,9 +4142,157 @@ function isSupportTier(value) {
 function slug2(value) {
   return value.trim().toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function unique6(values) {
+function unique7(values) {
+  return [...new Set(values)];
+}
+
+// src/catalog.ts
+var riskRank2 = {
+  read: 0,
+  write: 1,
+  destructive: 2
+};
+function integrationToolName(providerId, connectorId, actionId) {
+  return `int_${encodeToolPart(providerId)}_${encodeToolPart(connectorId)}_${encodeToolPart(actionId)}`;
+}
+function parseIntegrationToolName(name) {
+  const parts = name.split("_");
+  if (parts.length !== 4 || parts[0] !== "int") {
+    throw new Error(`Invalid integration tool name: ${name}`);
+  }
+  return {
+    providerId: decodeToolPart(parts[1]),
+    connectorId: decodeToolPart(parts[2]),
+    actionId: decodeToolPart(parts[3])
+  };
+}
+function buildIntegrationToolCatalog(connectors) {
+  const tools = [];
+  for (const connector of connectors) {
+    for (const action of connector.actions) {
+      const tags = unique8([
+        connector.id,
+        connector.providerId,
+        connector.title,
+        connector.category,
+        action.id,
+        action.title,
+        action.risk,
+        action.dataClass,
+        ...connector.scopes ?? [],
+        ...action.requiredScopes ?? []
+      ].flatMap(tokenize));
+      tools.push({
+        name: integrationToolName(connector.providerId, connector.id, action.id),
+        title: `${connector.title}: ${action.title}`,
+        description: action.description ?? `${action.risk} action ${action.id} on ${connector.title}`,
+        providerId: connector.providerId,
+        connectorId: connector.id,
+        connectorTitle: connector.title,
+        category: connector.category,
+        action,
+        risk: action.risk,
+        dataClass: action.dataClass,
+        requiredScopes: action.requiredScopes,
+        inputSchema: action.inputSchema,
+        outputSchema: action.outputSchema,
+        tags,
+        supportTier: toolSupportTier(connector),
+        runnable: toolRunnable(connector)
+      });
+    }
+  }
+  return tools;
+}
+function buildIntegrationCatalogView(input) {
+  const runtimeConnectors = input.executableRegistry?.connectors ?? input.discoveryRegistry.connectors.filter((connector) => toolRunnable(connector));
+  const runtimeTools = buildIntegrationToolCatalog(runtimeConnectors);
+  const discoveryTools = buildIntegrationToolCatalog(input.discoveryRegistry.connectors);
+  return {
+    connectors: input.discoveryRegistry.connectors,
+    conflicts: input.discoveryRegistry.entries.flatMap((entry) => entry.conflicts),
+    summary: summarizeIntegrationRegistry(input.discoveryRegistry),
+    tools: runtimeTools,
+    runtimeTools,
+    discoveryTools
+  };
+}
+function searchIntegrationTools(catalog, query, filters = {}) {
+  const terms = tokenize(query);
+  const filtered = catalog.filter((tool) => {
+    if (filters.providerId && tool.providerId !== filters.providerId) return false;
+    if (filters.connectorId && tool.connectorId !== filters.connectorId) return false;
+    if (filters.category && tool.category !== filters.category) return false;
+    if (filters.dataClass && tool.dataClass !== filters.dataClass) return false;
+    if (filters.maxRisk && riskRank2[tool.risk] > riskRank2[filters.maxRisk]) return false;
+    return true;
+  });
+  const scored = filtered.map((tool) => scoreTool(tool, terms));
+  return scored.filter((result) => terms.length === 0 || result.score > 0).sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name)).slice(0, filters.limit ?? 20);
+}
+function toMcpTools(tools) {
+  return tools.map((tool) => ({
+    name: tool.name,
+    description: `${tool.title}. ${tool.description}`,
+    inputSchema: tool.inputSchema ?? {
+      type: "object",
+      additionalProperties: true,
+      properties: {}
+    }
+  }));
+}
+function scoreTool(tool, terms) {
+  if (terms.length === 0) return { tool, score: 1, matched: [] };
+  const haystack = new Set(tool.tags);
+  const matched = [];
+  let score = 0;
+  for (const term of terms) {
+    if (haystack.has(term)) {
+      matched.push(term);
+      score += 4;
+      continue;
+    }
+    if (tool.tags.some((tag) => tag.includes(term))) {
+      matched.push(term);
+      score += 1;
+    }
+  }
+  if (tool.risk === "read") score += 0.25;
+  return { tool, score, matched: unique8(matched) };
+}
+function tokenize(value) {
+  return value.toLowerCase().split(/[^a-z0-9]+/g).map((part) => part.trim()).filter(Boolean);
+}
+function encodeToolPart(value) {
+  return Buffer.from(value, "utf8").toString("base64url").replace(/_/g, ".");
+}
+function decodeToolPart(value) {
+  return Buffer.from(value.replace(/\./g, "_"), "base64url").toString("utf8");
+}
+function unique8(values) {
   return [...new Set(values)];
 }
+function toolSupportTier(connector) {
+  const registry = connector.metadata?.registry;
+  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
+    const supportTier2 = registry.supportTier;
+    return isIntegrationSupportTier(supportTier2) ? supportTier2 : void 0;
+  }
+  const supportTier = connector.metadata?.supportTier;
+  return isIntegrationSupportTier(supportTier) ? supportTier : void 0;
+}
+function toolRunnable(connector) {
+  const registry = connector.metadata?.registry;
+  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
+    const toolBindable = registry.toolBindable;
+    if (typeof toolBindable === "boolean") return toolBindable;
+  }
+  const tier = toolSupportTier(connector);
+  return tier === "gatewayExecutable" || tier === "firstPartyExecutable" || tier === "sandboxExecutable";
+}
+function isIntegrationSupportTier(value) {
+  return value === "catalogOnly" || value === "setupReady" || value === "gatewayExecutable" || value === "firstPartyExecutable" || value === "sandboxExecutable";
+}
 
 export {
   ACTIVEPIECES_OVERRIDES,
@@ -3882,6 +4301,12 @@ export {
   buildActivepiecesConnectors,
   createCatalogExecutorProvider,
   createActivepiecesExecutorProvider,
+  integrationToolName,
+  parseIntegrationToolName,
+  buildIntegrationToolCatalog,
+  buildIntegrationCatalogView,
+  searchIntegrationTools,
+  toMcpTools,
   ACTIVEPIECES_PUBLIC_CATALOG_URL,
   extractActivepiecesPublicPieceCount,
   auditIntegrationCatalogFreshness,
@@ -3988,6 +4413,9 @@ export {
   tangleCatalogAuthValue,
   createTangleCatalogRuntimeNodeRequestListener,
   startTangleCatalogRuntimeNodeServer,
+  InMemoryIntegrationGrantStore,
+  IntegrationRuntime,
+  createIntegrationRuntime,
   InMemoryIntegrationWorkflowStore,
   IntegrationWorkflowRuntime,
   createIntegrationWorkflowRuntime,
@@ -4000,4 +4428,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-IOO75SJH.js.map
+//# sourceMappingURL=chunk-S54DPRDU.js.map