@tangle-network/agent-integrations 0.28.0 → 0.30.0

package/dist/registry.d.ts

@@ -1,4 +1,4 @@
-import { C as ConnectorAdapter, R as ResolvedDataSource, d as ConnectorCredentials } from './tangle-id-CTU4kGId.js';
+import { C as ConnectorAdapter, R as ResolvedDataSource, d as ConnectorCredentials } from './tangle-id-C6s2NT2r.js';
 import './errors-Bg3_rxnQ.js';
 import './connect/index.js';
 import './middleware/index.js';
@@ -59,11 +59,145 @@ declare function buildDefaultIntegrationRegistry(options?: {
     /** @deprecated Use includeTangleCatalog. */
     includeActivepieces?: boolean;
 }): IntegrationRegistry;
+/** Per-entry executability classification. Pure metadata — never loads or
+ *  runs a runtime module. The coverage report consumes this to separate
+ *  "we can execute this today" from "catalog-only / setup-only". */
+interface IntegrationCatalogExecutability {
+    canonicalId: string;
+    /** True when the entry resolves to a runnable action: a first-party /
+     *  sandbox / gateway-executable support tier, or a tangle-catalog entry
+     *  with a resolvable npm runtime package. */
+    executable: boolean;
+    supportTier: IntegrationSupportTier;
+    authKind: IntegrationConnector['auth'];
+    /** Resolvable npm runtime package name when one is registered for this
+     *  connector in the vendored catalog; undefined for first-party adapters
+     *  (which execute in-process) and catalog-only entries. */
+    runtimePackage?: string;
+    actionCount: number;
+    triggerCount: number;
+}
+/** Classify every entry in a composed registry by executability + auth kind
+ *  WITHOUT executing anything. Defaults to {@link buildDefaultIntegrationRegistry}. */
+declare function classifyIntegrationCatalogExecutability(registry?: IntegrationRegistry): IntegrationCatalogExecutability[];
 declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
 declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
 declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
 declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
 
+interface ConnectorAdapterProviderOptions {
+    id?: string;
+    kind?: IntegrationProviderKind;
+    adapters: ConnectorAdapter[];
+    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
+    /** Invoked when an adapter rotates credentials during executeRead /
+     *  executeMutation (e.g. an OAuth access token refreshed on expiry). The
+     *  host re-encrypts + persists the rotated envelope so the next expiry
+     *  does not force a reconnect. Carries the connection so the host can
+     *  resolve the secretRef. */
+    onCredentialsRotated?: (event: {
+        connection: IntegrationConnection;
+        credentials: ConnectorCredentials;
+    }) => Promise<void> | void;
+    now?: () => Date;
+}
+declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
+declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
+declare function createConnectorAdapterCatalogSource(options: {
+    id?: string;
+    providerId?: string;
+    adapters: ConnectorAdapter[];
+    precedence?: number;
+}): IntegrationCatalogSource;
+declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
+
+interface IntegrationSecretStore {
+    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
+    delete?(ref: SecretRef): Promise<void> | void;
+}
+/** Single-use record stashed at OAuth-start and consumed once at callback to
+ *  guard against CSRF / replay. The hub injects its own durable
+ *  implementation (KV/Redis/D1) so the callback can land on any worker. */
+interface IntegrationOAuthState {
+    /** Opaque value round-tripped through the provider redirect. */
+    state: string;
+    /** Provider the auth flow targets. */
+    providerId: string;
+    /** Connector the user is connecting. */
+    connectorId: string;
+    /** Owner initiating the flow. */
+    owner: IntegrationActor;
+    /** Scopes requested at start; verified against the granted scopes on callback. */
+    requestedScopes: string[];
+    /** Redirect URI used at start; MUST match exactly on callback exchange. */
+    redirectUri: string;
+    /** PKCE code_verifier, when the connector uses PKCE. */
+    codeVerifier?: string;
+    /** Absolute expiry (UTC ms since epoch). consume() MUST treat an expired
+     *  record as a miss. */
+    expiresAt: number;
+    /** Arbitrary non-secret context the host pinned at start-time. */
+    metadata?: Record<string, unknown>;
+}
+/** Outcome of consuming an OAuth state record. Callers MUST inspect `ok`
+ *  before using `state`; a miss (`unknown`/`expired`) is the CSRF/replay
+ *  guard firing, not an exception. */
+type IntegrationOAuthStateOutcome = {
+    ok: true;
+    state: IntegrationOAuthState;
+} | {
+    ok: false;
+    reason: 'unknown' | 'expired';
+};
+/** Host-injectable store for single-use OAuth-start records. The default is
+ *  in-memory for local/dev and tests; multi-tenant hubs inject a durable
+ *  encrypted store so callbacks survive worker hops. consume() MUST be
+ *  single-use: a second consume of the same state returns `{ ok: false }`. */
+interface IntegrationOAuthStateStore {
+    put(state: IntegrationOAuthState): Promise<void> | void;
+    consume(state: string): Promise<IntegrationOAuthStateOutcome> | IntegrationOAuthStateOutcome;
+    sweep?(now: number): Promise<void> | void;
+}
+interface ConnectionCredentialResolverOptions {
+    secrets: IntegrationSecretStore;
+    connections?: IntegrationConnectionStore;
+    adapters?: ConnectorAdapter[];
+    now?: () => Date;
+    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
+}
+declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
+    private readonly secrets;
+    get(ref: SecretRef): ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): void;
+    delete(ref: SecretRef): void;
+}
+/** Test/dev double for {@link IntegrationOAuthStateStore}. Production hubs
+ *  inject a durable implementation; this one keeps records in a Map and
+ *  enforces the single-use + expiry contract. */
+declare class InMemoryIntegrationOAuthStateStore implements IntegrationOAuthStateStore {
+    private readonly states;
+    put(state: IntegrationOAuthState): void;
+    consume(state: string): IntegrationOAuthStateOutcome;
+    sweep(now: number): void;
+}
+declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
+declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
+type CredentialBackedAdapterProviderOptions = Omit<ConnectorAdapterProviderOptions, 'resolveDataSource' | 'onCredentialsRotated'> & ConnectionCredentialResolverOptions & {
+    /** Fired after the provider re-persists rotated credentials to the
+     *  secret + connection stores. Receives the hub-shaped event including
+     *  the resolved secretRef so the host can drive external re-encryption
+     *  or telemetry. */
+    onCredentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void;
+};
+declare function createCredentialBackedAdapterProvider(options: CredentialBackedAdapterProviderOptions): IntegrationProvider;
+declare function revokeConnection(input: {
+    connection: IntegrationConnection;
+    connections?: IntegrationConnectionStore;
+    secrets?: IntegrationSecretStore;
+    now?: () => Date;
+}): Promise<IntegrationConnection>;
+
 type IntegrationAuditEventType = 'connection.created' | 'connection.updated' | 'connection.revoked' | 'grant.created' | 'grant.revoked' | 'capability.issued' | 'action.invoked' | 'action.failed' | 'trigger.subscribed' | 'trigger.received' | 'workflow.installed' | 'approval.requested' | 'approval.resolved' | 'healthcheck.completed';
 interface IntegrationAuditEvent {
     id: string;
@@ -248,6 +382,17 @@ declare function parseIntegrationToolName(name: string): {
     actionId: string;
 };
 declare function buildIntegrationToolCatalog(connectors: IntegrationConnector[]): IntegrationToolDefinition[];
+/** Flatten a single (connector, action) pair into the tool descriptor the
+ *  catalog exposes. The inverse of {@link parseIntegrationToolName} +
+ *  {@link integrationToolName}: every tool name round-trips back to exactly
+ *  this shape via {@link describeIntegrationTool}. */
+declare function flattenIntegrationToolDefinition(connector: IntegrationConnector, action: IntegrationConnectorAction): IntegrationToolDefinition;
+/** Resolve a single tool's full descriptor from an opaque
+ *  `int_<provider>_<connector>_<action>` name against a composed registry.
+ *  Returns undefined when the name is malformed, the connector is unknown,
+ *  or the action is not defined by that connector. Powers `/tools/describe`
+ *  without callers re-implementing parse → byId → action → flatten. */
+declare function describeIntegrationTool(registry: IntegrationRegistry, toolName: string): IntegrationToolDefinition | undefined;
 declare function buildIntegrationCatalogView(input: {
     discoveryRegistry: IntegrationRegistry;
     executableRegistry?: IntegrationRegistry;
@@ -451,6 +596,245 @@ declare class TangleIntegrationsClient {
 }
 declare function createTangleIntegrationsClient(options: TangleIntegrationsClientOptions): TangleIntegrationsClient;
 
+type IntegrationHealthcheckStatus = 'healthy' | 'degraded' | 'unhealthy' | 'unknown';
+interface IntegrationHealthcheckCheck {
+    id: string;
+    status: IntegrationHealthcheckStatus;
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckResult {
+    connectionId: string;
+    providerId: string;
+    connectorId: string;
+    status: IntegrationHealthcheckStatus;
+    checkedAt: string;
+    checks: IntegrationHealthcheckCheck[];
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationHealthcheckStore {
+    put(result: IntegrationHealthcheckResult): Promise<void> | void;
+    get(connectionId: string): Promise<IntegrationHealthcheckResult | undefined> | IntegrationHealthcheckResult | undefined;
+    list(): Promise<IntegrationHealthcheckResult[]> | IntegrationHealthcheckResult[];
+}
+declare class InMemoryIntegrationHealthcheckStore implements IntegrationHealthcheckStore {
+    private readonly results;
+    put(result: IntegrationHealthcheckResult): void;
+    get(connectionId: string): IntegrationHealthcheckResult | undefined;
+    list(): IntegrationHealthcheckResult[];
+}
+declare function runIntegrationHealthcheck(input: {
+    connection: IntegrationConnection;
+    connector?: IntegrationConnector;
+    registry?: IntegrationRegistry;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationHealthcheckResult>;
+declare function runIntegrationHealthchecks(input: {
+    connections: IntegrationConnection[];
+    registry?: IntegrationRegistry;
+    store?: IntegrationHealthcheckStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
+}): Promise<IntegrationHealthcheckResult[]>;
+declare function healthcheckRequest(action?: string): IntegrationActionRequest;
+
+/**
+ * @stable Integration Hub consumer client.
+ *
+ * The third client-shaped surface a product needs, alongside the two that
+ * already ship:
+ *
+ *   - `createTangleIntegrationsClient` (`client.ts`) — the *invoke* client.
+ *     Capability-token auth, runs INSIDE a sandbox / generated app, single
+ *     endpoint `/v1/integrations/invoke`.
+ *   - `startConnectFlow` / `finishConnectFlow` (`connect/index.ts`) — the
+ *     *user-consent* flow, mirrors `/cross-site/*`.
+ *   - **this** — the S2S *management* client. A product BACKEND (blueprint-
+ *     agent, sandbox, gtm-agent, tax-agent, legal-agent, evals, …) drives the
+ *     `/v1/integrations/{resolve-manifest,grants,capabilities/bundle,
+ *     healthchecks/run}` management surface on `id.tangle.tools` on behalf of
+ *     an identified user.
+ *
+ * Every consumer needs the identical client — the wire protocol, the
+ * `{ success, data }` envelope, the auth header shape are all platform-owned.
+ * Re-implementing a bespoke fetch loop per product forks the protocol and the
+ * copies drift. This module is that shared implementation. It mirrors the
+ * `connect/index.ts` design rule one-for-one: DO NOT invent the wire protocol
+ * — speak exactly what `products/platform/api/src/routes/integrations.ts`
+ * serves.
+ *
+ * Two auth modes — the route layer (`authMiddleware`) accepts either:
+ *
+ *   - `service`  — a `svc_*` service token + `X-Service-Name`. The acting
+ *     user travels in `X-Platform-User-Id`. The platform honors that header
+ *     only for service tokens whose `SERVICE_SCOPES` set contains
+ *     `impersonate:user`; a token without it is rejected (403). Reaches the
+ *     four management paths the platform allowlists for service tokens.
+ *   - `user-key` — a per-user `sk-tan-*` API key (minted via the connect
+ *     flow). The key identifies the user; no impersonation header. Reaches
+ *     every route the user themselves can.
+ *
+ * The capability-token `invoke` endpoint is intentionally NOT exposed here —
+ * that is `createTangleIntegrationsClient`'s job and uses a different auth.
+ */
+
+type IntegrationHubAuth = {
+    mode: 'service';
+    /** The `svc_*` token issued to this product. */
+    serviceToken: string;
+    /** Registered service name — sent as `X-Service-Name`. Required
+     *  because one token may be shared across services, in which case the
+     *  platform demands the header to disambiguate. */
+    serviceName: string;
+} | {
+    mode: 'user-key';
+    /** A per-user `sk-tan-*` key bound to the acting user. */
+    apiKey: string;
+};
+interface IntegrationHubClientOptions {
+    /** The product / consumer identifier (e.g. `blueprint-agent`). Sent as the
+     *  `product` field of resolve-manifest calls; recorded platform-side. */
+    product: string;
+    /** Service-token or per-user-key auth. */
+    auth: IntegrationHubAuth;
+    /** Platform base URL. Defaults to `https://id.tangle.tools`. */
+    endpoint?: string;
+    /** Injected for tests. Defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Per-request timeout in ms. Default 10_000. */
+    timeoutMs?: number;
+    /** Max attempts on transient (network / 502 / 503 / 504) failures.
+     *  Default 2 — i.e. one retry. */
+    maxAttempts?: number;
+}
+/** Thrown for every non-2xx response and every transport failure. Carries the
+ *  HTTP status and the platform error code so callers can branch precisely
+ *  (`403` + `impersonate` → the service token lacks the scope; `409` /
+ *  `missing_connection` → prompt the user to connect). */
+declare class IntegrationHubRequestError extends Error {
+    readonly name = "IntegrationHubRequestError";
+    /** HTTP status, or 0 for a network-level failure. */
+    readonly status: number;
+    /** Platform error code (`VALIDATION_ERROR`, `scope_missing`, …) or
+     *  `network_error` / `http_error` when no structured code was returned. */
+    readonly code: string;
+    /** `METHOD /path` the request targeted. */
+    readonly endpoint: string;
+    /** True when the failure class is transient and a retry could succeed. */
+    readonly retryable: boolean;
+    constructor(input: {
+        status: number;
+        code: string;
+        message: string;
+        endpoint: string;
+        retryable: boolean;
+    });
+}
+interface ResolveManifestInput {
+    /** The acting user — the connection owner. */
+    userId: string;
+    manifest: IntegrationManifest;
+    /** Overrides the client-level `product` for this call. */
+    product?: string;
+}
+interface CreateGrantsInput {
+    /** The acting user — the connection owner. */
+    userId: string;
+    /** Who the grant is FOR (the sandbox / agent / app that will invoke). */
+    grantee: IntegrationActor;
+    manifest: IntegrationManifest;
+    metadata?: Record<string, unknown>;
+}
+interface ListGrantsInput {
+    /** The acting user — the connection owner. */
+    userId: string;
+    /** Optional grantee filter; both fields travel together as query params. */
+    grantee?: IntegrationActor;
+}
+interface MintCapabilityBundleInput {
+    /** The acting user — must own every connection behind the grants. */
+    userId: string;
+    /** Who the capability bundle is issued TO (the sandbox / agent process). */
+    subject: IntegrationActor;
+    /** Mint from every grant of a manifest … */
+    manifestId?: string;
+    /** … or from an explicit grant id list. Exactly one of the two is required. */
+    grantIds?: string[];
+    grantee?: IntegrationActor;
+    /** Bundle TTL in ms. Platform clamps to [1s, 60m]; default 15m. */
+    ttlMs?: number;
+}
+interface CapabilityBundleResult {
+    bundle: IntegrationSandboxBundle;
+    /** Bridge environment variables to inject into the sandbox process —
+     *  `buildIntegrationBridgeEnvironment(bundle)`, computed platform-side. */
+    env: Record<string, string>;
+}
+interface CheckConnectorInput {
+    /** The acting user. */
+    userId: string;
+    /** Connector to probe — `github`, `google-calendar`, `tangle-id`, … */
+    connectorId: string;
+    /** Defaults to `read`. */
+    mode?: IntegrationRequirementMode;
+    requiredScopes?: string[];
+    requiredActions?: string[];
+}
+interface CheckConnectorResult {
+    /** True when the user has an active connection satisfying the requirement. */
+    connected: boolean;
+    /** The satisfying connection, present iff `connected`. */
+    connection?: IntegrationConnection;
+    /** The full requirement resolution — status, missing scopes/actions, message. */
+    resolution: IntegrationRequirementResolution;
+}
+/**
+ * S2S management client for the `id.tangle.tools` integration hub. One per
+ * product; methods are stateless and safe to call concurrently.
+ */
+declare class IntegrationHubClient {
+    private readonly endpoint;
+    private readonly product;
+    private readonly auth;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    private readonly maxAttempts;
+    constructor(options: IntegrationHubClientOptions);
+    /**
+     * Resolve a manifest against a user's connections. The returned
+     * `ready` / `missing` split is the canonical way to ask "does this user
+     * have the connections this work needs" — the raw connection list is not
+     * reachable by a service token by design.
+     */
+    resolveManifest(input: ResolveManifestInput): Promise<IntegrationManifestResolution>;
+    /**
+     * Convenience over {@link resolveManifest} — probe a single connector and
+     * get back a boolean plus the satisfying connection. The Surface-A quest
+     * primitive ("is the user's GitHub linked?").
+     */
+    checkConnector(input: CheckConnectorInput): Promise<CheckConnectorResult>;
+    /** Create grants for every satisfiable requirement of a manifest. The
+     *  platform rejects the call if any non-optional requirement is missing a
+     *  connection. */
+    createGrants(input: CreateGrantsInput): Promise<IntegrationGrant[]>;
+    /** List the acting user's grants, optionally filtered to one grantee. */
+    listGrants(input: ListGrantsInput): Promise<IntegrationGrant[]>;
+    /** Mint a short-lived capability bundle for a sandbox / agent process.
+     *  Provider credentials never leave the platform — the bundle carries only
+     *  scoped, expiring capability tokens. */
+    mintCapabilityBundle(input: MintCapabilityBundleInput): Promise<CapabilityBundleResult>;
+    /** Run live healthchecks across all of the acting user's connections. */
+    runHealthchecks(input: {
+        userId: string;
+    }): Promise<IntegrationHealthcheckResult[]>;
+    private buildHeaders;
+    private request;
+}
+declare function createIntegrationHubClient(options: IntegrationHubClientOptions): IntegrationHubClient;
+
 interface ConsentSummary {
     title: string;
     body: string;
@@ -471,51 +855,6 @@ declare function renderApprovalCopy(input: {
     approvalId?: string;
 }): ConsentSummary;
 
-interface ConnectorAdapterProviderOptions {
-    id?: string;
-    kind?: IntegrationProviderKind;
-    adapters: ConnectorAdapter[];
-    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
-    now?: () => Date;
-}
-declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
-declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
-declare function createConnectorAdapterCatalogSource(options: {
-    id?: string;
-    providerId?: string;
-    adapters: ConnectorAdapter[];
-    precedence?: number;
-}): IntegrationCatalogSource;
-declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
-
-interface IntegrationSecretStore {
-    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
-    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
-    delete?(ref: SecretRef): Promise<void> | void;
-}
-interface ConnectionCredentialResolverOptions {
-    secrets: IntegrationSecretStore;
-    connections?: IntegrationConnectionStore;
-    adapters?: ConnectorAdapter[];
-    now?: () => Date;
-    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
-}
-declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
-    private readonly secrets;
-    get(ref: SecretRef): ConnectorCredentials | undefined;
-    put(ref: SecretRef, credentials: ConnectorCredentials): void;
-    delete(ref: SecretRef): void;
-}
-declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
-declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
-declare function createCredentialBackedAdapterProvider(options: Omit<ConnectorAdapterProviderOptions, 'resolveDataSource'> & ConnectionCredentialResolverOptions): IntegrationProvider;
-declare function revokeConnection(input: {
-    connection: IntegrationConnection;
-    connections?: IntegrationConnectionStore;
-    secrets?: IntegrationSecretStore;
-    now?: () => Date;
-}): Promise<IntegrationConnection>;
-
 /**
  * Workspace capability discovery — answers "what can this workspace do?"
  * with a typed list of MCP-shape tool descriptors that the agent runtime
@@ -828,51 +1167,6 @@ declare class DefaultIntegrationActionGuard implements IntegrationActionGuard {
 }
 declare function createDefaultIntegrationActionGuard(options?: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0]): DefaultIntegrationActionGuard;
 
-type IntegrationHealthcheckStatus = 'healthy' | 'degraded' | 'unhealthy' | 'unknown';
-interface IntegrationHealthcheckCheck {
-    id: string;
-    status: IntegrationHealthcheckStatus;
-    message: string;
-    metadata?: Record<string, unknown>;
-}
-interface IntegrationHealthcheckResult {
-    connectionId: string;
-    providerId: string;
-    connectorId: string;
-    status: IntegrationHealthcheckStatus;
-    checkedAt: string;
-    checks: IntegrationHealthcheckCheck[];
-    metadata?: Record<string, unknown>;
-}
-interface IntegrationHealthcheckStore {
-    put(result: IntegrationHealthcheckResult): Promise<void> | void;
-    get(connectionId: string): Promise<IntegrationHealthcheckResult | undefined> | IntegrationHealthcheckResult | undefined;
-    list(): Promise<IntegrationHealthcheckResult[]> | IntegrationHealthcheckResult[];
-}
-declare class InMemoryIntegrationHealthcheckStore implements IntegrationHealthcheckStore {
-    private readonly results;
-    put(result: IntegrationHealthcheckResult): void;
-    get(connectionId: string): IntegrationHealthcheckResult | undefined;
-    list(): IntegrationHealthcheckResult[];
-}
-declare function runIntegrationHealthcheck(input: {
-    connection: IntegrationConnection;
-    connector?: IntegrationConnector;
-    registry?: IntegrationRegistry;
-    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
-    audit?: IntegrationAuditSink;
-    now?: () => Date;
-}): Promise<IntegrationHealthcheckResult>;
-declare function runIntegrationHealthchecks(input: {
-    connections: IntegrationConnection[];
-    registry?: IntegrationRegistry;
-    store?: IntegrationHealthcheckStore;
-    audit?: IntegrationAuditSink;
-    now?: () => Date;
-    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
-}): Promise<IntegrationHealthcheckResult[]>;
-declare function healthcheckRequest(action?: string): IntegrationActionRequest;
-
 interface ManifestValidationIssue {
     path: string;
     message: string;
@@ -1820,6 +2114,27 @@ declare function getIntegrationFamily(id: IntegrationFamilyId): IntegrationFamil
 
 declare function listIntegrationSpecs(): IntegrationSpec[];
 declare function getIntegrationSpec(kind: string): IntegrationSpec | undefined;
+/** Auth-driving descriptor the hub uses to start a connect flow per provider
+ *  instead of hard-coding scopes/auth kind. Derived from the spec catalog
+ *  ({@link getIntegrationSpec}); undefined when the kind is not in the
+ *  catalog. */
+interface ConnectorAuthSpec {
+    kind: string;
+    authKind: 'oauth2' | 'api_key' | 'none' | 'custom';
+    /** Provider scopes to request in the authorization grant. Empty for
+     *  api_key / none / custom. */
+    requestedScopes: string[];
+    /** OAuth-only: authorization + token endpoints and PKCE posture. Present
+     *  only when authKind === 'oauth2'. */
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    pkce?: 'required' | 'supported' | 'unsupported';
+    redirectUriTemplate?: string;
+    clientIdEnv?: string;
+    clientSecretEnv?: string;
+    extraAuthParams?: Record<string, string>;
+}
+declare function resolveConnectorAuthSpec(kind: string): ConnectorAuthSpec | undefined;
 declare function listExecutableIntegrationSpecs(): IntegrationSpec[];
 declare function integrationSpecToConnector(spec: IntegrationSpec, providerId?: string): IntegrationConnector;
 
@@ -2074,8 +2389,34 @@ interface IntegrationHubOptions {
      *  provider invocation. Use it to pause writes, deny destructive actions,
      *  or apply tenant-specific allow rules. */
     policy?: IntegrationPolicyEngine;
+    /** Host-injectable secret store. Multi-tenant hubs inject a durable
+     *  encrypted store; defaults to {@link InMemoryIntegrationSecretStore} for
+     *  local/dev and tests. The interface is the contract — the lib never
+     *  ships a D1/KV/encryption impl. */
+    secretStore?: IntegrationSecretStore;
+    /** Host-injectable single-use OAuth-state store guarding the start →
+     *  callback CSRF boundary. Defaults to
+     *  {@link InMemoryIntegrationOAuthStateStore}. */
+    oauthStateStore?: IntegrationOAuthStateStore;
+    /** TTL applied to OAuth-state records the hub stashes at startAuth.
+     *  Defaults to 10 minutes. */
+    oauthStateTtlMs?: number;
+    /** Fired whenever a provider surfaces rotated credentials during an
+     *  invoke (e.g. an OAuth access token refreshed on expiry). The host
+     *  re-encrypts + persists the rotated envelope so the next expiry does
+     *  not force a reconnect. The hub also writes the rotated credentials to
+     *  {@link secretStore} when the connection carries a secretRef. */
+    credentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void;
     now?: () => Date;
 }
+/** Emitted when a provider rotates credentials mid-invoke. The host
+ *  re-persists `credentials` against `secretRef` (when present) so the
+ *  refreshed token survives the call. */
+interface IntegrationCredentialsRotatedEvent {
+    connection: IntegrationConnection;
+    secretRef?: SecretRef;
+    credentials: ConnectorCredentials;
+}
 interface HttpIntegrationProviderOptions {
     id: string;
     kind?: IntegrationProviderKind;
@@ -2104,6 +2445,12 @@ declare class IntegrationHub {
     private readonly capabilitySecret;
     private readonly guard;
     private readonly policy;
+    /** Host-injected (or in-memory default) secret store. The hub re-persists
+     *  rotated credentials here when a connection carries a secretRef. */
+    readonly secretStore: IntegrationSecretStore;
+    private readonly oauthStateStore;
+    private readonly oauthStateTtlMs;
+    private readonly credentialsRotated;
     private readonly now;
     constructor(options: IntegrationHubOptions);
     listConnectors(): Promise<IntegrationConnector[]>;
@@ -2132,4 +2479,4 @@ declare function createHttpIntegrationProvider(options: HttpIntegrationProviderO
 declare function signCapability(capability: IntegrationCapability, secret: string): string;
 declare function verifyCapabilityToken(token: string, secret: string): IntegrationCapability;
 
-export { type HealthcheckSpec as $, type TangleCatalogHttpAuthResolverRequest as A, type TangleCatalogInstalledPackageExecutorOptions as B, type TangleCatalogRuntimeHandlerOptions as C, type ComposeIntegrationRegistryOptions, type TangleCatalogRuntimeHttpRequest as D, type TangleCatalogRuntimeHttpResponse as E, type TangleCatalogRuntimeInvocation as F, type TangleCatalogRuntimeModuleAction as G, type TangleCatalogRuntimePackageCoverageOptions as H, type IntegrationCatalogView as I, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, type TangleCatalogRuntimePackageCoverageRow as J, auditTangleCatalogRuntimePackages as K, createTangleCatalogCredentialAuthResolver as L, type McpToolDefinition as M, createTangleCatalogHttpAuthResolver as N, createTangleCatalogInstalledPackageExecutor as O, createTangleCatalogRuntimeHandler as P, signTangleCatalogRuntimeRequest as Q, tangleCatalogAuthValue as R, verifyTangleCatalogRuntimeSignature as S, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as T, type ApiKeyAuthSpec as U, type ConsoleStep as V, type CredentialFieldSpec as W, type CredentialValidationInput as X, type CredentialValidationResult as Y, type CustomAuthSpec as Z, type HealthcheckPlan as _, type IntegrationToolDefinition as a, type GatewayCatalogProviderOptions as a$, type HmacAuthSpec as a0, INTEGRATION_FAMILIES as a1, type IntegrationAuthMode as a2, type IntegrationAuthSpec as a3, type IntegrationFamilyId as a4, type IntegrationFamilySpec as a5, type IntegrationLifecycleSpec as a6, type IntegrationPlannerHints as a7, type IntegrationSetupSpec as a8, type IntegrationSpec as a9, validateIntegrationSpec as aA, ACTIVEPIECES_OVERRIDES as aB, ACTIVEPIECES_PUBLIC_CATALOG_URL as aC, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as aD, type ActivepiecesCatalogAuthField as aE, type ActivepiecesCatalogEntry as aF, type ActivepiecesExecutorInvocation as aG, type ActivepiecesExecutorProviderOptions as aH, type ActivepiecesHttpExecutorOptions as aI, type ActivepiecesPieceOverride as aJ, type ActivepiecesRuntimeRequest as aK, ApprovalBackedPolicyEngine as aL, type ApprovalBackedPolicyOptions as aM, CANONICAL_INTEGRATION_ACTIONS as aN, type CanonicalIntegrationActionId as aO, type CanonicalLaunchConnectorOptions as aP, type CatalogExecutorInvocation as aQ, type CatalogExecutorProviderOptions as aR, type CompleteAuthRequest as aS, type ConnectionCredentialResolverOptions as aT, type ConnectorAdapterProviderOptions as aU, type ConsentSummary as aV, DEFAULT_INTEGRATION_BRIDGE_ENV as aW, DefaultIntegrationActionGuard as aX, type DiscoverWorkspaceCapabilitiesInput as aY, type GatewayCatalogAction as aZ, type GatewayCatalogEntry as a_, type IntegrationSpecStatus as aa, type IntegrationSpecValidationIssue as ab, type IntegrationSpecValidationResult as ac, type NoneAuthSpec as ad, type NormalizedPermission as ae, type OAuth2AuthSpec as af, type PermissionDescriptor as ag, type PostSetupCheck as ah, type Quirk as ai, type RenderSpecOptions as aj, type RenderedConsoleStep as ak, type ScopeDescriptor as al, assertValidIntegrationSpec as am, buildHealthcheckPlan as an, consoleStepsToText as ao, getIntegrationFamily as ap, getIntegrationSpec as aq, integrationSpecToConnector as ar, listExecutableIntegrationSpecs as as, listIntegrationSpecs as at, renderAgentToolDescription as au, renderConsoleSteps as av, renderRunbookMarkdown as aw, specAuthToConnectorAuth as ax, validateCredentialFormat as ay, validateCredentialSet as az, type IntegrationToolSearchFilters as b, type IntegrationProviderKind as b$, type GatewayCatalogTrigger as b0, type GraphqlOperationSpec as b1, type HttpIntegrationProviderOptions as b2, type ImportCatalogOptions as b3, InMemoryConnectionStore as b4, InMemoryIntegrationApprovalStore as b5, InMemoryIntegrationAuditStore as b6, InMemoryIntegrationEventStore as b7, InMemoryIntegrationHealthcheckStore as b8, InMemoryIntegrationIdempotencyStore as b9, type IntegrationConnection as bA, type IntegrationConnectionStore as bB, type IntegrationConnector as bC, type IntegrationConnectorAction as bD, type IntegrationConnectorCategory as bE, type IntegrationConnectorTrigger as bF, type IntegrationCoveragePriority as bG, type IntegrationCoverageSpec as bH, type IntegrationDataClass as bI, IntegrationError as bJ, type IntegrationEventStore as bK, type IntegrationGuardContext as bL, type IntegrationHealthcheckCheck as bM, type IntegrationHealthcheckResult as bN, type IntegrationHealthcheckStatus as bO, type IntegrationHealthcheckStore as bP, IntegrationHub as bQ, type IntegrationHubOptions as bR, type IntegrationIdempotencyRecord as bS, type IntegrationIdempotencyStore as bT, type IntegrationInvocationEnvelope as bU, type IntegrationInvocationEnvelopeValidationOptions as bV, type IntegrationPolicyDecision as bW, type IntegrationPolicyEffect as bX, type IntegrationPolicyEngine as bY, type IntegrationPolicyRule as bZ, type IntegrationProvider as b_, InMemoryIntegrationSecretStore as ba, InMemoryIntegrationWorkflowStore as bb, type InferIntegrationRequirementsOptions as bc, type InstalledIntegrationWorkflow as bd, type IntegrationActionGuard as be, type IntegrationActionPack as bf, type IntegrationActionRequest as bg, type IntegrationActionResult as bh, type IntegrationActionRisk as bi, type IntegrationActor as bj, type IntegrationApprovalFilter as bk, type IntegrationApprovalRecord as bl, type IntegrationApprovalRequest as bm, type IntegrationApprovalResolution as bn, type IntegrationApprovalStatus as bo, type IntegrationApprovalStore as bp, type IntegrationAuditEvent as bq, type IntegrationAuditEventType as br, type IntegrationAuditFilter as bs, type IntegrationAuditSink as bt, type IntegrationAuditStore as bu, buildDefaultIntegrationRegistry, type IntegrationBridgePayload as bv, type IntegrationBridgeToolBinding as bw, type IntegrationCapability as bx, type IntegrationCatalogFreshnessOptions as by, type IntegrationCatalogFreshnessResult as bz, type IntegrationToolSearchResult as c, type WorkspaceTrigger as c$, type IntegrationRateLimitDecision as c0, type IntegrationRateLimiter as c1, IntegrationSandboxHost as c2, type IntegrationSandboxHostHub as c3, type IntegrationSandboxHostOptions as c4, type IntegrationSecretStore as c5, type IntegrationTriggerEvent as c6, type IntegrationTriggerSubscription as c7, type IntegrationWebhookReceiverResult as c8, type IntegrationWorkflowDefinition as c9, type StoredIntegrationEvent as cA, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cB, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cC, type TangleCatalogExecutorInvocation as cD, type TangleCatalogExecutorProviderOptions as cE, type TangleCatalogHttpExecutorInvocation as cF, type TangleCatalogHttpExecutorOptions as cG, type TangleCatalogRuntimeActionRequest as cH, type TangleCatalogRuntimeNodeServerOptions as cI, type TangleCatalogRuntimePackageManifest as cJ, type TangleCatalogRuntimePackageManifestOptions as cK, type TangleCatalogRuntimePiece as cL, type TangleCatalogRuntimeRequest as cM, type TangleCatalogTriggerInvocation as cN, type TangleIntegrationCatalogEntry as cO, type TangleIntegrationCatalogFreshnessOptions as cP, type TangleIntegrationCatalogFreshnessResult as cQ, type TangleIntegrationContract as cR, type TangleIntegrationContractStatus as cS, type TangleIntegrationImplementationKind as cT, type TangleIntegrationInvokeInput as cU, type TangleIntegrationInvokeResult as cV, TangleIntegrationsClient as cW, type TangleIntegrationsClientOptions as cX, type WorkspaceCapability as cY, type WorkspaceCapabilityDiscovery as cZ, type WorkspaceToolSchema as c_, IntegrationWorkflowRuntime as ca, canonicalConnectorId, type IntegrationWorkflowRuntimeHub as cb, type IntegrationWorkflowRuntimeOptions as cc, type IntegrationWorkflowStore as cd, type InvokeWithCapabilityRequest as ce, type IssueCapabilityRequest as cf, type IssuedIntegrationCapability as cg, type ManifestValidationIssue as ch, type ManifestValidationResult as ci, type McpCatalog as cj, type McpCatalogTool as ck, type MissingRequirementExplanation as cl, type NormalizedIntegrationResult as cm, type OpenApiDocument as cn, type OpenApiOperation as co, composeIntegrationRegistry, PROVIDER_PASSTHROUGH_ACTION as cp, type PlatformIntegrationPolicyPresetOptions as cq, type ProviderHttpRequestInput as cr, type ProviderPassthroughPolicy as cs, type RenderConsentOptions as ct, type SecretRef as cu, type StartAuthRequest as cv, type StartAuthResult as cw, type StartedTangleCatalogRuntimeNodeServer as cx, StaticIntegrationPolicyEngine as cy, type StaticIntegrationPolicyOptions as cz, buildIntegrationCatalogView as d, parseIntegrationBridgeEnvironment as d$, adapterManifestsToConnectors as d0, assertValidIntegrationManifest as d1, auditIntegrationCatalogFreshness as d2, auditTangleIntegrationCatalogFreshness as d3, buildActivepiecesConnectors as d4, buildActivepiecesRuntimeRequest as d5, buildApprovalRequest as d6, buildCanonicalLaunchConnectors as d7, buildIntegrationBridgeEnvironment as d8, buildIntegrationBridgePayload as d9, createTangleCatalogHttpExecutor as dA, createTangleCatalogRuntimeNodeRequestListener as dB, createTangleIntegrationsClient as dC, decodeIntegrationBridgePayload as dD, discoverWorkspaceCapabilities as dE, dispatchIntegrationInvocation as dF, encodeIntegrationBridgePayload as dG, explainMissingRequirements as dH, extractActivepiecesPublicPieceCount as dI, extractExternalCatalogPublicCount as dJ, filterDiscoveryByWorkspaceScopes as dK, getActivepiecesOverride as dL, healthcheckRequest as dM, importGraphqlConnector as dN, importMcpConnector as dO, importOpenApiConnector as dP, inferIntegrationManifestFromTools as dQ, integrationCoverageChecklistMarkdown as dR, invocationRequestFromEnvelope as dS, listActivepiecesCatalogEntries as dT, listIntegrationCoverageSpecs as dU, listTangleIntegrationCatalogEntries as dV, listTangleIntegrationCatalogRuntimePackages as dW, listTangleIntegrationContracts as dX, manifestToConnector as dY, normalizeGatewayCatalog as dZ, normalizeIntegrationResult as d_, buildIntegrationCoverageConnectors as da, buildIntegrationInvocationEnvelope as db, buildTangleCatalogRuntimePackageManifest as dc, buildTangleCatalogRuntimeRequest as dd, buildTangleIntegrationCatalogConnectors as de, calendarExercisePlannerManifest as df, canonicalActionConnectorId as dg, createActivepiecesExecutorProvider as dh, createActivepiecesHttpExecutor as di, createApprovalBackedPolicyEngine as dj, createAuditingActionGuard as dk, createCatalogExecutorProvider as dl, createConnectionCredentialResolver as dm, createConnectorAdapterCatalogSource as dn, createConnectorAdapterProvider as dp, createCredentialBackedAdapterProvider as dq, createDefaultIntegrationActionGuard as dr, createDefaultIntegrationPolicyEngine as ds, createGatewayCatalogProvider as dt, createHttpIntegrationProvider as du, createIntegrationAuditEvent as dv, createIntegrationWorkflowRuntime as dw, createMockIntegrationProvider as dx, createPlatformIntegrationPolicyPreset as dy, createTangleCatalogExecutorProvider as dz, buildIntegrationToolCatalog as e, receiveIntegrationWebhook as e0, redactApprovalRequest as e1, redactCapability as e2, redactIntegrationBridgePayload as e3, redactInvocationEnvelope as e4, renderApprovalCopy as e5, renderConsentSummary as e6, renderTangleCatalogRuntimePnpmAddCommand as e7, resolveConnectionCredentials as e8, resolveIntegrationApproval as e9, revokeConnection as ea, runIntegrationHealthcheck as eb, runIntegrationHealthchecks as ec, sanitizeAuditConnection as ed, sanitizeConnection as ee, signActivepiecesRuntimeRequest as ef, signCapability as eg, startTangleCatalogRuntimeNodeServer as eh, storedEventToTriggerEvent as ei, validateIntegrationInvocationEnvelope as ej, validateIntegrationManifest as ek, validateProviderPassthroughRequest as el, verifyActivepiecesRuntimeSignature as em, verifyCapabilityToken as en, InMemoryIntegrationGrantStore as f, type IntegrationCapabilityBinding as g, type IntegrationGrant as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationGrantStore as j, type IntegrationManifest as k, type IntegrationManifestResolution as l, type IntegrationRequirement as m, type IntegrationRequirementMode as n, type IntegrationRequirementResolution as o, parseIntegrationToolName as p, type IntegrationRequirementStatus as q, IntegrationRuntime as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationRuntimeHub as u, type IntegrationRuntimeOptions as v, type IntegrationSandboxBundle as w, createIntegrationRuntime as x, type TangleCatalogAuthResolverOptions as y, type TangleCatalogHttpAuthResolverOptions as z };
+export { createTangleCatalogCredentialAuthResolver as $, type CheckConnectorInput as A, type CheckConnectorResult as B, type CapabilityBundleResult as C, type ComposeIntegrationRegistryOptions, type CreateGrantsInput as D, type IntegrationHubAuth as E, IntegrationHubClient as F, type IntegrationHubClientOptions as G, IntegrationHubRequestError as H, type IntegrationCatalogView as I, type IntegrationCatalogExecutability, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, type MintCapabilityBundleInput as J, createIntegrationHubClient as K, type ListGrantsInput as L, type McpToolDefinition as M, type TangleCatalogAuthResolverOptions as N, type TangleCatalogHttpAuthResolverOptions as O, type TangleCatalogHttpAuthResolverRequest as P, type TangleCatalogInstalledPackageExecutorOptions as Q, type ResolveManifestInput as R, type TangleCatalogRuntimeHandlerOptions as S, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as T, type TangleCatalogRuntimeHttpRequest as U, type TangleCatalogRuntimeHttpResponse as V, type TangleCatalogRuntimeInvocation as W, type TangleCatalogRuntimeModuleAction as X, type TangleCatalogRuntimePackageCoverageOptions as Y, type TangleCatalogRuntimePackageCoverageRow as Z, auditTangleCatalogRuntimePackages as _, type IntegrationToolDefinition as a, ApprovalBackedPolicyEngine as a$, createTangleCatalogHttpAuthResolver as a0, createTangleCatalogInstalledPackageExecutor as a1, createTangleCatalogRuntimeHandler as a2, signTangleCatalogRuntimeRequest as a3, tangleCatalogAuthValue as a4, verifyTangleCatalogRuntimeSignature as a5, type ApiKeyAuthSpec as a6, type ConnectorAuthSpec as a7, type ConsoleStep as a8, type CredentialFieldSpec as a9, type ScopeDescriptor as aA, assertValidIntegrationSpec as aB, buildHealthcheckPlan as aC, consoleStepsToText as aD, getIntegrationFamily as aE, getIntegrationSpec as aF, integrationSpecToConnector as aG, listExecutableIntegrationSpecs as aH, listIntegrationSpecs as aI, renderAgentToolDescription as aJ, renderConsoleSteps as aK, renderRunbookMarkdown as aL, resolveConnectorAuthSpec as aM, specAuthToConnectorAuth as aN, validateCredentialFormat as aO, validateCredentialSet as aP, validateIntegrationSpec as aQ, ACTIVEPIECES_OVERRIDES as aR, ACTIVEPIECES_PUBLIC_CATALOG_URL as aS, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as aT, type ActivepiecesCatalogAuthField as aU, type ActivepiecesCatalogEntry as aV, type ActivepiecesExecutorInvocation as aW, type ActivepiecesExecutorProviderOptions as aX, type ActivepiecesHttpExecutorOptions as aY, type ActivepiecesPieceOverride as aZ, type ActivepiecesRuntimeRequest as a_, type CredentialValidationInput as aa, type CredentialValidationResult as ab, type CustomAuthSpec as ac, type HealthcheckPlan as ad, type HealthcheckSpec as ae, type HmacAuthSpec as af, INTEGRATION_FAMILIES as ag, type IntegrationAuthMode as ah, type IntegrationAuthSpec as ai, type IntegrationFamilyId as aj, type IntegrationFamilySpec as ak, type IntegrationLifecycleSpec as al, type IntegrationPlannerHints as am, type IntegrationSetupSpec as an, type IntegrationSpec as ao, type IntegrationSpecStatus as ap, type IntegrationSpecValidationIssue as aq, type IntegrationSpecValidationResult as ar, type NoneAuthSpec as as, type NormalizedPermission as at, type OAuth2AuthSpec as au, type PermissionDescriptor as av, type PostSetupCheck as aw, type Quirk as ax, type RenderSpecOptions as ay, type RenderedConsoleStep as az, type IntegrationToolSearchFilters as b, type IntegrationDataClass as b$, type ApprovalBackedPolicyOptions as b0, CANONICAL_INTEGRATION_ACTIONS as b1, type CanonicalIntegrationActionId as b2, type CanonicalLaunchConnectorOptions as b3, type CatalogExecutorInvocation as b4, type CatalogExecutorProviderOptions as b5, type CompleteAuthRequest as b6, type ConnectionCredentialResolverOptions as b7, type ConnectorAdapterProviderOptions as b8, type ConsentSummary as b9, type IntegrationActionRisk as bA, type IntegrationActor as bB, type IntegrationApprovalFilter as bC, type IntegrationApprovalRecord as bD, type IntegrationApprovalRequest as bE, type IntegrationApprovalResolution as bF, type IntegrationApprovalStatus as bG, type IntegrationApprovalStore as bH, type IntegrationAuditEvent as bI, type IntegrationAuditEventType as bJ, type IntegrationAuditFilter as bK, type IntegrationAuditSink as bL, type IntegrationAuditStore as bM, type IntegrationBridgePayload as bN, type IntegrationBridgeToolBinding as bO, type IntegrationCapability as bP, type IntegrationCatalogFreshnessOptions as bQ, type IntegrationCatalogFreshnessResult as bR, type IntegrationConnection as bS, type IntegrationConnectionStore as bT, type IntegrationConnector as bU, type IntegrationConnectorAction as bV, type IntegrationConnectorCategory as bW, type IntegrationConnectorTrigger as bX, type IntegrationCoveragePriority as bY, type IntegrationCoverageSpec as bZ, type IntegrationCredentialsRotatedEvent as b_, type CredentialBackedAdapterProviderOptions as ba, DEFAULT_INTEGRATION_BRIDGE_ENV as bb, DefaultIntegrationActionGuard as bc, type DiscoverWorkspaceCapabilitiesInput as bd, type GatewayCatalogAction as be, type GatewayCatalogEntry as bf, type GatewayCatalogProviderOptions as bg, type GatewayCatalogTrigger as bh, type GraphqlOperationSpec as bi, type HttpIntegrationProviderOptions as bj, type ImportCatalogOptions as bk, InMemoryConnectionStore as bl, InMemoryIntegrationApprovalStore as bm, InMemoryIntegrationAuditStore as bn, InMemoryIntegrationEventStore as bo, InMemoryIntegrationHealthcheckStore as bp, InMemoryIntegrationIdempotencyStore as bq, InMemoryIntegrationOAuthStateStore as br, InMemoryIntegrationSecretStore as bs, InMemoryIntegrationWorkflowStore as bt, type InferIntegrationRequirementsOptions as bu, buildDefaultIntegrationRegistry, type InstalledIntegrationWorkflow as bv, type IntegrationActionGuard as bw, type IntegrationActionPack as bx, type IntegrationActionRequest as by, type IntegrationActionResult as bz, type IntegrationToolSearchResult as c, type TangleCatalogHttpExecutorInvocation as c$, IntegrationError as c0, type IntegrationEventStore as c1, type IntegrationGuardContext as c2, type IntegrationHealthcheckCheck as c3, type IntegrationHealthcheckResult as c4, type IntegrationHealthcheckStatus as c5, type IntegrationHealthcheckStore as c6, IntegrationHub as c7, type IntegrationHubOptions as c8, type IntegrationIdempotencyRecord as c9, type InvokeWithCapabilityRequest as cA, type IssueCapabilityRequest as cB, type IssuedIntegrationCapability as cC, type ManifestValidationIssue as cD, type ManifestValidationResult as cE, type McpCatalog as cF, type McpCatalogTool as cG, type MissingRequirementExplanation as cH, type NormalizedIntegrationResult as cI, type OpenApiDocument as cJ, type OpenApiOperation as cK, PROVIDER_PASSTHROUGH_ACTION as cL, type PlatformIntegrationPolicyPresetOptions as cM, type ProviderHttpRequestInput as cN, type ProviderPassthroughPolicy as cO, type RenderConsentOptions as cP, type SecretRef as cQ, type StartAuthRequest as cR, type StartAuthResult as cS, type StartedTangleCatalogRuntimeNodeServer as cT, StaticIntegrationPolicyEngine as cU, type StaticIntegrationPolicyOptions as cV, type StoredIntegrationEvent as cW, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cX, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cY, type TangleCatalogExecutorInvocation as cZ, type TangleCatalogExecutorProviderOptions as c_, type IntegrationIdempotencyStore as ca, canonicalConnectorId, type IntegrationInvocationEnvelope as cb, type IntegrationInvocationEnvelopeValidationOptions as cc, type IntegrationOAuthState as cd, type IntegrationOAuthStateOutcome as ce, type IntegrationOAuthStateStore as cf, type IntegrationPolicyDecision as cg, type IntegrationPolicyEffect as ch, type IntegrationPolicyEngine as ci, type IntegrationPolicyRule as cj, type IntegrationProvider as ck, type IntegrationProviderKind as cl, classifyIntegrationCatalogExecutability, type IntegrationRateLimitDecision as cm, type IntegrationRateLimiter as cn, IntegrationSandboxHost as co, composeIntegrationRegistry, type IntegrationSandboxHostHub as cp, type IntegrationSandboxHostOptions as cq, type IntegrationSecretStore as cr, type IntegrationTriggerEvent as cs, type IntegrationTriggerSubscription as ct, type IntegrationWebhookReceiverResult as cu, type IntegrationWorkflowDefinition as cv, IntegrationWorkflowRuntime as cw, type IntegrationWorkflowRuntimeHub as cx, type IntegrationWorkflowRuntimeOptions as cy, type IntegrationWorkflowStore as cz, buildIntegrationCatalogView as d, dispatchIntegrationInvocation as d$, type TangleCatalogHttpExecutorOptions as d0, type TangleCatalogRuntimeActionRequest as d1, type TangleCatalogRuntimeNodeServerOptions as d2, type TangleCatalogRuntimePackageManifest as d3, type TangleCatalogRuntimePackageManifestOptions as d4, type TangleCatalogRuntimePiece as d5, type TangleCatalogRuntimeRequest as d6, type TangleCatalogTriggerInvocation as d7, type TangleIntegrationCatalogEntry as d8, type TangleIntegrationCatalogFreshnessOptions as d9, buildTangleCatalogRuntimeRequest as dA, buildTangleIntegrationCatalogConnectors as dB, calendarExercisePlannerManifest as dC, canonicalActionConnectorId as dD, createActivepiecesExecutorProvider as dE, createActivepiecesHttpExecutor as dF, createApprovalBackedPolicyEngine as dG, createAuditingActionGuard as dH, createCatalogExecutorProvider as dI, createConnectionCredentialResolver as dJ, createConnectorAdapterCatalogSource as dK, createConnectorAdapterProvider as dL, createCredentialBackedAdapterProvider as dM, createDefaultIntegrationActionGuard as dN, createDefaultIntegrationPolicyEngine as dO, createGatewayCatalogProvider as dP, createHttpIntegrationProvider as dQ, createIntegrationAuditEvent as dR, createIntegrationWorkflowRuntime as dS, createMockIntegrationProvider as dT, createPlatformIntegrationPolicyPreset as dU, createTangleCatalogExecutorProvider as dV, createTangleCatalogHttpExecutor as dW, createTangleCatalogRuntimeNodeRequestListener as dX, createTangleIntegrationsClient as dY, decodeIntegrationBridgePayload as dZ, discoverWorkspaceCapabilities as d_, type TangleIntegrationCatalogFreshnessResult as da, type TangleIntegrationContract as db, type TangleIntegrationContractStatus as dc, type TangleIntegrationImplementationKind as dd, type TangleIntegrationInvokeInput as de, type TangleIntegrationInvokeResult as df, TangleIntegrationsClient as dg, type TangleIntegrationsClientOptions as dh, type WorkspaceCapability as di, type WorkspaceCapabilityDiscovery as dj, type WorkspaceToolSchema as dk, type WorkspaceTrigger as dl, adapterManifestsToConnectors as dm, assertValidIntegrationManifest as dn, auditIntegrationCatalogFreshness as dp, auditTangleIntegrationCatalogFreshness as dq, buildActivepiecesConnectors as dr, buildActivepiecesRuntimeRequest as ds, buildApprovalRequest as dt, buildCanonicalLaunchConnectors as du, buildIntegrationBridgeEnvironment as dv, buildIntegrationBridgePayload as dw, buildIntegrationCoverageConnectors as dx, buildIntegrationInvocationEnvelope as dy, buildTangleCatalogRuntimePackageManifest as dz, buildIntegrationToolCatalog as e, encodeIntegrationBridgePayload as e0, explainMissingRequirements as e1, extractActivepiecesPublicPieceCount as e2, extractExternalCatalogPublicCount as e3, filterDiscoveryByWorkspaceScopes as e4, getActivepiecesOverride as e5, healthcheckRequest as e6, importGraphqlConnector as e7, importMcpConnector as e8, importOpenApiConnector as e9, sanitizeConnection as eA, signActivepiecesRuntimeRequest as eB, signCapability as eC, startTangleCatalogRuntimeNodeServer as eD, storedEventToTriggerEvent as eE, validateIntegrationInvocationEnvelope as eF, validateIntegrationManifest as eG, validateProviderPassthroughRequest as eH, verifyActivepiecesRuntimeSignature as eI, verifyCapabilityToken as eJ, inferIntegrationManifestFromTools as ea, integrationCoverageChecklistMarkdown as eb, invocationRequestFromEnvelope as ec, listActivepiecesCatalogEntries as ed, listIntegrationCoverageSpecs as ee, listTangleIntegrationCatalogEntries as ef, listTangleIntegrationCatalogRuntimePackages as eg, listTangleIntegrationContracts as eh, manifestToConnector as ei, normalizeGatewayCatalog as ej, normalizeIntegrationResult as ek, parseIntegrationBridgeEnvironment as el, receiveIntegrationWebhook as em, redactApprovalRequest as en, redactCapability as eo, redactIntegrationBridgePayload as ep, redactInvocationEnvelope as eq, renderApprovalCopy as er, renderConsentSummary as es, renderTangleCatalogRuntimePnpmAddCommand as et, resolveConnectionCredentials as eu, resolveIntegrationApproval as ev, revokeConnection as ew, runIntegrationHealthcheck as ex, runIntegrationHealthchecks as ey, sanitizeAuditConnection as ez, describeIntegrationTool as f, flattenIntegrationToolDefinition as g, InMemoryIntegrationGrantStore as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationCapabilityBinding as j, type IntegrationGrant as k, type IntegrationGrantStore as l, type IntegrationManifest as m, type IntegrationManifestResolution as n, type IntegrationRequirement as o, parseIntegrationToolName as p, type IntegrationRequirementMode as q, type IntegrationRequirementResolution as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationRequirementStatus as u, IntegrationRuntime as v, type IntegrationRuntimeHub as w, type IntegrationRuntimeOptions as x, type IntegrationSandboxBundle as y, createIntegrationRuntime as z };