@tangle-network/agent-integrations 0.29.0 → 0.31.0

package/dist/middleware/index.d.ts

@@ -1,4 +1,4 @@
-import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-CTU4kGId.js';
+import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-Dj0ipP4E.js';
 
 /**
  * @stable Drop-in request middleware that verifies id.tangle.tools

package/dist/middleware/index.js

@@ -3,8 +3,8 @@ import {
   extractToken,
   honoTangleAuthMiddleware,
   requireTangleAuth
-} from "../chunk-SVQ4PHDZ.js";
-import "../chunk-ATYHZXLL.js";
+} from "../chunk-CDY2ETYT.js";
+import "../chunk-Q5X3QNHR.js";
 export {
   expressTangleAuthMiddleware,
   extractToken,

package/dist/registry.d.ts

@@ -1,4 +1,4 @@
-import { C as ConnectorAdapter, R as ResolvedDataSource, d as ConnectorCredentials } from './tangle-id-CTU4kGId.js';
+import { C as ConnectorAdapter, R as ResolvedDataSource, d as ConnectorCredentials } from './tangle-id-Dj0ipP4E.js';
 import './errors-Bg3_rxnQ.js';
 import './connect/index.js';
 import './middleware/index.js';
@@ -59,11 +59,145 @@ declare function buildDefaultIntegrationRegistry(options?: {
     /** @deprecated Use includeTangleCatalog. */
     includeActivepieces?: boolean;
 }): IntegrationRegistry;
+/** Per-entry executability classification. Pure metadata — never loads or
+ *  runs a runtime module. The coverage report consumes this to separate
+ *  "we can execute this today" from "catalog-only / setup-only". */
+interface IntegrationCatalogExecutability {
+    canonicalId: string;
+    /** True when the entry resolves to a runnable action: a first-party /
+     *  sandbox / gateway-executable support tier, or a tangle-catalog entry
+     *  with a resolvable npm runtime package. */
+    executable: boolean;
+    supportTier: IntegrationSupportTier;
+    authKind: IntegrationConnector['auth'];
+    /** Resolvable npm runtime package name when one is registered for this
+     *  connector in the vendored catalog; undefined for first-party adapters
+     *  (which execute in-process) and catalog-only entries. */
+    runtimePackage?: string;
+    actionCount: number;
+    triggerCount: number;
+}
+/** Classify every entry in a composed registry by executability + auth kind
+ *  WITHOUT executing anything. Defaults to {@link buildDefaultIntegrationRegistry}. */
+declare function classifyIntegrationCatalogExecutability(registry?: IntegrationRegistry): IntegrationCatalogExecutability[];
 declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
 declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
 declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
 declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
 
+interface ConnectorAdapterProviderOptions {
+    id?: string;
+    kind?: IntegrationProviderKind;
+    adapters: ConnectorAdapter[];
+    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
+    /** Invoked when an adapter rotates credentials during executeRead /
+     *  executeMutation (e.g. an OAuth access token refreshed on expiry). The
+     *  host re-encrypts + persists the rotated envelope so the next expiry
+     *  does not force a reconnect. Carries the connection so the host can
+     *  resolve the secretRef. */
+    onCredentialsRotated?: (event: {
+        connection: IntegrationConnection;
+        credentials: ConnectorCredentials;
+    }) => Promise<void> | void;
+    now?: () => Date;
+}
+declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
+declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
+declare function createConnectorAdapterCatalogSource(options: {
+    id?: string;
+    providerId?: string;
+    adapters: ConnectorAdapter[];
+    precedence?: number;
+}): IntegrationCatalogSource;
+declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
+
+interface IntegrationSecretStore {
+    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
+    delete?(ref: SecretRef): Promise<void> | void;
+}
+/** Single-use record stashed at OAuth-start and consumed once at callback to
+ *  guard against CSRF / replay. The hub injects its own durable
+ *  implementation (KV/Redis/D1) so the callback can land on any worker. */
+interface IntegrationOAuthState {
+    /** Opaque value round-tripped through the provider redirect. */
+    state: string;
+    /** Provider the auth flow targets. */
+    providerId: string;
+    /** Connector the user is connecting. */
+    connectorId: string;
+    /** Owner initiating the flow. */
+    owner: IntegrationActor;
+    /** Scopes requested at start; verified against the granted scopes on callback. */
+    requestedScopes: string[];
+    /** Redirect URI used at start; MUST match exactly on callback exchange. */
+    redirectUri: string;
+    /** PKCE code_verifier, when the connector uses PKCE. */
+    codeVerifier?: string;
+    /** Absolute expiry (UTC ms since epoch). consume() MUST treat an expired
+     *  record as a miss. */
+    expiresAt: number;
+    /** Arbitrary non-secret context the host pinned at start-time. */
+    metadata?: Record<string, unknown>;
+}
+/** Outcome of consuming an OAuth state record. Callers MUST inspect `ok`
+ *  before using `state`; a miss (`unknown`/`expired`) is the CSRF/replay
+ *  guard firing, not an exception. */
+type IntegrationOAuthStateOutcome = {
+    ok: true;
+    state: IntegrationOAuthState;
+} | {
+    ok: false;
+    reason: 'unknown' | 'expired';
+};
+/** Host-injectable store for single-use OAuth-start records. The default is
+ *  in-memory for local/dev and tests; multi-tenant hubs inject a durable
+ *  encrypted store so callbacks survive worker hops. consume() MUST be
+ *  single-use: a second consume of the same state returns `{ ok: false }`. */
+interface IntegrationOAuthStateStore {
+    put(state: IntegrationOAuthState): Promise<void> | void;
+    consume(state: string): Promise<IntegrationOAuthStateOutcome> | IntegrationOAuthStateOutcome;
+    sweep?(now: number): Promise<void> | void;
+}
+interface ConnectionCredentialResolverOptions {
+    secrets: IntegrationSecretStore;
+    connections?: IntegrationConnectionStore;
+    adapters?: ConnectorAdapter[];
+    now?: () => Date;
+    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
+}
+declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
+    private readonly secrets;
+    get(ref: SecretRef): ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): void;
+    delete(ref: SecretRef): void;
+}
+/** Test/dev double for {@link IntegrationOAuthStateStore}. Production hubs
+ *  inject a durable implementation; this one keeps records in a Map and
+ *  enforces the single-use + expiry contract. */
+declare class InMemoryIntegrationOAuthStateStore implements IntegrationOAuthStateStore {
+    private readonly states;
+    put(state: IntegrationOAuthState): void;
+    consume(state: string): IntegrationOAuthStateOutcome;
+    sweep(now: number): void;
+}
+declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
+declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
+type CredentialBackedAdapterProviderOptions = Omit<ConnectorAdapterProviderOptions, 'resolveDataSource' | 'onCredentialsRotated'> & ConnectionCredentialResolverOptions & {
+    /** Fired after the provider re-persists rotated credentials to the
+     *  secret + connection stores. Receives the hub-shaped event including
+     *  the resolved secretRef so the host can drive external re-encryption
+     *  or telemetry. */
+    onCredentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void;
+};
+declare function createCredentialBackedAdapterProvider(options: CredentialBackedAdapterProviderOptions): IntegrationProvider;
+declare function revokeConnection(input: {
+    connection: IntegrationConnection;
+    connections?: IntegrationConnectionStore;
+    secrets?: IntegrationSecretStore;
+    now?: () => Date;
+}): Promise<IntegrationConnection>;
+
 type IntegrationAuditEventType = 'connection.created' | 'connection.updated' | 'connection.revoked' | 'grant.created' | 'grant.revoked' | 'capability.issued' | 'action.invoked' | 'action.failed' | 'trigger.subscribed' | 'trigger.received' | 'workflow.installed' | 'approval.requested' | 'approval.resolved' | 'healthcheck.completed';
 interface IntegrationAuditEvent {
     id: string;
@@ -248,6 +382,17 @@ declare function parseIntegrationToolName(name: string): {
     actionId: string;
 };
 declare function buildIntegrationToolCatalog(connectors: IntegrationConnector[]): IntegrationToolDefinition[];
+/** Flatten a single (connector, action) pair into the tool descriptor the
+ *  catalog exposes. The inverse of {@link parseIntegrationToolName} +
+ *  {@link integrationToolName}: every tool name round-trips back to exactly
+ *  this shape via {@link describeIntegrationTool}. */
+declare function flattenIntegrationToolDefinition(connector: IntegrationConnector, action: IntegrationConnectorAction): IntegrationToolDefinition;
+/** Resolve a single tool's full descriptor from an opaque
+ *  `int_<provider>_<connector>_<action>` name against a composed registry.
+ *  Returns undefined when the name is malformed, the connector is unknown,
+ *  or the action is not defined by that connector. Powers `/tools/describe`
+ *  without callers re-implementing parse → byId → action → flatten. */
+declare function describeIntegrationTool(registry: IntegrationRegistry, toolName: string): IntegrationToolDefinition | undefined;
 declare function buildIntegrationCatalogView(input: {
     discoveryRegistry: IntegrationRegistry;
     executableRegistry?: IntegrationRegistry;
@@ -710,51 +855,6 @@ declare function renderApprovalCopy(input: {
     approvalId?: string;
 }): ConsentSummary;
 
-interface ConnectorAdapterProviderOptions {
-    id?: string;
-    kind?: IntegrationProviderKind;
-    adapters: ConnectorAdapter[];
-    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
-    now?: () => Date;
-}
-declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
-declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
-declare function createConnectorAdapterCatalogSource(options: {
-    id?: string;
-    providerId?: string;
-    adapters: ConnectorAdapter[];
-    precedence?: number;
-}): IntegrationCatalogSource;
-declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
-
-interface IntegrationSecretStore {
-    get(ref: SecretRef): Promise<ConnectorCredentials | undefined> | ConnectorCredentials | undefined;
-    put(ref: SecretRef, credentials: ConnectorCredentials): Promise<void> | void;
-    delete?(ref: SecretRef): Promise<void> | void;
-}
-interface ConnectionCredentialResolverOptions {
-    secrets: IntegrationSecretStore;
-    connections?: IntegrationConnectionStore;
-    adapters?: ConnectorAdapter[];
-    now?: () => Date;
-    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
-}
-declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
-    private readonly secrets;
-    get(ref: SecretRef): ConnectorCredentials | undefined;
-    put(ref: SecretRef, credentials: ConnectorCredentials): void;
-    delete(ref: SecretRef): void;
-}
-declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
-declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
-declare function createCredentialBackedAdapterProvider(options: Omit<ConnectorAdapterProviderOptions, 'resolveDataSource'> & ConnectionCredentialResolverOptions): IntegrationProvider;
-declare function revokeConnection(input: {
-    connection: IntegrationConnection;
-    connections?: IntegrationConnectionStore;
-    secrets?: IntegrationSecretStore;
-    now?: () => Date;
-}): Promise<IntegrationConnection>;
-
 /**
  * Workspace capability discovery — answers "what can this workspace do?"
  * with a typed list of MCP-shape tool descriptors that the agent runtime
@@ -2014,6 +2114,27 @@ declare function getIntegrationFamily(id: IntegrationFamilyId): IntegrationFamil
 
 declare function listIntegrationSpecs(): IntegrationSpec[];
 declare function getIntegrationSpec(kind: string): IntegrationSpec | undefined;
+/** Auth-driving descriptor the hub uses to start a connect flow per provider
+ *  instead of hard-coding scopes/auth kind. Derived from the spec catalog
+ *  ({@link getIntegrationSpec}); undefined when the kind is not in the
+ *  catalog. */
+interface ConnectorAuthSpec {
+    kind: string;
+    authKind: 'oauth2' | 'api_key' | 'none' | 'custom';
+    /** Provider scopes to request in the authorization grant. Empty for
+     *  api_key / none / custom. */
+    requestedScopes: string[];
+    /** OAuth-only: authorization + token endpoints and PKCE posture. Present
+     *  only when authKind === 'oauth2'. */
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    pkce?: 'required' | 'supported' | 'unsupported';
+    redirectUriTemplate?: string;
+    clientIdEnv?: string;
+    clientSecretEnv?: string;
+    extraAuthParams?: Record<string, string>;
+}
+declare function resolveConnectorAuthSpec(kind: string): ConnectorAuthSpec | undefined;
 declare function listExecutableIntegrationSpecs(): IntegrationSpec[];
 declare function integrationSpecToConnector(spec: IntegrationSpec, providerId?: string): IntegrationConnector;
 
@@ -2268,8 +2389,34 @@ interface IntegrationHubOptions {
      *  provider invocation. Use it to pause writes, deny destructive actions,
      *  or apply tenant-specific allow rules. */
     policy?: IntegrationPolicyEngine;
+    /** Host-injectable secret store. Multi-tenant hubs inject a durable
+     *  encrypted store; defaults to {@link InMemoryIntegrationSecretStore} for
+     *  local/dev and tests. The interface is the contract — the lib never
+     *  ships a D1/KV/encryption impl. */
+    secretStore?: IntegrationSecretStore;
+    /** Host-injectable single-use OAuth-state store guarding the start →
+     *  callback CSRF boundary. Defaults to
+     *  {@link InMemoryIntegrationOAuthStateStore}. */
+    oauthStateStore?: IntegrationOAuthStateStore;
+    /** TTL applied to OAuth-state records the hub stashes at startAuth.
+     *  Defaults to 10 minutes. */
+    oauthStateTtlMs?: number;
+    /** Fired whenever a provider surfaces rotated credentials during an
+     *  invoke (e.g. an OAuth access token refreshed on expiry). The host
+     *  re-encrypts + persists the rotated envelope so the next expiry does
+     *  not force a reconnect. The hub also writes the rotated credentials to
+     *  {@link secretStore} when the connection carries a secretRef. */
+    credentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void;
     now?: () => Date;
 }
+/** Emitted when a provider rotates credentials mid-invoke. The host
+ *  re-persists `credentials` against `secretRef` (when present) so the
+ *  refreshed token survives the call. */
+interface IntegrationCredentialsRotatedEvent {
+    connection: IntegrationConnection;
+    secretRef?: SecretRef;
+    credentials: ConnectorCredentials;
+}
 interface HttpIntegrationProviderOptions {
     id: string;
     kind?: IntegrationProviderKind;
@@ -2298,6 +2445,12 @@ declare class IntegrationHub {
     private readonly capabilitySecret;
     private readonly guard;
     private readonly policy;
+    /** Host-injected (or in-memory default) secret store. The hub re-persists
+     *  rotated credentials here when a connection carries a secretRef. */
+    readonly secretStore: IntegrationSecretStore;
+    private readonly oauthStateStore;
+    private readonly oauthStateTtlMs;
+    private readonly credentialsRotated;
     private readonly now;
     constructor(options: IntegrationHubOptions);
     listConnectors(): Promise<IntegrationConnector[]>;
@@ -2326,4 +2479,4 @@ declare function createHttpIntegrationProvider(options: HttpIntegrationProviderO
 declare function signCapability(capability: IntegrationCapability, secret: string): string;
 declare function verifyCapabilityToken(token: string, secret: string): IntegrationCapability;
 
-export { createTangleCatalogInstalledPackageExecutor as $, type CreateGrantsInput as A, type IntegrationHubAuth as B, type CapabilityBundleResult as C, type ComposeIntegrationRegistryOptions, IntegrationHubClient as D, type IntegrationHubClientOptions as E, IntegrationHubRequestError as F, type MintCapabilityBundleInput as G, createIntegrationHubClient as H, type IntegrationCatalogView as I, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, type TangleCatalogAuthResolverOptions as J, type TangleCatalogHttpAuthResolverOptions as K, type ListGrantsInput as L, type McpToolDefinition as M, type TangleCatalogHttpAuthResolverRequest as N, type TangleCatalogInstalledPackageExecutorOptions as O, type TangleCatalogRuntimeHandlerOptions as P, type TangleCatalogRuntimeHttpRequest as Q, type ResolveManifestInput as R, type TangleCatalogRuntimeHttpResponse as S, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as T, type TangleCatalogRuntimeInvocation as U, type TangleCatalogRuntimeModuleAction as V, type TangleCatalogRuntimePackageCoverageOptions as W, type TangleCatalogRuntimePackageCoverageRow as X, auditTangleCatalogRuntimePackages as Y, createTangleCatalogCredentialAuthResolver as Z, createTangleCatalogHttpAuthResolver as _, type IntegrationToolDefinition as a, type CanonicalLaunchConnectorOptions as a$, createTangleCatalogRuntimeHandler as a0, signTangleCatalogRuntimeRequest as a1, tangleCatalogAuthValue as a2, verifyTangleCatalogRuntimeSignature as a3, type ApiKeyAuthSpec as a4, type ConsoleStep as a5, type CredentialFieldSpec as a6, type CredentialValidationInput as a7, type CredentialValidationResult as a8, type CustomAuthSpec as a9, consoleStepsToText as aA, getIntegrationFamily as aB, getIntegrationSpec as aC, integrationSpecToConnector as aD, listExecutableIntegrationSpecs as aE, listIntegrationSpecs as aF, renderAgentToolDescription as aG, renderConsoleSteps as aH, renderRunbookMarkdown as aI, specAuthToConnectorAuth as aJ, validateCredentialFormat as aK, validateCredentialSet as aL, validateIntegrationSpec as aM, ACTIVEPIECES_OVERRIDES as aN, ACTIVEPIECES_PUBLIC_CATALOG_URL as aO, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as aP, type ActivepiecesCatalogAuthField as aQ, type ActivepiecesCatalogEntry as aR, type ActivepiecesExecutorInvocation as aS, type ActivepiecesExecutorProviderOptions as aT, type ActivepiecesHttpExecutorOptions as aU, type ActivepiecesPieceOverride as aV, type ActivepiecesRuntimeRequest as aW, ApprovalBackedPolicyEngine as aX, type ApprovalBackedPolicyOptions as aY, CANONICAL_INTEGRATION_ACTIONS as aZ, type CanonicalIntegrationActionId as a_, type HealthcheckPlan as aa, type HealthcheckSpec as ab, type HmacAuthSpec as ac, INTEGRATION_FAMILIES as ad, type IntegrationAuthMode as ae, type IntegrationAuthSpec as af, type IntegrationFamilyId as ag, type IntegrationFamilySpec as ah, type IntegrationLifecycleSpec as ai, type IntegrationPlannerHints as aj, type IntegrationSetupSpec as ak, type IntegrationSpec as al, type IntegrationSpecStatus as am, type IntegrationSpecValidationIssue as an, type IntegrationSpecValidationResult as ao, type NoneAuthSpec as ap, type NormalizedPermission as aq, type OAuth2AuthSpec as ar, type PermissionDescriptor as as, type PostSetupCheck as at, type Quirk as au, type RenderSpecOptions as av, type RenderedConsoleStep as aw, type ScopeDescriptor as ax, assertValidIntegrationSpec as ay, buildHealthcheckPlan as az, type IntegrationToolSearchFilters as b, type IntegrationHealthcheckStore as b$, type CatalogExecutorInvocation as b0, type CatalogExecutorProviderOptions as b1, type CompleteAuthRequest as b2, type ConnectionCredentialResolverOptions as b3, type ConnectorAdapterProviderOptions as b4, type ConsentSummary as b5, DEFAULT_INTEGRATION_BRIDGE_ENV as b6, DefaultIntegrationActionGuard as b7, type DiscoverWorkspaceCapabilitiesInput as b8, type GatewayCatalogAction as b9, type IntegrationApprovalStatus as bA, type IntegrationApprovalStore as bB, type IntegrationAuditEvent as bC, type IntegrationAuditEventType as bD, type IntegrationAuditFilter as bE, type IntegrationAuditSink as bF, type IntegrationAuditStore as bG, type IntegrationBridgePayload as bH, type IntegrationBridgeToolBinding as bI, type IntegrationCapability as bJ, type IntegrationCatalogFreshnessOptions as bK, type IntegrationCatalogFreshnessResult as bL, type IntegrationConnection as bM, type IntegrationConnectionStore as bN, type IntegrationConnector as bO, type IntegrationConnectorAction as bP, type IntegrationConnectorCategory as bQ, type IntegrationConnectorTrigger as bR, type IntegrationCoveragePriority as bS, type IntegrationCoverageSpec as bT, type IntegrationDataClass as bU, IntegrationError as bV, type IntegrationEventStore as bW, type IntegrationGuardContext as bX, type IntegrationHealthcheckCheck as bY, type IntegrationHealthcheckResult as bZ, type IntegrationHealthcheckStatus as b_, type GatewayCatalogEntry as ba, type GatewayCatalogProviderOptions as bb, type GatewayCatalogTrigger as bc, type GraphqlOperationSpec as bd, type HttpIntegrationProviderOptions as be, type ImportCatalogOptions as bf, InMemoryConnectionStore as bg, InMemoryIntegrationApprovalStore as bh, InMemoryIntegrationAuditStore as bi, InMemoryIntegrationEventStore as bj, InMemoryIntegrationHealthcheckStore as bk, InMemoryIntegrationIdempotencyStore as bl, InMemoryIntegrationSecretStore as bm, InMemoryIntegrationWorkflowStore as bn, type InferIntegrationRequirementsOptions as bo, type InstalledIntegrationWorkflow as bp, type IntegrationActionGuard as bq, type IntegrationActionPack as br, type IntegrationActionRequest as bs, type IntegrationActionResult as bt, type IntegrationActionRisk as bu, buildDefaultIntegrationRegistry, type IntegrationActor as bv, type IntegrationApprovalFilter as bw, type IntegrationApprovalRecord as bx, type IntegrationApprovalRequest as by, type IntegrationApprovalResolution as bz, type IntegrationToolSearchResult as c, type TangleIntegrationCatalogFreshnessOptions as c$, IntegrationHub as c0, type IntegrationHubOptions as c1, type IntegrationIdempotencyRecord as c2, type IntegrationIdempotencyStore as c3, type IntegrationInvocationEnvelope as c4, type IntegrationInvocationEnvelopeValidationOptions as c5, type IntegrationPolicyDecision as c6, type IntegrationPolicyEffect as c7, type IntegrationPolicyEngine as c8, type IntegrationPolicyRule as c9, type OpenApiOperation as cA, PROVIDER_PASSTHROUGH_ACTION as cB, type PlatformIntegrationPolicyPresetOptions as cC, type ProviderHttpRequestInput as cD, type ProviderPassthroughPolicy as cE, type RenderConsentOptions as cF, type SecretRef as cG, type StartAuthRequest as cH, type StartAuthResult as cI, type StartedTangleCatalogRuntimeNodeServer as cJ, StaticIntegrationPolicyEngine as cK, type StaticIntegrationPolicyOptions as cL, type StoredIntegrationEvent as cM, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cN, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cO, type TangleCatalogExecutorInvocation as cP, type TangleCatalogExecutorProviderOptions as cQ, type TangleCatalogHttpExecutorInvocation as cR, type TangleCatalogHttpExecutorOptions as cS, type TangleCatalogRuntimeActionRequest as cT, type TangleCatalogRuntimeNodeServerOptions as cU, type TangleCatalogRuntimePackageManifest as cV, type TangleCatalogRuntimePackageManifestOptions as cW, type TangleCatalogRuntimePiece as cX, type TangleCatalogRuntimeRequest as cY, type TangleCatalogTriggerInvocation as cZ, type TangleIntegrationCatalogEntry as c_, type IntegrationProvider as ca, canonicalConnectorId, type IntegrationProviderKind as cb, type IntegrationRateLimitDecision as cc, type IntegrationRateLimiter as cd, IntegrationSandboxHost as ce, type IntegrationSandboxHostHub as cf, type IntegrationSandboxHostOptions as cg, type IntegrationSecretStore as ch, type IntegrationTriggerEvent as ci, type IntegrationTriggerSubscription as cj, type IntegrationWebhookReceiverResult as ck, type IntegrationWorkflowDefinition as cl, IntegrationWorkflowRuntime as cm, type IntegrationWorkflowRuntimeHub as cn, type IntegrationWorkflowRuntimeOptions as co, composeIntegrationRegistry, type IntegrationWorkflowStore as cp, type InvokeWithCapabilityRequest as cq, type IssueCapabilityRequest as cr, type IssuedIntegrationCapability as cs, type ManifestValidationIssue as ct, type ManifestValidationResult as cu, type McpCatalog as cv, type McpCatalogTool as cw, type MissingRequirementExplanation as cx, type NormalizedIntegrationResult as cy, type OpenApiDocument as cz, buildIntegrationCatalogView as d, importOpenApiConnector as d$, type TangleIntegrationCatalogFreshnessResult as d0, type TangleIntegrationContract as d1, type TangleIntegrationContractStatus as d2, type TangleIntegrationImplementationKind as d3, type TangleIntegrationInvokeInput as d4, type TangleIntegrationInvokeResult as d5, TangleIntegrationsClient as d6, type TangleIntegrationsClientOptions as d7, type WorkspaceCapability as d8, type WorkspaceCapabilityDiscovery as d9, createConnectorAdapterCatalogSource as dA, createConnectorAdapterProvider as dB, createCredentialBackedAdapterProvider as dC, createDefaultIntegrationActionGuard as dD, createDefaultIntegrationPolicyEngine as dE, createGatewayCatalogProvider as dF, createHttpIntegrationProvider as dG, createIntegrationAuditEvent as dH, createIntegrationWorkflowRuntime as dI, createMockIntegrationProvider as dJ, createPlatformIntegrationPolicyPreset as dK, createTangleCatalogExecutorProvider as dL, createTangleCatalogHttpExecutor as dM, createTangleCatalogRuntimeNodeRequestListener as dN, createTangleIntegrationsClient as dO, decodeIntegrationBridgePayload as dP, discoverWorkspaceCapabilities as dQ, dispatchIntegrationInvocation as dR, encodeIntegrationBridgePayload as dS, explainMissingRequirements as dT, extractActivepiecesPublicPieceCount as dU, extractExternalCatalogPublicCount as dV, filterDiscoveryByWorkspaceScopes as dW, getActivepiecesOverride as dX, healthcheckRequest as dY, importGraphqlConnector as dZ, importMcpConnector as d_, type WorkspaceToolSchema as da, type WorkspaceTrigger as db, adapterManifestsToConnectors as dc, assertValidIntegrationManifest as dd, auditIntegrationCatalogFreshness as de, auditTangleIntegrationCatalogFreshness as df, buildActivepiecesConnectors as dg, buildActivepiecesRuntimeRequest as dh, buildApprovalRequest as di, buildCanonicalLaunchConnectors as dj, buildIntegrationBridgeEnvironment as dk, buildIntegrationBridgePayload as dl, buildIntegrationCoverageConnectors as dm, buildIntegrationInvocationEnvelope as dn, buildTangleCatalogRuntimePackageManifest as dp, buildTangleCatalogRuntimeRequest as dq, buildTangleIntegrationCatalogConnectors as dr, calendarExercisePlannerManifest as ds, canonicalActionConnectorId as dt, createActivepiecesExecutorProvider as du, createActivepiecesHttpExecutor as dv, createApprovalBackedPolicyEngine as dw, createAuditingActionGuard as dx, createCatalogExecutorProvider as dy, createConnectionCredentialResolver as dz, buildIntegrationToolCatalog as e, inferIntegrationManifestFromTools as e0, integrationCoverageChecklistMarkdown as e1, invocationRequestFromEnvelope as e2, listActivepiecesCatalogEntries as e3, listIntegrationCoverageSpecs as e4, listTangleIntegrationCatalogEntries as e5, listTangleIntegrationCatalogRuntimePackages as e6, listTangleIntegrationContracts as e7, manifestToConnector as e8, normalizeGatewayCatalog as e9, normalizeIntegrationResult as ea, parseIntegrationBridgeEnvironment as eb, receiveIntegrationWebhook as ec, redactApprovalRequest as ed, redactCapability as ee, redactIntegrationBridgePayload as ef, redactInvocationEnvelope as eg, renderApprovalCopy as eh, renderConsentSummary as ei, renderTangleCatalogRuntimePnpmAddCommand as ej, resolveConnectionCredentials as ek, resolveIntegrationApproval as el, revokeConnection as em, runIntegrationHealthcheck as en, runIntegrationHealthchecks as eo, sanitizeAuditConnection as ep, sanitizeConnection as eq, signActivepiecesRuntimeRequest as er, signCapability as es, startTangleCatalogRuntimeNodeServer as et, storedEventToTriggerEvent as eu, validateIntegrationInvocationEnvelope as ev, validateIntegrationManifest as ew, validateProviderPassthroughRequest as ex, verifyActivepiecesRuntimeSignature as ey, verifyCapabilityToken as ez, InMemoryIntegrationGrantStore as f, type IntegrationCapabilityBinding as g, type IntegrationGrant as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationGrantStore as j, type IntegrationManifest as k, type IntegrationManifestResolution as l, type IntegrationRequirement as m, type IntegrationRequirementMode as n, type IntegrationRequirementResolution as o, parseIntegrationToolName as p, type IntegrationRequirementStatus as q, IntegrationRuntime as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationRuntimeHub as u, type IntegrationRuntimeOptions as v, type IntegrationSandboxBundle as w, createIntegrationRuntime as x, type CheckConnectorInput as y, type CheckConnectorResult as z };
+export { createTangleCatalogCredentialAuthResolver as $, type CheckConnectorInput as A, type CheckConnectorResult as B, type CapabilityBundleResult as C, type ComposeIntegrationRegistryOptions, type CreateGrantsInput as D, type IntegrationHubAuth as E, IntegrationHubClient as F, type IntegrationHubClientOptions as G, IntegrationHubRequestError as H, type IntegrationCatalogView as I, type IntegrationCatalogExecutability, type IntegrationCatalogSource, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, type MintCapabilityBundleInput as J, createIntegrationHubClient as K, type ListGrantsInput as L, type McpToolDefinition as M, type TangleCatalogAuthResolverOptions as N, type TangleCatalogHttpAuthResolverOptions as O, type TangleCatalogHttpAuthResolverRequest as P, type TangleCatalogInstalledPackageExecutorOptions as Q, type ResolveManifestInput as R, type TangleCatalogRuntimeHandlerOptions as S, TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER as T, type TangleCatalogRuntimeHttpRequest as U, type TangleCatalogRuntimeHttpResponse as V, type TangleCatalogRuntimeInvocation as W, type TangleCatalogRuntimeModuleAction as X, type TangleCatalogRuntimePackageCoverageOptions as Y, type TangleCatalogRuntimePackageCoverageRow as Z, auditTangleCatalogRuntimePackages as _, type IntegrationToolDefinition as a, ApprovalBackedPolicyEngine as a$, createTangleCatalogHttpAuthResolver as a0, createTangleCatalogInstalledPackageExecutor as a1, createTangleCatalogRuntimeHandler as a2, signTangleCatalogRuntimeRequest as a3, tangleCatalogAuthValue as a4, verifyTangleCatalogRuntimeSignature as a5, type ApiKeyAuthSpec as a6, type ConnectorAuthSpec as a7, type ConsoleStep as a8, type CredentialFieldSpec as a9, type ScopeDescriptor as aA, assertValidIntegrationSpec as aB, buildHealthcheckPlan as aC, consoleStepsToText as aD, getIntegrationFamily as aE, getIntegrationSpec as aF, integrationSpecToConnector as aG, listExecutableIntegrationSpecs as aH, listIntegrationSpecs as aI, renderAgentToolDescription as aJ, renderConsoleSteps as aK, renderRunbookMarkdown as aL, resolveConnectorAuthSpec as aM, specAuthToConnectorAuth as aN, validateCredentialFormat as aO, validateCredentialSet as aP, validateIntegrationSpec as aQ, ACTIVEPIECES_OVERRIDES as aR, ACTIVEPIECES_PUBLIC_CATALOG_URL as aS, ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER as aT, type ActivepiecesCatalogAuthField as aU, type ActivepiecesCatalogEntry as aV, type ActivepiecesExecutorInvocation as aW, type ActivepiecesExecutorProviderOptions as aX, type ActivepiecesHttpExecutorOptions as aY, type ActivepiecesPieceOverride as aZ, type ActivepiecesRuntimeRequest as a_, type CredentialValidationInput as aa, type CredentialValidationResult as ab, type CustomAuthSpec as ac, type HealthcheckPlan as ad, type HealthcheckSpec as ae, type HmacAuthSpec as af, INTEGRATION_FAMILIES as ag, type IntegrationAuthMode as ah, type IntegrationAuthSpec as ai, type IntegrationFamilyId as aj, type IntegrationFamilySpec as ak, type IntegrationLifecycleSpec as al, type IntegrationPlannerHints as am, type IntegrationSetupSpec as an, type IntegrationSpec as ao, type IntegrationSpecStatus as ap, type IntegrationSpecValidationIssue as aq, type IntegrationSpecValidationResult as ar, type NoneAuthSpec as as, type NormalizedPermission as at, type OAuth2AuthSpec as au, type PermissionDescriptor as av, type PostSetupCheck as aw, type Quirk as ax, type RenderSpecOptions as ay, type RenderedConsoleStep as az, type IntegrationToolSearchFilters as b, type IntegrationDataClass as b$, type ApprovalBackedPolicyOptions as b0, CANONICAL_INTEGRATION_ACTIONS as b1, type CanonicalIntegrationActionId as b2, type CanonicalLaunchConnectorOptions as b3, type CatalogExecutorInvocation as b4, type CatalogExecutorProviderOptions as b5, type CompleteAuthRequest as b6, type ConnectionCredentialResolverOptions as b7, type ConnectorAdapterProviderOptions as b8, type ConsentSummary as b9, type IntegrationActionRisk as bA, type IntegrationActor as bB, type IntegrationApprovalFilter as bC, type IntegrationApprovalRecord as bD, type IntegrationApprovalRequest as bE, type IntegrationApprovalResolution as bF, type IntegrationApprovalStatus as bG, type IntegrationApprovalStore as bH, type IntegrationAuditEvent as bI, type IntegrationAuditEventType as bJ, type IntegrationAuditFilter as bK, type IntegrationAuditSink as bL, type IntegrationAuditStore as bM, type IntegrationBridgePayload as bN, type IntegrationBridgeToolBinding as bO, type IntegrationCapability as bP, type IntegrationCatalogFreshnessOptions as bQ, type IntegrationCatalogFreshnessResult as bR, type IntegrationConnection as bS, type IntegrationConnectionStore as bT, type IntegrationConnector as bU, type IntegrationConnectorAction as bV, type IntegrationConnectorCategory as bW, type IntegrationConnectorTrigger as bX, type IntegrationCoveragePriority as bY, type IntegrationCoverageSpec as bZ, type IntegrationCredentialsRotatedEvent as b_, type CredentialBackedAdapterProviderOptions as ba, DEFAULT_INTEGRATION_BRIDGE_ENV as bb, DefaultIntegrationActionGuard as bc, type DiscoverWorkspaceCapabilitiesInput as bd, type GatewayCatalogAction as be, type GatewayCatalogEntry as bf, type GatewayCatalogProviderOptions as bg, type GatewayCatalogTrigger as bh, type GraphqlOperationSpec as bi, type HttpIntegrationProviderOptions as bj, type ImportCatalogOptions as bk, InMemoryConnectionStore as bl, InMemoryIntegrationApprovalStore as bm, InMemoryIntegrationAuditStore as bn, InMemoryIntegrationEventStore as bo, InMemoryIntegrationHealthcheckStore as bp, InMemoryIntegrationIdempotencyStore as bq, InMemoryIntegrationOAuthStateStore as br, InMemoryIntegrationSecretStore as bs, InMemoryIntegrationWorkflowStore as bt, type InferIntegrationRequirementsOptions as bu, buildDefaultIntegrationRegistry, type InstalledIntegrationWorkflow as bv, type IntegrationActionGuard as bw, type IntegrationActionPack as bx, type IntegrationActionRequest as by, type IntegrationActionResult as bz, type IntegrationToolSearchResult as c, type TangleCatalogHttpExecutorInvocation as c$, IntegrationError as c0, type IntegrationEventStore as c1, type IntegrationGuardContext as c2, type IntegrationHealthcheckCheck as c3, type IntegrationHealthcheckResult as c4, type IntegrationHealthcheckStatus as c5, type IntegrationHealthcheckStore as c6, IntegrationHub as c7, type IntegrationHubOptions as c8, type IntegrationIdempotencyRecord as c9, type InvokeWithCapabilityRequest as cA, type IssueCapabilityRequest as cB, type IssuedIntegrationCapability as cC, type ManifestValidationIssue as cD, type ManifestValidationResult as cE, type McpCatalog as cF, type McpCatalogTool as cG, type MissingRequirementExplanation as cH, type NormalizedIntegrationResult as cI, type OpenApiDocument as cJ, type OpenApiOperation as cK, PROVIDER_PASSTHROUGH_ACTION as cL, type PlatformIntegrationPolicyPresetOptions as cM, type ProviderHttpRequestInput as cN, type ProviderPassthroughPolicy as cO, type RenderConsentOptions as cP, type SecretRef as cQ, type StartAuthRequest as cR, type StartAuthResult as cS, type StartedTangleCatalogRuntimeNodeServer as cT, StaticIntegrationPolicyEngine as cU, type StaticIntegrationPolicyOptions as cV, type StoredIntegrationEvent as cW, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID as cX, TANGLE_INTEGRATIONS_CATALOG_SOURCE as cY, type TangleCatalogExecutorInvocation as cZ, type TangleCatalogExecutorProviderOptions as c_, type IntegrationIdempotencyStore as ca, canonicalConnectorId, type IntegrationInvocationEnvelope as cb, type IntegrationInvocationEnvelopeValidationOptions as cc, type IntegrationOAuthState as cd, type IntegrationOAuthStateOutcome as ce, type IntegrationOAuthStateStore as cf, type IntegrationPolicyDecision as cg, type IntegrationPolicyEffect as ch, type IntegrationPolicyEngine as ci, type IntegrationPolicyRule as cj, type IntegrationProvider as ck, type IntegrationProviderKind as cl, classifyIntegrationCatalogExecutability, type IntegrationRateLimitDecision as cm, type IntegrationRateLimiter as cn, IntegrationSandboxHost as co, composeIntegrationRegistry, type IntegrationSandboxHostHub as cp, type IntegrationSandboxHostOptions as cq, type IntegrationSecretStore as cr, type IntegrationTriggerEvent as cs, type IntegrationTriggerSubscription as ct, type IntegrationWebhookReceiverResult as cu, type IntegrationWorkflowDefinition as cv, IntegrationWorkflowRuntime as cw, type IntegrationWorkflowRuntimeHub as cx, type IntegrationWorkflowRuntimeOptions as cy, type IntegrationWorkflowStore as cz, buildIntegrationCatalogView as d, dispatchIntegrationInvocation as d$, type TangleCatalogHttpExecutorOptions as d0, type TangleCatalogRuntimeActionRequest as d1, type TangleCatalogRuntimeNodeServerOptions as d2, type TangleCatalogRuntimePackageManifest as d3, type TangleCatalogRuntimePackageManifestOptions as d4, type TangleCatalogRuntimePiece as d5, type TangleCatalogRuntimeRequest as d6, type TangleCatalogTriggerInvocation as d7, type TangleIntegrationCatalogEntry as d8, type TangleIntegrationCatalogFreshnessOptions as d9, buildTangleCatalogRuntimeRequest as dA, buildTangleIntegrationCatalogConnectors as dB, calendarExercisePlannerManifest as dC, canonicalActionConnectorId as dD, createActivepiecesExecutorProvider as dE, createActivepiecesHttpExecutor as dF, createApprovalBackedPolicyEngine as dG, createAuditingActionGuard as dH, createCatalogExecutorProvider as dI, createConnectionCredentialResolver as dJ, createConnectorAdapterCatalogSource as dK, createConnectorAdapterProvider as dL, createCredentialBackedAdapterProvider as dM, createDefaultIntegrationActionGuard as dN, createDefaultIntegrationPolicyEngine as dO, createGatewayCatalogProvider as dP, createHttpIntegrationProvider as dQ, createIntegrationAuditEvent as dR, createIntegrationWorkflowRuntime as dS, createMockIntegrationProvider as dT, createPlatformIntegrationPolicyPreset as dU, createTangleCatalogExecutorProvider as dV, createTangleCatalogHttpExecutor as dW, createTangleCatalogRuntimeNodeRequestListener as dX, createTangleIntegrationsClient as dY, decodeIntegrationBridgePayload as dZ, discoverWorkspaceCapabilities as d_, type TangleIntegrationCatalogFreshnessResult as da, type TangleIntegrationContract as db, type TangleIntegrationContractStatus as dc, type TangleIntegrationImplementationKind as dd, type TangleIntegrationInvokeInput as de, type TangleIntegrationInvokeResult as df, TangleIntegrationsClient as dg, type TangleIntegrationsClientOptions as dh, type WorkspaceCapability as di, type WorkspaceCapabilityDiscovery as dj, type WorkspaceToolSchema as dk, type WorkspaceTrigger as dl, adapterManifestsToConnectors as dm, assertValidIntegrationManifest as dn, auditIntegrationCatalogFreshness as dp, auditTangleIntegrationCatalogFreshness as dq, buildActivepiecesConnectors as dr, buildActivepiecesRuntimeRequest as ds, buildApprovalRequest as dt, buildCanonicalLaunchConnectors as du, buildIntegrationBridgeEnvironment as dv, buildIntegrationBridgePayload as dw, buildIntegrationCoverageConnectors as dx, buildIntegrationInvocationEnvelope as dy, buildTangleCatalogRuntimePackageManifest as dz, buildIntegrationToolCatalog as e, encodeIntegrationBridgePayload as e0, explainMissingRequirements as e1, extractActivepiecesPublicPieceCount as e2, extractExternalCatalogPublicCount as e3, filterDiscoveryByWorkspaceScopes as e4, getActivepiecesOverride as e5, healthcheckRequest as e6, importGraphqlConnector as e7, importMcpConnector as e8, importOpenApiConnector as e9, sanitizeConnection as eA, signActivepiecesRuntimeRequest as eB, signCapability as eC, startTangleCatalogRuntimeNodeServer as eD, storedEventToTriggerEvent as eE, validateIntegrationInvocationEnvelope as eF, validateIntegrationManifest as eG, validateProviderPassthroughRequest as eH, verifyActivepiecesRuntimeSignature as eI, verifyCapabilityToken as eJ, inferIntegrationManifestFromTools as ea, integrationCoverageChecklistMarkdown as eb, invocationRequestFromEnvelope as ec, listActivepiecesCatalogEntries as ed, listIntegrationCoverageSpecs as ee, listTangleIntegrationCatalogEntries as ef, listTangleIntegrationCatalogRuntimePackages as eg, listTangleIntegrationContracts as eh, manifestToConnector as ei, normalizeGatewayCatalog as ej, normalizeIntegrationResult as ek, parseIntegrationBridgeEnvironment as el, receiveIntegrationWebhook as em, redactApprovalRequest as en, redactCapability as eo, redactIntegrationBridgePayload as ep, redactInvocationEnvelope as eq, renderApprovalCopy as er, renderConsentSummary as es, renderTangleCatalogRuntimePnpmAddCommand as et, resolveConnectionCredentials as eu, resolveIntegrationApproval as ev, revokeConnection as ew, runIntegrationHealthcheck as ex, runIntegrationHealthchecks as ey, sanitizeAuditConnection as ez, describeIntegrationTool as f, flattenIntegrationToolDefinition as g, InMemoryIntegrationGrantStore as h, integrationToolName as i, inferIntegrationSupportTier, type IntegrationCapabilityBinding as j, type IntegrationGrant as k, type IntegrationGrantStore as l, type IntegrationManifest as m, type IntegrationManifestResolution as n, type IntegrationRequirement as o, parseIntegrationToolName as p, type IntegrationRequirementMode as q, type IntegrationRequirementResolution as r, searchIntegrationTools as s, summarizeIntegrationRegistry, toMcpTools as t, type IntegrationRequirementStatus as u, IntegrationRuntime as v, type IntegrationRuntimeHub as w, type IntegrationRuntimeOptions as x, type IntegrationSandboxBundle as y, createIntegrationRuntime as z };

package/dist/registry.js

@@ -1,22 +1,24 @@
 import {
   buildDefaultIntegrationRegistry,
   canonicalConnectorId,
+  classifyIntegrationCatalogExecutability,
   composeIntegrationRegistry,
   inferIntegrationSupportTier,
   summarizeIntegrationRegistry
-} from "./chunk-TUX6MJJ4.js";
-import "./chunk-P24T3MLM.js";
-import "./chunk-SVQ4PHDZ.js";
+} from "./chunk-M2RFFAMB.js";
+import "./chunk-JCHD6L3B.js";
+import "./chunk-CDY2ETYT.js";
 import "./chunk-H4XYLS7T.js";
-import "./chunk-YOKNZY2N.js";
-import "./chunk-4JQ754PA.js";
+import "./chunk-S2MVWQYL.js";
+import "./chunk-VVC7U7W7.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-JU25UDN2.js";
+import "./chunk-F4YILONK.js";
 import "./chunk-2TW2QKGZ.js";
-import "./chunk-ATYHZXLL.js";
+import "./chunk-Q5X3QNHR.js";
 export {
   buildDefaultIntegrationRegistry,
   canonicalConnectorId,
+  classifyIntegrationCatalogExecutability,
   composeIntegrationRegistry,
   inferIntegrationSupportTier,
   summarizeIntegrationRegistry

package/dist/runtime.d.ts

@@ -1,5 +1,5 @@
-export { f as InMemoryIntegrationGrantStore, g as IntegrationCapabilityBinding, h as IntegrationGrant, j as IntegrationGrantStore, k as IntegrationManifest, l as IntegrationManifestResolution, m as IntegrationRequirement, n as IntegrationRequirementMode, o as IntegrationRequirementResolution, q as IntegrationRequirementStatus, r as IntegrationRuntime, u as IntegrationRuntimeHub, v as IntegrationRuntimeOptions, w as IntegrationSandboxBundle, x as createIntegrationRuntime } from './registry.js';
-import './tangle-id-CTU4kGId.js';
+export { h as InMemoryIntegrationGrantStore, j as IntegrationCapabilityBinding, k as IntegrationGrant, l as IntegrationGrantStore, m as IntegrationManifest, n as IntegrationManifestResolution, o as IntegrationRequirement, q as IntegrationRequirementMode, r as IntegrationRequirementResolution, u as IntegrationRequirementStatus, v as IntegrationRuntime, w as IntegrationRuntimeHub, x as IntegrationRuntimeOptions, y as IntegrationSandboxBundle, z as createIntegrationRuntime } from './registry.js';
+import './tangle-id-Dj0ipP4E.js';
 import './errors-Bg3_rxnQ.js';
 import './connect/index.js';
 import './middleware/index.js';

package/dist/runtime.js

@@ -2,16 +2,16 @@ import {
   InMemoryIntegrationGrantStore,
   IntegrationRuntime,
   createIntegrationRuntime
-} from "./chunk-TUX6MJJ4.js";
-import "./chunk-P24T3MLM.js";
-import "./chunk-SVQ4PHDZ.js";
+} from "./chunk-M2RFFAMB.js";
+import "./chunk-JCHD6L3B.js";
+import "./chunk-CDY2ETYT.js";
 import "./chunk-H4XYLS7T.js";
-import "./chunk-YOKNZY2N.js";
-import "./chunk-4JQ754PA.js";
+import "./chunk-S2MVWQYL.js";
+import "./chunk-VVC7U7W7.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-JU25UDN2.js";
+import "./chunk-F4YILONK.js";
 import "./chunk-2TW2QKGZ.js";
-import "./chunk-ATYHZXLL.js";
+import "./chunk-Q5X3QNHR.js";
 export {
   InMemoryIntegrationGrantStore,
   IntegrationRuntime,

package/dist/specs.d.ts

@@ -1,5 +1,5 @@
-export { a4 as ApiKeyAuthSpec, a5 as ConsoleStep, a6 as CredentialFieldSpec, a7 as CredentialValidationInput, a8 as CredentialValidationResult, a9 as CustomAuthSpec, aa as HealthcheckPlan, ab as HealthcheckSpec, ac as HmacAuthSpec, ad as INTEGRATION_FAMILIES, ae as IntegrationAuthMode, af as IntegrationAuthSpec, ag as IntegrationFamilyId, ah as IntegrationFamilySpec, ai as IntegrationLifecycleSpec, aj as IntegrationPlannerHints, ak as IntegrationSetupSpec, al as IntegrationSpec, am as IntegrationSpecStatus, an as IntegrationSpecValidationIssue, ao as IntegrationSpecValidationResult, ap as NoneAuthSpec, aq as NormalizedPermission, ar as OAuth2AuthSpec, as as PermissionDescriptor, at as PostSetupCheck, au as Quirk, av as RenderSpecOptions, aw as RenderedConsoleStep, ax as ScopeDescriptor, ay as assertValidIntegrationSpec, az as buildHealthcheckPlan, aA as consoleStepsToText, aB as getIntegrationFamily, aC as getIntegrationSpec, aD as integrationSpecToConnector, aE as listExecutableIntegrationSpecs, aF as listIntegrationSpecs, aG as renderAgentToolDescription, aH as renderConsoleSteps, aI as renderRunbookMarkdown, aJ as specAuthToConnectorAuth, aK as validateCredentialFormat, aL as validateCredentialSet, aM as validateIntegrationSpec } from './registry.js';
-import './tangle-id-CTU4kGId.js';
+export { a6 as ApiKeyAuthSpec, a7 as ConnectorAuthSpec, a8 as ConsoleStep, a9 as CredentialFieldSpec, aa as CredentialValidationInput, ab as CredentialValidationResult, ac as CustomAuthSpec, ad as HealthcheckPlan, ae as HealthcheckSpec, af as HmacAuthSpec, ag as INTEGRATION_FAMILIES, ah as IntegrationAuthMode, ai as IntegrationAuthSpec, aj as IntegrationFamilyId, ak as IntegrationFamilySpec, al as IntegrationLifecycleSpec, am as IntegrationPlannerHints, an as IntegrationSetupSpec, ao as IntegrationSpec, ap as IntegrationSpecStatus, aq as IntegrationSpecValidationIssue, ar as IntegrationSpecValidationResult, as as NoneAuthSpec, at as NormalizedPermission, au as OAuth2AuthSpec, av as PermissionDescriptor, aw as PostSetupCheck, ax as Quirk, ay as RenderSpecOptions, az as RenderedConsoleStep, aA as ScopeDescriptor, aB as assertValidIntegrationSpec, aC as buildHealthcheckPlan, aD as consoleStepsToText, aE as getIntegrationFamily, aF as getIntegrationSpec, aG as integrationSpecToConnector, aH as listExecutableIntegrationSpecs, aI as listIntegrationSpecs, aJ as renderAgentToolDescription, aK as renderConsoleSteps, aL as renderRunbookMarkdown, aM as resolveConnectorAuthSpec, aN as specAuthToConnectorAuth, aO as validateCredentialFormat, aP as validateCredentialSet, aQ as validateIntegrationSpec } from './registry.js';
+import './tangle-id-Dj0ipP4E.js';
 import './errors-Bg3_rxnQ.js';
 import './connect/index.js';
 import './middleware/index.js';

package/dist/specs.js

@@ -11,11 +11,12 @@ import {
   renderAgentToolDescription,
   renderConsoleSteps,
   renderRunbookMarkdown,
+  resolveConnectorAuthSpec,
   specAuthToConnectorAuth,
   validateCredentialFormat,
   validateCredentialSet,
   validateIntegrationSpec
-} from "./chunk-4JQ754PA.js";
+} from "./chunk-VVC7U7W7.js";
 export {
   INTEGRATION_FAMILIES,
   assertValidIntegrationSpec,
@@ -29,6 +30,7 @@ export {
   renderAgentToolDescription,
   renderConsoleSteps,
   renderRunbookMarkdown,
+  resolveConnectorAuthSpec,
   specAuthToConnectorAuth,
   validateCredentialFormat,
   validateCredentialSet,

package/dist/tangle-catalog-runtime.d.ts

@@ -1,5 +1,5 @@
-export { T as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, J as TangleCatalogAuthResolverOptions, K as TangleCatalogHttpAuthResolverOptions, N as TangleCatalogHttpAuthResolverRequest, O as TangleCatalogInstalledPackageExecutorOptions, P as TangleCatalogRuntimeHandlerOptions, Q as TangleCatalogRuntimeHttpRequest, S as TangleCatalogRuntimeHttpResponse, U as TangleCatalogRuntimeInvocation, V as TangleCatalogRuntimeModuleAction, W as TangleCatalogRuntimePackageCoverageOptions, X as TangleCatalogRuntimePackageCoverageRow, Y as auditTangleCatalogRuntimePackages, Z as createTangleCatalogCredentialAuthResolver, _ as createTangleCatalogHttpAuthResolver, $ as createTangleCatalogInstalledPackageExecutor, a0 as createTangleCatalogRuntimeHandler, a1 as signTangleCatalogRuntimeRequest, a2 as tangleCatalogAuthValue, a3 as verifyTangleCatalogRuntimeSignature } from './registry.js';
-import './tangle-id-CTU4kGId.js';
+export { T as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, N as TangleCatalogAuthResolverOptions, O as TangleCatalogHttpAuthResolverOptions, P as TangleCatalogHttpAuthResolverRequest, Q as TangleCatalogInstalledPackageExecutorOptions, S as TangleCatalogRuntimeHandlerOptions, U as TangleCatalogRuntimeHttpRequest, V as TangleCatalogRuntimeHttpResponse, W as TangleCatalogRuntimeInvocation, X as TangleCatalogRuntimeModuleAction, Y as TangleCatalogRuntimePackageCoverageOptions, Z as TangleCatalogRuntimePackageCoverageRow, _ as auditTangleCatalogRuntimePackages, $ as createTangleCatalogCredentialAuthResolver, a0 as createTangleCatalogHttpAuthResolver, a1 as createTangleCatalogInstalledPackageExecutor, a2 as createTangleCatalogRuntimeHandler, a3 as signTangleCatalogRuntimeRequest, a4 as tangleCatalogAuthValue, a5 as verifyTangleCatalogRuntimeSignature } from './registry.js';
+import './tangle-id-Dj0ipP4E.js';
 import './errors-Bg3_rxnQ.js';
 import './connect/index.js';
 import './middleware/index.js';

package/dist/tangle-catalog-runtime.js

@@ -8,16 +8,16 @@ import {
   signTangleCatalogRuntimeRequest,
   tangleCatalogAuthValue,
   verifyTangleCatalogRuntimeSignature
-} from "./chunk-TUX6MJJ4.js";
-import "./chunk-P24T3MLM.js";
-import "./chunk-SVQ4PHDZ.js";
+} from "./chunk-M2RFFAMB.js";
+import "./chunk-JCHD6L3B.js";
+import "./chunk-CDY2ETYT.js";
 import "./chunk-H4XYLS7T.js";
-import "./chunk-YOKNZY2N.js";
-import "./chunk-4JQ754PA.js";
+import "./chunk-S2MVWQYL.js";
+import "./chunk-VVC7U7W7.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-JU25UDN2.js";
+import "./chunk-F4YILONK.js";
 import "./chunk-2TW2QKGZ.js";
-import "./chunk-ATYHZXLL.js";
+import "./chunk-Q5X3QNHR.js";
 export {
   TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER,
   auditTangleCatalogRuntimePackages,

package/dist/{tangle-id-CTU4kGId.d.ts → tangle-id-Dj0ipP4E.d.ts}

@@ -192,6 +192,13 @@ interface ConnectorInvocation {
     expectedEtag?: string;
     /** Product/session id (if any) for forensic logging. */
     callSessionId?: string;
+    /** Fired by the adapter when it rotates the credentials mid-call (e.g. an
+     *  OAuth access token refreshed on expiry). The host re-encrypts +
+     *  persists the rotated envelope so the next expiry does not force a
+     *  reconnect. Adapters MUST invoke this with the FULL rotated envelope,
+     *  not a partial — the previous refresh token is preserved by the caller's
+     *  refresh logic, not inferred here. */
+    onCredentialsRotated?: (credentials: ConnectorCredentials) => void;
 }
 /** A single inbound event extracted from a push payload. The webhook
  *  receiver persists one `InboundEvent` row per entry the connector returns. */
@@ -302,7 +309,7 @@ interface ConnectorManifest {
      *  `cache` because they refresh it nightly). */
     defaultConsistencyModel: ConsistencyModel;
     /** Connector category for UI grouping. */
-    category: 'calendar' | 'spreadsheet' | 'crm' | 'doc' | 'webhook' | 'storage' | 'comms' | 'commerce' | 'other';
+    category: 'calendar' | 'spreadsheet' | 'crm' | 'doc' | 'webhook' | 'storage' | 'comms' | 'commerce' | 'database' | 'other';
     /** Optional icon URL or named icon. */
     icon?: string;
     /** Optional per-kind rate-limit budget. The SDK enforces it inside

package/docs/integration-execution-audit.md

@@ -35,7 +35,7 @@ This audit separates product contracts from implementation backends:
 | Package-runtime backends | 659 |
 | Runtime manifest dependencies | 670 |
 | Tangle catalog connectors exposable behind runtime | 669 |
-| Tangle catalog actions exposable behind runtime | 3970 |
+| Tangle catalog actions exposable behind runtime | 3790 |
 
 Full machine-readable matrix: [integration-execution-matrix.json](./integration-execution-matrix.json).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-integrations",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Vendor-neutral integration contracts and runtime helpers for sandbox and agent apps.",
   "homepage": "https://github.com/tangle-network/agent-integrations#readme",
   "repository": {
@@ -93,16 +93,13 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "audit:execution": "pnpm build >/dev/null && node scripts/audit-integration-execution.mjs",
-    "prepare": "tsup",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
-  },
   "devDependencies": {
+    "@activepieces/piece-gmail": "0.12.3",
+    "@activepieces/piece-hackernews": "0.4.3",
+    "@activepieces/piece-json": "0.1.6",
+    "@activepieces/piece-notion": "0.6.1",
+    "@activepieces/piece-slack": "0.17.0",
+    "@activepieces/piece-stripe": "0.6.7",
     "@types/node": "^25.6.0",
     "tsup": "^8.0.0",
     "typescript": "^5.7.0",
@@ -112,5 +109,12 @@
     "node": ">=20"
   },
   "license": "MIT",
-  "packageManager": "pnpm@10.28.0"
-}
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "audit:execution": "pnpm build >/dev/null && node scripts/audit-integration-execution.mjs",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}