@tangle-network/agent-integrations 0.31.0 → 0.33.0

package/dist/index.d.ts

@@ -1,8 +1,1286 @@
-export { aR as ACTIVEPIECES_OVERRIDES, aS as ACTIVEPIECES_PUBLIC_CATALOG_URL, aT as ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER, aU as ActivepiecesCatalogAuthField, aV as ActivepiecesCatalogEntry, aW as ActivepiecesExecutorInvocation, aX as ActivepiecesExecutorProviderOptions, aY as ActivepiecesHttpExecutorOptions, aZ as ActivepiecesPieceOverride, a_ as ActivepiecesRuntimeRequest, a6 as ApiKeyAuthSpec, a$ as ApprovalBackedPolicyEngine, b0 as ApprovalBackedPolicyOptions, b1 as CANONICAL_INTEGRATION_ACTIONS, b2 as CanonicalIntegrationActionId, b3 as CanonicalLaunchConnectorOptions, C as CapabilityBundleResult, b4 as CatalogExecutorInvocation, b5 as CatalogExecutorProviderOptions, A as CheckConnectorInput, B as CheckConnectorResult, b6 as CompleteAuthRequest, ComposeIntegrationRegistryOptions, b7 as ConnectionCredentialResolverOptions, b8 as ConnectorAdapterProviderOptions, a7 as ConnectorAuthSpec, b9 as ConsentSummary, a8 as ConsoleStep, D as CreateGrantsInput, ba as CredentialBackedAdapterProviderOptions, a9 as CredentialFieldSpec, aa as CredentialValidationInput, ab as CredentialValidationResult, ac as CustomAuthSpec, bb as DEFAULT_INTEGRATION_BRIDGE_ENV, bc as DefaultIntegrationActionGuard, bd as DiscoverWorkspaceCapabilitiesInput, be as GatewayCatalogAction, bf as GatewayCatalogEntry, bg as GatewayCatalogProviderOptions, bh as GatewayCatalogTrigger, bi as GraphqlOperationSpec, ad as HealthcheckPlan, ae as HealthcheckSpec, af as HmacAuthSpec, bj as HttpIntegrationProviderOptions, ag as INTEGRATION_FAMILIES, bk as ImportCatalogOptions, bl as InMemoryConnectionStore, bm as InMemoryIntegrationApprovalStore, bn as InMemoryIntegrationAuditStore, bo as InMemoryIntegrationEventStore, h as InMemoryIntegrationGrantStore, bp as InMemoryIntegrationHealthcheckStore, bq as InMemoryIntegrationIdempotencyStore, br as InMemoryIntegrationOAuthStateStore, bs as InMemoryIntegrationSecretStore, bt as InMemoryIntegrationWorkflowStore, bu as InferIntegrationRequirementsOptions, bv as InstalledIntegrationWorkflow, bw as IntegrationActionGuard, bx as IntegrationActionPack, by as IntegrationActionRequest, bz as IntegrationActionResult, bA as IntegrationActionRisk, bB as IntegrationActor, bC as IntegrationApprovalFilter, bD as IntegrationApprovalRecord, bE as IntegrationApprovalRequest, bF as IntegrationApprovalResolution, bG as IntegrationApprovalStatus, bH as IntegrationApprovalStore, bI as IntegrationAuditEvent, bJ as IntegrationAuditEventType, bK as IntegrationAuditFilter, bL as IntegrationAuditSink, bM as IntegrationAuditStore, ah as IntegrationAuthMode, ai as IntegrationAuthSpec, bN as IntegrationBridgePayload, bO as IntegrationBridgeToolBinding, bP as IntegrationCapability, j as IntegrationCapabilityBinding, IntegrationCatalogExecutability, bQ as IntegrationCatalogFreshnessOptions, bR as IntegrationCatalogFreshnessResult, IntegrationCatalogSource, I as IntegrationCatalogView, bS as IntegrationConnection, bT as IntegrationConnectionStore, bU as IntegrationConnector, bV as IntegrationConnectorAction, bW as IntegrationConnectorCategory, bX as IntegrationConnectorTrigger, bY as IntegrationCoveragePriority, bZ as IntegrationCoverageSpec, b_ as IntegrationCredentialsRotatedEvent, b$ as IntegrationDataClass, c0 as IntegrationError, c1 as IntegrationEventStore, aj as IntegrationFamilyId, ak as IntegrationFamilySpec, k as IntegrationGrant, l as IntegrationGrantStore, c2 as IntegrationGuardContext, c3 as IntegrationHealthcheckCheck, c4 as IntegrationHealthcheckResult, c5 as IntegrationHealthcheckStatus, c6 as IntegrationHealthcheckStore, c7 as IntegrationHub, E as IntegrationHubAuth, F as IntegrationHubClient, G as IntegrationHubClientOptions, c8 as IntegrationHubOptions, H as IntegrationHubRequestError, c9 as IntegrationIdempotencyRecord, ca as IntegrationIdempotencyStore, cb as IntegrationInvocationEnvelope, cc as IntegrationInvocationEnvelopeValidationOptions, al as IntegrationLifecycleSpec, m as IntegrationManifest, n as IntegrationManifestResolution, cd as IntegrationOAuthState, ce as IntegrationOAuthStateOutcome, cf as IntegrationOAuthStateStore, am as IntegrationPlannerHints, cg as IntegrationPolicyDecision, ch as IntegrationPolicyEffect, ci as IntegrationPolicyEngine, cj as IntegrationPolicyRule, ck as IntegrationProvider, cl as IntegrationProviderKind, cm as IntegrationRateLimitDecision, cn as IntegrationRateLimiter, IntegrationRegistry, IntegrationRegistryConflict, IntegrationRegistryEntry, IntegrationRegistrySourceRef, IntegrationRegistrySummary, o as IntegrationRequirement, q as IntegrationRequirementMode, r as IntegrationRequirementResolution, u as IntegrationRequirementStatus, v as IntegrationRuntime, w as IntegrationRuntimeHub, x as IntegrationRuntimeOptions, y as IntegrationSandboxBundle, co as IntegrationSandboxHost, cp as IntegrationSandboxHostHub, cq as IntegrationSandboxHostOptions, cr as IntegrationSecretStore, an as IntegrationSetupSpec, ao as IntegrationSpec, ap as IntegrationSpecStatus, aq as IntegrationSpecValidationIssue, ar as IntegrationSpecValidationResult, IntegrationSupportTier, a as IntegrationToolDefinition, b as IntegrationToolSearchFilters, c as IntegrationToolSearchResult, cs as IntegrationTriggerEvent, ct as IntegrationTriggerSubscription, cu as IntegrationWebhookReceiverResult, cv as IntegrationWorkflowDefinition, cw as IntegrationWorkflowRuntime, cx as IntegrationWorkflowRuntimeHub, cy as IntegrationWorkflowRuntimeOptions, cz as IntegrationWorkflowStore, cA as InvokeWithCapabilityRequest, cB as IssueCapabilityRequest, cC as IssuedIntegrationCapability, L as ListGrantsInput, cD as ManifestValidationIssue, cE as ManifestValidationResult, cF as McpCatalog, cG as McpCatalogTool, M as McpToolDefinition, J as MintCapabilityBundleInput, cH as MissingRequirementExplanation, as as NoneAuthSpec, cI as NormalizedIntegrationResult, at as NormalizedPermission, au as OAuth2AuthSpec, cJ as OpenApiDocument, cK as OpenApiOperation, cL as PROVIDER_PASSTHROUGH_ACTION, av as PermissionDescriptor, cM as PlatformIntegrationPolicyPresetOptions, aw as PostSetupCheck, cN as ProviderHttpRequestInput, cO as ProviderPassthroughPolicy, ax as Quirk, cP as RenderConsentOptions, ay as RenderSpecOptions, az as RenderedConsoleStep, R as ResolveManifestInput, aA as ScopeDescriptor, cQ as SecretRef, cR as StartAuthRequest, cS as StartAuthResult, cT as StartedTangleCatalogRuntimeNodeServer, cU as StaticIntegrationPolicyEngine, cV as StaticIntegrationPolicyOptions, cW as StoredIntegrationEvent, T as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, cX as TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, cY as TANGLE_INTEGRATIONS_CATALOG_SOURCE, N as TangleCatalogAuthResolverOptions, cZ as TangleCatalogExecutorInvocation, c_ as TangleCatalogExecutorProviderOptions, O as TangleCatalogHttpAuthResolverOptions, P as TangleCatalogHttpAuthResolverRequest, c$ as TangleCatalogHttpExecutorInvocation, d0 as TangleCatalogHttpExecutorOptions, Q as TangleCatalogInstalledPackageExecutorOptions, d1 as TangleCatalogRuntimeActionRequest, S as TangleCatalogRuntimeHandlerOptions, U as TangleCatalogRuntimeHttpRequest, V as TangleCatalogRuntimeHttpResponse, W as TangleCatalogRuntimeInvocation, X as TangleCatalogRuntimeModuleAction, d2 as TangleCatalogRuntimeNodeServerOptions, Y as TangleCatalogRuntimePackageCoverageOptions, Z as TangleCatalogRuntimePackageCoverageRow, d3 as TangleCatalogRuntimePackageManifest, d4 as TangleCatalogRuntimePackageManifestOptions, d5 as TangleCatalogRuntimePiece, d6 as TangleCatalogRuntimeRequest, d7 as TangleCatalogTriggerInvocation, d8 as TangleIntegrationCatalogEntry, d9 as TangleIntegrationCatalogFreshnessOptions, da as TangleIntegrationCatalogFreshnessResult, db as TangleIntegrationContract, dc as TangleIntegrationContractStatus, dd as TangleIntegrationImplementationKind, de as TangleIntegrationInvokeInput, df as TangleIntegrationInvokeResult, dg as TangleIntegrationsClient, dh as TangleIntegrationsClientOptions, di as WorkspaceCapability, dj as WorkspaceCapabilityDiscovery, dk as WorkspaceToolSchema, dl as WorkspaceTrigger, dm as adapterManifestsToConnectors, dn as assertValidIntegrationManifest, aB as assertValidIntegrationSpec, dp as auditIntegrationCatalogFreshness, _ as auditTangleCatalogRuntimePackages, dq as auditTangleIntegrationCatalogFreshness, dr as buildActivepiecesConnectors, ds as buildActivepiecesRuntimeRequest, dt as buildApprovalRequest, du as buildCanonicalLaunchConnectors, buildDefaultIntegrationRegistry, aC as buildHealthcheckPlan, dv as buildIntegrationBridgeEnvironment, dw as buildIntegrationBridgePayload, d as buildIntegrationCatalogView, dx as buildIntegrationCoverageConnectors, dy as buildIntegrationInvocationEnvelope, e as buildIntegrationToolCatalog, dz as buildTangleCatalogRuntimePackageManifest, dA as buildTangleCatalogRuntimeRequest, dB as buildTangleIntegrationCatalogConnectors, dC as calendarExercisePlannerManifest, dD as canonicalActionConnectorId, canonicalConnectorId, classifyIntegrationCatalogExecutability, composeIntegrationRegistry, aD as consoleStepsToText, dE as createActivepiecesExecutorProvider, dF as createActivepiecesHttpExecutor, dG as createApprovalBackedPolicyEngine, dH as createAuditingActionGuard, dI as createCatalogExecutorProvider, dJ as createConnectionCredentialResolver, dK as createConnectorAdapterCatalogSource, dL as createConnectorAdapterProvider, dM as createCredentialBackedAdapterProvider, dN as createDefaultIntegrationActionGuard, dO as createDefaultIntegrationPolicyEngine, dP as createGatewayCatalogProvider, dQ as createHttpIntegrationProvider, dR as createIntegrationAuditEvent, K as createIntegrationHubClient, z as createIntegrationRuntime, dS as createIntegrationWorkflowRuntime, dT as createMockIntegrationProvider, dU as createPlatformIntegrationPolicyPreset, $ as createTangleCatalogCredentialAuthResolver, dV as createTangleCatalogExecutorProvider, a0 as createTangleCatalogHttpAuthResolver, dW as createTangleCatalogHttpExecutor, a1 as createTangleCatalogInstalledPackageExecutor, a2 as createTangleCatalogRuntimeHandler, dX as createTangleCatalogRuntimeNodeRequestListener, dY as createTangleIntegrationsClient, dZ as decodeIntegrationBridgePayload, f as describeIntegrationTool, d_ as discoverWorkspaceCapabilities, d$ as dispatchIntegrationInvocation, e0 as encodeIntegrationBridgePayload, e1 as explainMissingRequirements, e2 as extractActivepiecesPublicPieceCount, e3 as extractExternalCatalogPublicCount, e4 as filterDiscoveryByWorkspaceScopes, g as flattenIntegrationToolDefinition, e5 as getActivepiecesOverride, aE as getIntegrationFamily, aF as getIntegrationSpec, e6 as healthcheckRequest, e7 as importGraphqlConnector, e8 as importMcpConnector, e9 as importOpenApiConnector, ea as inferIntegrationManifestFromTools, inferIntegrationSupportTier, eb as integrationCoverageChecklistMarkdown, aG as integrationSpecToConnector, i as integrationToolName, ec as invocationRequestFromEnvelope, ed as listActivepiecesCatalogEntries, aH as listExecutableIntegrationSpecs, ee as listIntegrationCoverageSpecs, aI as listIntegrationSpecs, ef as listTangleIntegrationCatalogEntries, eg as listTangleIntegrationCatalogRuntimePackages, eh as listTangleIntegrationContracts, ei as manifestToConnector, ej as normalizeGatewayCatalog, ek as normalizeIntegrationResult, el as parseIntegrationBridgeEnvironment, p as parseIntegrationToolName, em as receiveIntegrationWebhook, en as redactApprovalRequest, eo as redactCapability, ep as redactIntegrationBridgePayload, eq as redactInvocationEnvelope, aJ as renderAgentToolDescription, er as renderApprovalCopy, es as renderConsentSummary, aK as renderConsoleSteps, aL as renderRunbookMarkdown, et as renderTangleCatalogRuntimePnpmAddCommand, eu as resolveConnectionCredentials, aM as resolveConnectorAuthSpec, ev as resolveIntegrationApproval, ew as revokeConnection, ex as runIntegrationHealthcheck, ey as runIntegrationHealthchecks, ez as sanitizeAuditConnection, eA as sanitizeConnection, s as searchIntegrationTools, eB as signActivepiecesRuntimeRequest, eC as signCapability, a3 as signTangleCatalogRuntimeRequest, aN as specAuthToConnectorAuth, eD as startTangleCatalogRuntimeNodeServer, eE as storedEventToTriggerEvent, summarizeIntegrationRegistry, a4 as tangleCatalogAuthValue, t as toMcpTools, aO as validateCredentialFormat, aP as validateCredentialSet, eF as validateIntegrationInvocationEnvelope, eG as validateIntegrationManifest, aQ as validateIntegrationSpec, eH as validateProviderPassthroughRequest, eI as verifyActivepiecesRuntimeSignature, eJ as verifyCapabilityToken, a5 as verifyTangleCatalogRuntimeSignature } from './registry.js';
-export { A as AuthSpec, e as CASStrategy, f as Capability, g as CapabilityClass, h as CapabilityMutation, i as CapabilityMutationResult, j as CapabilityParameterSchema, k as CapabilityRead, l as CapabilityReadResult, C as ConnectorAdapter, d as ConnectorCredentials, m as ConnectorInvocation, n as ConnectorManifest, o as ConnectorManifestValidationIssue, p as ConnectorManifestValidationResult, q as ConsistencyModel, r as CredentialsExpired, D as DEFAULT_TANGLE_PLATFORM_URL, s as DataSourceMetadata, E as EventHandlerResult, I as InboundEvent, t as RateLimitSpec, R as ResolvedDataSource, u as ResourceContention, v as TANGLE_API_KEY_PREFIX, w as TANGLE_SERVICE_TOKEN_PREFIX, b as TangleIdentityClient, T as TangleIdentityOptions, x as TangleIdentityUnreachableError, c as TangleTokenVerifyFailure, y as TangleTokenVerifyResult, a as TangleUserSummary, z as TangleWorkspaceSummary, B as assertValidConnectorManifest, F as createTangleIdentityClient, G as tangleIdentity, H as validateConnectorManifest } from './tangle-id-Dj0ipP4E.js';
+import { IntegrationRegistrySummary, IntegrationRegistryConflict, ComposeIntegrationRegistryOptions, IntegrationRegistry } from './registry.js';
+export { IntegrationCatalogExecutability, IntegrationRegistryEntry, IntegrationRegistrySourceRef, IntegrationSupportTier, buildDefaultIntegrationRegistry, canonicalConnectorId, classifyIntegrationCatalogExecutability, composeIntegrationRegistry, inferIntegrationSupportTier, summarizeIntegrationRegistry } from './registry.js';
+import { o as IntegrationPolicyEngine, p as IntegrationApprovalRequest, I as IntegrationActor, q as IntegrationGuardContext, r as IntegrationPolicyDecision, b as IntegrationConnector, e as IntegrationConnectorAction, s as IntegrationProviderKind, c as IntegrationConnection, h as IntegrationCatalogSource, m as IntegrationProvider, n as IntegrationSecretStore, t as IntegrationConnectionStore, u as IntegrationCredentialsRotatedEvent, v as IntegrationOAuthStateStore, w as IntegrationOAuthState, x as IntegrationOAuthStateOutcome, y as SecretRef, d as IntegrationConnectorCategory, f as IntegrationActionRisk, g as IntegrationDataClass, z as IntegrationTriggerSubscription, A as IntegrationTriggerEvent, i as IntegrationActionGuard, k as IntegrationActionResult, j as IntegrationActionRequest, S as StartAuthRequest, l as StartAuthResult, C as CompleteAuthRequest, B as InvokeWithCapabilityRequest, D as IntegrationCapability, E as IntegrationHubOptions, F as IssueCapabilityRequest, a as IssuedIntegrationCapability, H as HttpIntegrationProviderOptions } from './core-types-D5Dc65Ud.js';
+export { G as IntegrationConnectorTrigger } from './core-types-D5Dc65Ud.js';
+import { I as IntegrationAuditSink } from './consumer-CzJgntej.js';
+export { C as CapabilityBundleResult, a as CheckConnectorInput, b as CheckConnectorResult, c as CreateGrantsInput, d as InMemoryIntegrationAuditStore, e as InMemoryIntegrationHealthcheckStore, f as IntegrationAuditEvent, g as IntegrationAuditEventType, h as IntegrationAuditFilter, i as IntegrationAuditStore, j as IntegrationHealthcheckCheck, k as IntegrationHealthcheckResult, l as IntegrationHealthcheckStatus, m as IntegrationHealthcheckStore, n as IntegrationHubAuth, o as IntegrationHubClient, p as IntegrationHubClientOptions, q as IntegrationHubRequestError, L as ListGrantsInput, M as MintCapabilityBundleInput, R as ResolveManifestInput, r as createAuditingActionGuard, s as createIntegrationAuditEvent, t as createIntegrationHubClient, u as healthcheckRequest, v as runIntegrationHealthcheck, w as runIntegrationHealthchecks, x as sanitizeAuditConnection } from './consumer-CzJgntej.js';
+import { IntegrationSandboxBundle, IntegrationManifest, IntegrationManifestResolution, IntegrationRuntime, IntegrationGrantStore, IntegrationRequirementMode } from './runtime.js';
+export { InMemoryIntegrationGrantStore, IntegrationCapabilityBinding, IntegrationGrant, IntegrationRequirement, IntegrationRequirementResolution, IntegrationRequirementStatus, IntegrationRuntimeHub, IntegrationRuntimeOptions, createIntegrationRuntime } from './runtime.js';
+import { C as ConnectorAdapter, R as ResolvedDataSource, a as ConnectorCredentials } from './types-XdpvaIzW.js';
+export { A as AuthSpec, b as CASStrategy, c as Capability, d as CapabilityClass, e as CapabilityMutation, f as CapabilityMutationResult, g as CapabilityParameterSchema, h as CapabilityRead, i as CapabilityReadResult, j as ConnectorInvocation, k as ConnectorManifest, l as ConnectorManifestValidationIssue, m as ConnectorManifestValidationResult, n as ConsistencyModel, o as CredentialsExpired, D as DataSourceMetadata, E as EventHandlerResult, I as InboundEvent, p as RateLimitSpec, q as ResourceContention, r as assertValidConnectorManifest, v as validateConnectorManifest } from './types-XdpvaIzW.js';
 export { b as IntegrationErrorCode, I as IntegrationRuntimeError, a as IntegrationUserAction, N as NormalizedIntegrationError, n as normalizeIntegrationError, s as statusForCode } from './errors-Bg3_rxnQ.js';
 export { ConnectFlowOptions, FinishConnectInput, FinishConnectOutput, InMemoryConnectStateStore, StartConnectInput, StartConnectOutput, finishConnectFlow, revokeConnectFlow, startConnectFlow } from './connect/index.js';
 export { ExpressLikeRequest, ExpressLikeResponse, HonoLikeContext, RequireTangleAuthOptions, TangleAuthContext, TangleAuthOutcome, TangleAuthReason, expressTangleAuthMiddleware, extractToken, honoTangleAuthMiddleware, requireTangleAuth } from './middleware/index.js';
 export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, ExchangeCodeInput, GenericHmacVerifyOptions, InMemoryOAuthFlowStore, OAuthFlowStore, OAuthTokens, ParsedStripeSignatureHeader, PendingOAuthFlow, RefreshInput, SlackVerifyOptions, StartOAuthInput, StartOAuthOutput, StripeVerifyOptions, TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature } from './connectors/index.js';
-export { DocuSealOptions, EtsyOptions, GmailOptions, GoogleCalendarOptions, GoogleDocsOptions, GoogleDriveOptions, GoogleFormsOptions, GoogleSheetsOptions, HelloSignOptions, HubSpotOptions, MicrosoftCalendarOptions, MicrosoftGraphOptions, MicrosoftTeamsOptions, NotionDatabaseOptions, OneDriveOptions, OutlookMailOptions, PandaDocOptions, RestConnectorSpec, RestCredentialPlacement, RestOperationSpec, RestRequestSpec, SharePointOptions, SlackOptions, TELEGRAM_FILE_DOWNLOAD_ROOT, WhatsappBusinessOptions, activecampaignConnector, acumbamailConnector, adobeCreativeCloudConnector, afforaiConnector, agentxConnector, aidbaseConnector, aipriseConnector, airOpsConnector, aircallConnector, airtableConnector, airtopConnector, alaiConnector, altTextAiConnector, alttextifyConnector, amazonBedrockConnector, amazonSecretsManagerConnector, amazonSesConnector, amazonSnsConnector, amazonSqsConnector, amazonTextractConnector, aminosConnector, ampecoConnector, anthropicConnector, apitableConnector, apitemplateIoConnector, apolloConnector, appfollowConnector, asanaConnector, ashbyConnector, asknewsConnector, assemblyaiConnector, attioConnector, auth0Connector, autocallsConnector, avianConnector, avomaConnector, azureAdConnector, azureCommunicationServicesConnector, azureOpenaiConnector, backblazeConnector, bamboohrConnector, barcodeLookupConnector, baremetricsConnector, basecampConnector, beamerConnector, bettermodeConnector, bexioConnector, bigcommerceConnector, biginByZohoConnector, billplzConnector, bitlyConnector, blandAiConnector, blueskyConnector, bolnaConnector, bonjoroConnector, bookedinConnector, boxConnector, braveSearchConnector, brazeConnector, brilliantDirectoriesConnector, browseAiConnector, calComConnector, calendlyConnector, campaignMonitorConnector, cannyConnector, canvaConnector, capsuleCrmConnector, captainDataConnector, cashfreePaymentsConnector, certopusConnector, chainalysisApiConnector, chargebeeConnector, chargekeepConnector, chartlyConnector, chatDataConnector, chatbaseConnector, chatlingConnector, chatnodeConnector, chatwootConnector, checkoutConnector, circleConnector, clearoutConnector, clicdataConnector, clickupConnector, clioConnector, clockifyConnector, clockodoConnector, closeConnector, cloudconvertConnector, cloudinaryConnector, cloutlyConnector, codaConnector, cognitoFormsConnector, cohereConnector, cometapiConnector, comfyicuConnector, confluenceConnector, constantContactConnector, contentfulConnector, convertkitConnector, copperConnector, copyAiConnector, crispConnector, cryptolensConnector, customerIoConnector, customgptConnector, dashworksConnector, datadogConnector, datafuelConnector, datocmsConnector, declarativeRestConnector, deepseekConnector, denserAiConnector, descriptConnector, devinConnector, discordConnector, dittofeedConnector, doctlyConnector, documentproConnector, documergeConnector, docuseal, docusignConnector, dropboxConnector, dubConnector, dumplingAiConnector, dustConnector, easyPeasyAiConnector, ebayConnector, edenAiConnector, elasticEmailConnector, emailitConnector, emailoctopusConnector, enrichlayerConnector, esignaturesConnector, etsyConnector, exaConnector, facebookLeadsConnector, facebookPagesConnector, fathomAnalyticsConnector, fathomConnector, figjamConnector, figmaConnector, filloutFormsConnector, firebaseConnector, fireberryConnector, firecrawlConnector, firefliesAiConnector, flipandoConnector, flowiseConnector, flowluConnector, folkConnector, foreplayCoConnector, formbricksConnector, formstackConnector, fountainConnector, fragmentConnector, frameConnector, freeAgentConnector, freshsalesConnector, freshserviceConnector, frontConnector, gameballConnector, geminiConnector, ghostcmsConnector, gistlyConnector, giteaConnector, githubConnector, gitlabConnector, glideConnector, gmail, googleBigqueryConnector, googleCalendar, googleCloudStorageConnector, googleContactsConnector, googleDocs, googleDrive, googleForms, googleGeminiConnector, googleMyBusinessConnector, googleSearchConnector, googleSearchConsoleConnector, googleSheets, googleSlidesConnector, googleTasksConnector, googleVertexaiConnector, googlechatConnector, gorgiasConnector, gotifyConnector, gptzeroDetectAiConnector, granolaConnector, greenhouseConnector, greenptConnector, greipConnector, griptapeConnector, gristConnector, guideliteConnector, gustoConnector, harvestConnector, hashiCorpVaultConnector, hastewireConnector, heartbeatConnector, hedyConnector, hellosign, helpscoutConnector, heygenConnector, heymarketSmsConnector, housecallProConnector, hubspot, huggingFaceConnector, huggingfaceConnector, humeAiConnector, hunterConnector, hystructConnector, ibmCognoseConnector, imageRouterConnector, imapConnector, influencersClubConnector, insightlyConnector, insightoAiConnector, instaChartsConnector, instantlyAiConnector, instasentConnector, intercomConnector, invoiceninjaConnector, jinaAiConnector, jiraCloudConnector, jiraDataCenterConnector, joggAiConnector, jotformConnector, justInvoiceConnector, kallabotAiConnector, kapsoConnector, kimaiConnector, kissflowConnector, kizeoFormsConnector, klaviyoConnector, klentyConnector, knackConnector, knockConnector, koFiConnector, kommoConnector, kudosityConnector, kustomerConnector, leadConnectorConnector, leapAiConnector, leexiConnector, lemlistConnector, lemonSqueezyConnector, letsCalendarConnector, lettaConnector, leverConnector, lightfunnelsConnector, linearConnector, linkaConnector, linkupConnector, llmrailsConnector, lobstermailConnector, localaiConnector, loftyConnector, logrocketConnector, logsnagConnector, lokaliseConnector, loopsConnector, lucidyaConnector, lushaConnector, luxuryPresenceConnector, magicalApiConnector, mailchainConnector, mailchimpConnector, mailerLiteConnector, mailercheckConnector, mailerooConnector, mailgunConnector, makeConnector, manychatConnector, marketoConnector, mastodonConnector, matomoConnector, matrixConnector, mattermostConnector, mauticConnector, medullarConnector, meetgeekAiConnector, memConnector, messagebirdConnector, metabaseConnector, microsoft365PeopleConnector, microsoft365PlannerConnector, microsoftCalendar, microsoftDynamics365BusinessCentralConnector, microsoftDynamicsCrmConnector, microsoftExcel365Connector, microsoftGraph, microsoftOnedriveConnector, microsoftOnenoteConnector, microsoftOutlookCalendarConnector, microsoftOutlookConnector, microsoftPowerBiConnector, microsoftSharepointConnector, microsoftTeams, microsoftTodoConnector, millionverifierConnector, mindStudioConnector, mindeeConnector, miroConnector, missiveConnector, mixmaxConnector, mixpanelConnector, mollieConnector, mondayConnector, mongodbConnector, n8nConnector, netlifyConnector, niftyConnector, ninjapipeConnector, nocodbConnector, notionConnector, notionDatabase, ntfyConnector, odooConnector, omniCoConnector, omnihrConnector, oneDrive, openPhoneConnector, openRouterConnector, openaiConnector, openmicAiConnector, opnformConnector, opportifyConnector, opsgenieConnector, oracleDatabaseConnector, orimonConnector, outlookMail, paddleConnector, pagerdutyConnector, pandadoc, paperformConnector, parseurConnector, pastefyConnector, paywhirlConnector, pdfmonkeyConnector, peekshotConnector, perplexityAiConnector, personalAiConnector, pinchPaymentsConnector, pineconeConnector, pipedreamConnector, pipedriveConnector, placidConnector, plausibleConnector, pocketbaseConnector, pollybotAiConnector, postgresConnector, posthogConnector, postizConnector, postmarkConnector, predictLeadsConnector, productboardConnector, proxycurlConnector, pushbulletConnector, pushoverConnector, qawafelConnector, qdrantConnector, quadernoConnector, quickbooksConnector, quickzuConnector, raiaAiConnector, rapidtextAiConnector, reachinboxConnector, recallAiConnector, redditConnector, reoonVerifierConnector, replyIoConnector, retableConnector, retellAiConnector, ripplingConnector, robollyConnector, runwareConnector, saasticConnector, saleorConnector, salesforceConnector, sanityConnector, sardisConnector, savvycalConnector, scrapegraphaiConnector, scrapelessConnector, seekTableConnector, sendgridConnector, sendinblueConnector, sendpulseConnector, senjaConnector, sentryConnector, serpstatConnector, serviceNowConnector, sharepoint, shippoConnector, shopifyConnector, shortIoConnector, signNowConnector, signrequestConnector, simplirouteConnector, simplybookmeConnector, skyprepConnector, slack, slackEventsConnector, smartleadConnector, smartsheetConnector, smartsuiteConnector, smooveConnector, smsmodeConnector, snowflakeConnector, socialkitConnector, squareConnector, stripeConnector, stripePackConnector, stripeWebhookReceiverConnector, supabaseConnector, supadataConnector, swarmnodeConnector, systemeIoConnector, tableauConnector, talkableConnector, tallyConnector, teableConnector, telegramConnector, telnyxConnector, tenzoConnector, textcortexAiConnector, ticktickConnector, timeOpsConnector, timelinesAiConnector, tlDvConnector, todoistConnector, togglTrackConnector, totalcmsConnector, trelloConnector, twentyConnector, twilioConnector, twilioSmsConnector, twinLabsConnector, twitterConnector, typeformConnector, typefullyConnector, umamiConnector, upgradechatConnector, uscreenConnector, validatedmailsConnector, vapiConnector, vboutConnector, vercelConnector, videoaskConnector, vidlab7Connector, vlmRunConnector, voucheryIoConnector, vtexConnector, vtigerConnector, wafeqConnector, weaviateConnector, webflowConnector, webhookConnector, webscrapingAiConnector, whatConvertsConnector, whatsappBusiness, whatsappConnector, whatsscaleConnector, wonderchatConnector, woocommerceConnector, woodpeckerConnector, wootricConnector, wordpressConnector, workableConnector, workdayConnector, wrikeConnector, writesonicBulkConnector, wufooConnector, xeroConnector, youcanbookmeConnector, zagomailConnector, zapierConnector, zendeskConnector, zendeskSellConnector, zeplinConnector, zerobounceConnector, zohoBookingsConnector, zohoCrmConnector, zohoDeskConnector, zuoraConnector } from './connectors/adapters/index.js';
-import 'node:http';
+export { DocuSealOptions, EtsyOptions, GmailOptions, GoogleCalendarOptions, GoogleDocsOptions, GoogleDriveOptions, GoogleFormsOptions, GoogleSheetsOptions, HelloSignOptions, HubSpotOptions, MicrosoftCalendarOptions, MicrosoftGraphOptions, MicrosoftTeamsOptions, NotionDatabaseOptions, OneDriveOptions, OutlookMailOptions, PandaDocOptions, RestConnectorSpec, RestCredentialPlacement, RestOperationSpec, RestRequestSpec, SharePointOptions, SlackOptions, TELEGRAM_FILE_DOWNLOAD_ROOT, WhatsappBusinessOptions, activecampaignConnector, acumbamailConnector, adobeCreativeCloudConnector, afforaiConnector, agentxConnector, aidbaseConnector, aipriseConnector, airOpsConnector, aircallConnector, airtableConnector, airtopConnector, alaiConnector, altTextAiConnector, alttextifyConnector, amazonBedrockConnector, amazonSecretsManagerConnector, amazonSesConnector, amazonSnsConnector, amazonSqsConnector, amazonTextractConnector, aminosConnector, ampecoConnector, anthropicConnector, apitableConnector, apitemplateIoConnector, apolloConnector, appfollowConnector, asanaConnector, ashbyConnector, asknewsConnector, assemblyaiConnector, attioConnector, auth0Connector, autocallsConnector, avianConnector, avomaConnector, azureAdConnector, azureCommunicationServicesConnector, azureOpenaiConnector, backblazeConnector, bamboohrConnector, barcodeLookupConnector, baremetricsConnector, basecampConnector, beamerConnector, bettermodeConnector, bexioConnector, bigcommerceConnector, biginByZohoConnector, billplzConnector, bitlyConnector, blandAiConnector, blueskyConnector, bolnaConnector, bonjoroConnector, bookedinConnector, boxConnector, braveSearchConnector, brazeConnector, brilliantDirectoriesConnector, browseAiConnector, calComConnector, calendlyConnector, campaignMonitorConnector, cannyConnector, canvaConnector, capsuleCrmConnector, captainDataConnector, cashfreePaymentsConnector, certopusConnector, chainalysisApiConnector, chargebeeConnector, chargekeepConnector, chartlyConnector, chatDataConnector, chatbaseConnector, chatlingConnector, chatnodeConnector, chatwootConnector, checkoutConnector, circleConnector, clearoutConnector, clicdataConnector, clickupConnector, clioConnector, clockifyConnector, clockodoConnector, closeConnector, cloudconvertConnector, cloudinaryConnector, cloutlyConnector, codaConnector, cognitoFormsConnector, cohereConnector, cometapiConnector, comfyicuConnector, confluenceConnector, constantContactConnector, contentfulConnector, convertkitConnector, copperConnector, copyAiConnector, crispConnector, cryptolensConnector, customerIoConnector, customgptConnector, dashworksConnector, datadogConnector, datafuelConnector, datocmsConnector, declarativeRestConnector, deepseekConnector, denserAiConnector, descriptConnector, devinConnector, discordConnector, dittofeedConnector, doctlyConnector, documentproConnector, documergeConnector, docuseal, docusignConnector, dropboxConnector, dubConnector, dumplingAiConnector, dustConnector, easyPeasyAiConnector, ebayConnector, edenAiConnector, elasticEmailConnector, emailitConnector, emailoctopusConnector, enrichlayerConnector, esignaturesConnector, etsyConnector, exaConnector, facebookLeadsConnector, facebookPagesConnector, fathomAnalyticsConnector, fathomConnector, figjamConnector, figmaConnector, filloutFormsConnector, firebaseConnector, fireberryConnector, firecrawlConnector, firefliesAiConnector, flipandoConnector, flowiseConnector, flowluConnector, folkConnector, foreplayCoConnector, formbricksConnector, formstackConnector, fountainConnector, fragmentConnector, frameConnector, freeAgentConnector, freshsalesConnector, freshserviceConnector, frontConnector, gameballConnector, geminiConnector, ghostcmsConnector, gistlyConnector, giteaConnector, githubConnector, gitlabConnector, glideConnector, gmail, googleBigqueryConnector, googleCalendar, googleCloudStorageConnector, googleContactsConnector, googleDocs, googleDrive, googleForms, googleGeminiConnector, googleMyBusinessConnector, googleSearchConnector, googleSearchConsoleConnector, googleSheets, googleSlidesConnector, googleTasksConnector, googleVertexaiConnector, googlechatConnector, gorgiasConnector, gotifyConnector, gptzeroDetectAiConnector, granolaConnector, greenhouseConnector, greenptConnector, greipConnector, griptapeConnector, gristConnector, guideliteConnector, gustoConnector, harvestConnector, hashiCorpVaultConnector, hastewireConnector, heartbeatConnector, hedyConnector, hellosign, helpscoutConnector, heygenConnector, heymarketSmsConnector, housecallProConnector, hubspot, huggingFaceConnector, huggingfaceConnector, humeAiConnector, hunterConnector, hystructConnector, ibmCognoseConnector, imageRouterConnector, imapConnector, influencersClubConnector, insightlyConnector, insightoAiConnector, instaChartsConnector, instantlyAiConnector, instasentConnector, intercomConnector, invoiceninjaConnector, jinaAiConnector, jiraCloudConnector, jiraDataCenterConnector, joggAiConnector, jotformConnector, justInvoiceConnector, kallabotAiConnector, kapsoConnector, kimaiConnector, kissflowConnector, kizeoFormsConnector, klaviyoConnector, klentyConnector, knackConnector, knockConnector, koFiConnector, kommoConnector, kudosityConnector, kustomerConnector, leadConnectorConnector, leapAiConnector, leexiConnector, lemlistConnector, lemonSqueezyConnector, letsCalendarConnector, lettaConnector, leverConnector, lightfunnelsConnector, linearConnector, linkaConnector, linkupConnector, llmrailsConnector, lobstermailConnector, localaiConnector, loftyConnector, logrocketConnector, logsnagConnector, lokaliseConnector, loopsConnector, lucidyaConnector, lushaConnector, luxuryPresenceConnector, magicalApiConnector, mailchainConnector, mailchimpConnector, mailerLiteConnector, mailercheckConnector, mailerooConnector, mailgunConnector, makeConnector, manychatConnector, marketoConnector, mastodonConnector, matomoConnector, matrixConnector, mattermostConnector, mauticConnector, medullarConnector, meetgeekAiConnector, memConnector, messagebirdConnector, metabaseConnector, microsoft365PeopleConnector, microsoft365PlannerConnector, microsoftCalendar, microsoftDynamics365BusinessCentralConnector, microsoftDynamicsCrmConnector, microsoftExcel365Connector, microsoftGraph, microsoftOnedriveConnector, microsoftOnenoteConnector, microsoftOutlookCalendarConnector, microsoftOutlookConnector, microsoftPowerBiConnector, microsoftSharepointConnector, microsoftTeams, microsoftTodoConnector, millionverifierConnector, mindStudioConnector, mindeeConnector, miroConnector, missiveConnector, mixmaxConnector, mixpanelConnector, mollieConnector, mondayConnector, mongodbConnector, n8nConnector, netlifyConnector, niftyConnector, ninjapipeConnector, nocodbConnector, notionConnector, notionDatabase, ntfyConnector, odooConnector, omniCoConnector, omnihrConnector, oneDrive, openPhoneConnector, openRouterConnector, openaiConnector, openmicAiConnector, opnformConnector, opportifyConnector, opsgenieConnector, oracleDatabaseConnector, orimonConnector, outlookMail, paddleConnector, pagerdutyConnector, pandadoc, paperformConnector, parseurConnector, pastefyConnector, paywhirlConnector, pdfmonkeyConnector, peekshotConnector, perplexityAiConnector, personalAiConnector, phonyConnector, pinchPaymentsConnector, pineconeConnector, pipedreamConnector, pipedriveConnector, placidConnector, plausibleConnector, pocketbaseConnector, pollybotAiConnector, postgresConnector, posthogConnector, postizConnector, postmarkConnector, predictLeadsConnector, productboardConnector, proxycurlConnector, pushbulletConnector, pushoverConnector, qawafelConnector, qdrantConnector, quadernoConnector, quickbooksConnector, quickzuConnector, raiaAiConnector, rapidtextAiConnector, reachinboxConnector, recallAiConnector, redditConnector, reoonVerifierConnector, replyIoConnector, retableConnector, retellAiConnector, ripplingConnector, robollyConnector, runwareConnector, saasticConnector, saleorConnector, salesforceConnector, sanityConnector, sardisConnector, savvycalConnector, scrapegraphaiConnector, scrapelessConnector, seekTableConnector, sendgridConnector, sendinblueConnector, sendpulseConnector, senjaConnector, sentryConnector, serpstatConnector, serviceNowConnector, sharepoint, shippoConnector, shopifyConnector, shortIoConnector, signNowConnector, signrequestConnector, simplirouteConnector, simplybookmeConnector, skyprepConnector, slack, slackEventsConnector, smartleadConnector, smartsheetConnector, smartsuiteConnector, smooveConnector, smsmodeConnector, snowflakeConnector, socialkitConnector, squareConnector, stripeConnector, stripePackConnector, stripeWebhookReceiverConnector, supabaseConnector, supadataConnector, swarmnodeConnector, systemeIoConnector, tableauConnector, talkableConnector, tallyConnector, teableConnector, telegramConnector, telnyxConnector, tenzoConnector, textcortexAiConnector, ticktickConnector, timeOpsConnector, timelinesAiConnector, tlDvConnector, todoistConnector, togglTrackConnector, totalcmsConnector, trelloConnector, twentyConnector, twilioConnector, twilioSmsConnector, twinLabsConnector, twitterConnector, typeformConnector, typefullyConnector, umamiConnector, upgradechatConnector, uscreenConnector, validatedmailsConnector, vapiConnector, vboutConnector, vercelConnector, videoaskConnector, vidlab7Connector, vlmRunConnector, voucheryIoConnector, vtexConnector, vtigerConnector, wafeqConnector, weaviateConnector, webflowConnector, webhookConnector, webscrapingAiConnector, whatConvertsConnector, whatsappBusiness, whatsappConnector, whatsscaleConnector, wonderchatConnector, woocommerceConnector, woodpeckerConnector, wootricConnector, wordpressConnector, workableConnector, workdayConnector, wrikeConnector, writesonicBulkConnector, wufooConnector, xeroConnector, youcanbookmeConnector, zagomailConnector, zapierConnector, zendeskConnector, zendeskSellConnector, zeplinConnector, zerobounceConnector, zohoBookingsConnector, zohoCrmConnector, zohoDeskConnector, zuoraConnector } from './connectors/adapters/index.js';
+export { D as DEFAULT_TANGLE_PLATFORM_URL, d as TANGLE_API_KEY_PREFIX, e as TANGLE_SERVICE_TOKEN_PREFIX, b as TangleIdentityClient, T as TangleIdentityOptions, f as TangleIdentityUnreachableError, c as TangleTokenVerifyFailure, g as TangleTokenVerifyResult, a as TangleUserSummary, h as TangleWorkspaceSummary, i as createTangleIdentityClient, t as tangleIdentity } from './tangle-id-DA_qj-O_.js';
+export { IntegrationCatalogView, IntegrationToolDefinition, IntegrationToolSearchFilters, IntegrationToolSearchResult, McpToolDefinition, buildIntegrationCatalogView, buildIntegrationToolCatalog, describeIntegrationTool, flattenIntegrationToolDefinition, integrationToolName, parseIntegrationToolName, searchIntegrationTools, toMcpTools } from './catalog.js';
+import { A as ActivepiecesCatalogEntry, T as TangleCatalogHttpAuthResolverOptions, a as TangleCatalogInstalledPackageExecutorOptions } from './tangle-catalog-runtime-2HddXxoM.js';
+export { b as ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER, c as ActivepiecesCatalogAuthField, d as ActivepiecesExecutorInvocation, e as ActivepiecesExecutorProviderOptions, f as ActivepiecesHttpExecutorOptions, g as ActivepiecesRuntimeRequest, h as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, i as TangleCatalogAuthResolverOptions, j as TangleCatalogHttpAuthResolverRequest, k as TangleCatalogHttpExecutorInvocation, l as TangleCatalogHttpExecutorOptions, m as TangleCatalogRuntimeActionRequest, n as TangleCatalogRuntimeHandlerOptions, o as TangleCatalogRuntimeHttpRequest, p as TangleCatalogRuntimeHttpResponse, q as TangleCatalogRuntimeInvocation, r as TangleCatalogRuntimeModuleAction, s as TangleCatalogRuntimePackageCoverageOptions, t as TangleCatalogRuntimePackageCoverageRow, u as TangleCatalogRuntimePiece, v as TangleCatalogRuntimeRequest, w as auditTangleCatalogRuntimePackages, x as buildActivepiecesConnectors, y as buildActivepiecesRuntimeRequest, z as buildTangleCatalogRuntimeRequest, B as createActivepiecesExecutorProvider, C as createActivepiecesHttpExecutor, D as createTangleCatalogCredentialAuthResolver, E as createTangleCatalogHttpAuthResolver, F as createTangleCatalogHttpExecutor, G as createTangleCatalogInstalledPackageExecutor, H as createTangleCatalogRuntimeHandler, I as listActivepiecesCatalogEntries, J as signActivepiecesRuntimeRequest, K as signTangleCatalogRuntimeRequest, L as tangleCatalogAuthValue, M as verifyActivepiecesRuntimeSignature, N as verifyTangleCatalogRuntimeSignature } from './tangle-catalog-runtime-2HddXxoM.js';
+import { Server, IncomingMessage, ServerResponse } from 'node:http';
+export { ApiKeyAuthSpec, ConnectorAuthSpec, ConsoleStep, CredentialFieldSpec, CredentialValidationInput, CredentialValidationResult, CustomAuthSpec, HealthcheckPlan, HealthcheckSpec, HmacAuthSpec, INTEGRATION_FAMILIES, IntegrationAuthMode, IntegrationAuthSpec, IntegrationFamilyId, IntegrationFamilySpec, IntegrationLifecycleSpec, IntegrationPlannerHints, IntegrationSetupSpec, IntegrationSpec, IntegrationSpecStatus, IntegrationSpecValidationIssue, IntegrationSpecValidationResult, NoneAuthSpec, NormalizedPermission, OAuth2AuthSpec, PermissionDescriptor, PostSetupCheck, Quirk, RenderSpecOptions, RenderedConsoleStep, ScopeDescriptor, assertValidIntegrationSpec, buildHealthcheckPlan, consoleStepsToText, getIntegrationFamily, getIntegrationSpec, integrationSpecToConnector, listExecutableIntegrationSpecs, listIntegrationSpecs, renderAgentToolDescription, renderConsoleSteps, renderRunbookMarkdown, resolveConnectorAuthSpec, specAuthToConnectorAuth, validateCredentialFormat, validateCredentialSet, validateIntegrationSpec } from './specs.js';
+
+/**
+ * IntegrationError — the runtime error class thrown by the hub, providers,
+ * adapters, and runtime helpers. Lives in its own module so any source
+ * file can import it without pulling the package barrel (`./index.ts`)
+ * and forming a cycle.
+ *
+ * The richer {@link IntegrationRuntimeError} (in `./errors.ts`) is a
+ * separate, structured error type used by consumers wiring custom
+ * error → HTTP-status mappings. `IntegrationError` is the legacy/canonical
+ * throw shape kept for back-compat with everything that already catches it.
+ */
+type IntegrationErrorRuntimeCode = 'provider_not_found' | 'connector_not_found' | 'connection_not_found' | 'connection_not_active' | 'auth_not_supported' | 'capability_invalid' | 'capability_expired' | 'scope_denied' | 'action_denied' | 'action_not_found' | 'trigger_not_found' | 'approval_required' | 'policy_denied' | 'config_missing' | 'provider_failure';
+declare class IntegrationError extends Error {
+    readonly code: IntegrationErrorRuntimeCode;
+    constructor(message: string, code: IntegrationErrorRuntimeCode);
+}
+
+type IntegrationApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired';
+interface IntegrationApprovalRecord {
+    id: string;
+    request: IntegrationApprovalRequest;
+    status: IntegrationApprovalStatus;
+    requestedAt: string;
+    resolvedAt?: string;
+    resolvedBy?: IntegrationActor;
+    reason?: string;
+    expiresAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationApprovalStore {
+    get(approvalId: string): Promise<IntegrationApprovalRecord | undefined> | IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): Promise<void> | void;
+    list(filter?: IntegrationApprovalFilter): Promise<IntegrationApprovalRecord[]> | IntegrationApprovalRecord[];
+}
+interface IntegrationApprovalFilter {
+    status?: IntegrationApprovalStatus;
+    connectionId?: string;
+    connectorId?: string;
+    action?: string;
+    actor?: IntegrationActor;
+}
+interface ApprovalBackedPolicyOptions {
+    base: IntegrationPolicyEngine;
+    store: IntegrationApprovalStore;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+    approvalTtlMs?: number;
+}
+declare class InMemoryIntegrationApprovalStore implements IntegrationApprovalStore {
+    private readonly records;
+    get(approvalId: string): IntegrationApprovalRecord | undefined;
+    put(record: IntegrationApprovalRecord): void;
+    list(filter?: IntegrationApprovalFilter): IntegrationApprovalRecord[];
+}
+declare class ApprovalBackedPolicyEngine implements IntegrationPolicyEngine {
+    private readonly base;
+    private readonly store;
+    private readonly audit;
+    private readonly now;
+    private readonly approvalTtlMs;
+    constructor(options: ApprovalBackedPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: IntegrationActor;
+    }): Promise<IntegrationPolicyDecision>;
+    private findApprovedRecord;
+}
+declare function createApprovalBackedPolicyEngine(options: ApprovalBackedPolicyOptions): ApprovalBackedPolicyEngine;
+declare function resolveIntegrationApproval(input: {
+    store: IntegrationApprovalStore;
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: IntegrationActor;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+    audit?: IntegrationAuditSink;
+    now?: () => Date;
+}): Promise<IntegrationApprovalRecord>;
+
+declare const CANONICAL_INTEGRATION_ACTIONS: {
+    readonly googleCalendarEventsList: "google-calendar.events.list";
+    readonly googleCalendarEventsCreate: "google-calendar.events.create";
+    readonly gmailMessagesSearch: "gmail.messages.search";
+    readonly gmailMessagesSend: "gmail.messages.send";
+    readonly googleDriveFilesSearch: "google-drive.files.search";
+    readonly googleDriveFilesRead: "google-drive.files.read";
+    readonly githubRepositoriesGet: "github.repositories.get";
+    readonly githubIssuesSearch: "github.issues.search";
+    readonly githubIssuesCreate: "github.issues.create";
+    readonly githubPullRequestsComment: "github.pull-requests.comment";
+    readonly slackChannelsList: "slack.channels.list";
+    readonly slackMessagesSearch: "slack.messages.search";
+    readonly slackMessagesPost: "slack.messages.post";
+    readonly providerHttpRequest: "provider.http.request";
+};
+type CanonicalIntegrationActionId = typeof CANONICAL_INTEGRATION_ACTIONS[keyof typeof CANONICAL_INTEGRATION_ACTIONS];
+interface CanonicalLaunchConnectorOptions {
+    providerId?: string;
+    includeProviderPassthrough?: boolean;
+}
+declare function buildCanonicalLaunchConnectors(options?: CanonicalLaunchConnectorOptions): IntegrationConnector[];
+declare function canonicalActionConnectorId(actionId: string): string | undefined;
+
+declare const DEFAULT_INTEGRATION_BRIDGE_ENV = "TANGLE_INTEGRATION_BUNDLE";
+interface IntegrationBridgePayload {
+    version: 1;
+    manifestId: string;
+    subject: IntegrationSandboxBundle['subject'];
+    expiresAt: string;
+    tools: IntegrationBridgeToolBinding[];
+}
+interface IntegrationBridgeToolBinding {
+    name: string;
+    title: string;
+    connectorId: string;
+    connectionId: string;
+    action: string;
+    risk: string;
+    dataClass: string;
+    requiredScopes: string[];
+    capabilityToken: string;
+}
+declare function buildIntegrationBridgePayload(bundle: IntegrationSandboxBundle): IntegrationBridgePayload;
+declare function encodeIntegrationBridgePayload(payload: IntegrationBridgePayload): string;
+declare function decodeIntegrationBridgePayload(encoded: string): IntegrationBridgePayload;
+declare function buildIntegrationBridgeEnvironment(bundle: IntegrationSandboxBundle, options?: {
+    envVar?: string;
+}): Record<string, string>;
+declare function parseIntegrationBridgeEnvironment(env: Record<string, string | undefined>, options?: {
+    envVar?: string;
+}): IntegrationBridgePayload;
+declare function redactIntegrationBridgePayload(payload: IntegrationBridgePayload): IntegrationBridgePayload;
+
+/**
+ * Self-service external-apps client — the brokered hub-exec path.
+ *
+ * The operator-allowlist-free way to integrate the Tangle hub (no `TRUSTED_APPS`
+ * entry): a product registers itself ONCE (`registerApp` → client_id/secret),
+ * the end user consents ONCE per connection from their Tangle session (a browser
+ * step — not done here), and the product then mints short-lived
+ * `sk-tan-broker-…` tokens unattended (`mintBrokerToken`) for each
+ * `/v1/hub/exec` call. The durable grant means only the first consent needs a
+ * user; everything after is app-credential-only.
+ *
+ * Sits alongside {@link TangleIntegrationsClient} in the integrations/hub SDK —
+ * same `endpoint` + `fetchImpl` shape and the same `IntegrationRuntimeError`
+ * surface. Endpoints (platform API, e.g. https://id.tangle.tools):
+ *   POST /v1/apps                                      register (owner bearer)
+ *   GET  /v1/apps                                      list (owner bearer)
+ *   POST /v1/apps/:appId/revoke                        revoke (owner bearer)
+ *   POST /v1/apps/grants/:grantId/mint-broker-token    durable re-mint (app creds)
+ *   POST /v1/apps/oauth/token                          authorization_code → token
+ */
+interface TangleAppsClientOptions {
+    /** Platform base URL (e.g. https://id.tangle.tools). */
+    endpoint: string;
+    /** Test seam. Defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+interface RegisterAppInput {
+    name: string;
+    redirectUris: string[];
+    allowedScopes: string[];
+    homepageUrl?: string;
+}
+interface AppSummary {
+    id: string;
+    clientId: string;
+    name: string;
+    redirectUris: string[];
+    allowedScopes: string[];
+    homepageUrl?: string;
+    createdAt?: string;
+}
+interface RegisteredApp extends AppSummary {
+    /** Shown ONCE at registration — persist it as a secret immediately. */
+    clientSecret: string;
+}
+interface BrokerToken {
+    /** The `sk-tan-broker-…` bearer for a single `/v1/hub/exec` call. */
+    accessToken: string;
+    expiresIn: number;
+    scope: string;
+    connectionId?: string;
+}
+declare class TangleAppsClient {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(options: TangleAppsClientOptions);
+    /**
+     * Register a product as an app (ONE-TIME, with the owner's bearer — a Tangle
+     * session or `sk-tan-*` key). Returns the client_id + the once-shown
+     * client_secret; persist the secret immediately (never retrievable again).
+     */
+    registerApp(input: RegisterAppInput, ownerBearer: string): Promise<RegisteredApp>;
+    /** List the caller's registered apps (no secrets). */
+    listApps(ownerBearer: string): Promise<AppSummary[]>;
+    /** Revoke an app and cascade-kill its grants + tokens. */
+    revokeApp(appId: string, ownerBearer: string): Promise<{
+        revoked: boolean;
+    }>;
+    /**
+     * Durable re-mint: mint a fresh single-use `sk-tan-broker-` token against an
+     * existing consented grant using ONLY the app credentials — no user session,
+     * no `agc_` code. The runtime path: one call per `/v1/hub/exec`.
+     */
+    mintBrokerToken(input: {
+        clientId: string;
+        clientSecret: string;
+        grantId: string;
+        ttlSeconds?: number;
+    }): Promise<BrokerToken>;
+    /**
+     * Exchange an `agc_` authorization code (from the user's one-time consent)
+     * for the first broker token + the durable grant. Use on the consent
+     * callback; afterward `mintBrokerToken` is enough.
+     */
+    exchangeAuthCode(input: {
+        clientId: string;
+        clientSecret: string;
+        code: string;
+        redirectUri: string;
+        connectionId?: string;
+    }): Promise<BrokerToken>;
+    private request;
+}
+declare function createTangleAppsClient(options: TangleAppsClientOptions): TangleAppsClient;
+
+interface TangleIntegrationsClientOptions {
+    endpoint: string;
+    bridge?: IntegrationBridgePayload;
+    env?: Record<string, string | undefined>;
+    envVar?: string;
+    fetchImpl?: typeof fetch;
+    getCapabilityToken?: (tool: IntegrationBridgeToolBinding) => string | Promise<string>;
+}
+interface TangleIntegrationInvokeInput<TInput = unknown> {
+    tool: string;
+    input?: TInput;
+    idempotencyKey?: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface TangleIntegrationInvokeResult<TOutput = unknown> {
+    status: 'ok' | 'approval_required' | 'failed';
+    action: string;
+    output?: TOutput;
+    approval?: unknown;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class TangleIntegrationsClient {
+    private readonly endpoint;
+    private readonly bridge;
+    private readonly fetchImpl;
+    private readonly getCapabilityToken;
+    constructor(options: TangleIntegrationsClientOptions);
+    tools(): IntegrationBridgeToolBinding[];
+    findTool(toolOrAction: string): IntegrationBridgeToolBinding;
+    invoke<TOutput = unknown, TInput = unknown>(input: TangleIntegrationInvokeInput<TInput>): Promise<TangleIntegrationInvokeResult<TOutput>>;
+}
+declare function createTangleIntegrationsClient(options: TangleIntegrationsClientOptions): TangleIntegrationsClient;
+
+interface ConsentSummary {
+    title: string;
+    body: string;
+    bullets: string[];
+    primaryAction: string;
+    risk: 'read' | 'write' | 'destructive';
+    connectorIds: string[];
+}
+interface RenderConsentOptions {
+    appName?: string;
+    connectors?: IntegrationConnector[];
+}
+declare function renderConsentSummary(manifestOrResolution: IntegrationManifest | IntegrationManifestResolution, options?: RenderConsentOptions): ConsentSummary;
+declare function renderApprovalCopy(input: {
+    appName: string;
+    connectorTitle: string;
+    action: IntegrationConnectorAction;
+    approvalId?: string;
+}): ConsentSummary;
+
+/** OAuth client credentials the host resolves at start/exchange time.
+ *  The lib never reads env or any vault — kept edge-runtime-safe. */
+interface OAuthClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+interface ConnectorAdapterProviderOptions {
+    id?: string;
+    kind?: IntegrationProviderKind;
+    adapters: ConnectorAdapter[];
+    resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource;
+    /** Invoked when an adapter rotates credentials during executeRead /
+     *  executeMutation (e.g. an OAuth access token refreshed on expiry). The
+     *  host re-encrypts + persists the rotated envelope so the next expiry
+     *  does not force a reconnect. Carries the connection so the host can
+     *  resolve the secretRef. */
+    onCredentialsRotated?: (event: {
+        connection: IntegrationConnection;
+        credentials: ConnectorCredentials;
+    }) => Promise<void> | void;
+    /** Resolve OAuth client_id / client_secret for an oauth2 adapter at
+     *  start- and exchange-time. Host owns env, vault, and per-tenant
+     *  overrides. Return null to refuse the flow (lib will throw
+     *  `config_missing`). The lib never logs the secret nor includes it
+     *  in thrown error messages. */
+    resolveOAuthClient?: (input: {
+        connectorId: string;
+    }) => Promise<OAuthClientCredentials | null> | OAuthClientCredentials | null;
+    /** Fetch implementation forwarded to the OAuth token exchange. Default
+     *  is `globalThis.fetch`. Tests inject a mock. */
+    fetchImpl?: typeof fetch;
+    now?: () => Date;
+}
+declare function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider;
+declare function adapterManifestsToConnectors(adapters: ConnectorAdapter[], providerId?: string): IntegrationConnector[];
+declare function createConnectorAdapterCatalogSource(options: {
+    id?: string;
+    providerId?: string;
+    adapters: ConnectorAdapter[];
+    precedence?: number;
+}): IntegrationCatalogSource;
+declare function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector;
+
+interface ConnectionCredentialResolverOptions {
+    secrets: IntegrationSecretStore;
+    connections?: IntegrationConnectionStore;
+    adapters?: ConnectorAdapter[];
+    now?: () => Date;
+    markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void;
+}
+declare class InMemoryIntegrationSecretStore implements IntegrationSecretStore {
+    private readonly secrets;
+    get(ref: SecretRef): ConnectorCredentials | undefined;
+    put(ref: SecretRef, credentials: ConnectorCredentials): void;
+    delete(ref: SecretRef): void;
+}
+/** Test/dev double for {@link IntegrationOAuthStateStore}. Production hubs
+ *  inject a durable implementation; this one keeps records in a Map and
+ *  enforces the single-use + expiry contract. */
+declare class InMemoryIntegrationOAuthStateStore implements IntegrationOAuthStateStore {
+    private readonly states;
+    put(state: IntegrationOAuthState): void;
+    consume(state: string): IntegrationOAuthStateOutcome;
+    sweep(now: number): void;
+}
+declare function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions): (connection: IntegrationConnection) => Promise<ResolvedDataSource>;
+declare function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials>;
+type CredentialBackedAdapterProviderOptions = Omit<ConnectorAdapterProviderOptions, 'resolveDataSource' | 'onCredentialsRotated'> & ConnectionCredentialResolverOptions & {
+    /** Fired after the provider re-persists rotated credentials to the
+     *  secret + connection stores. Receives the hub-shaped event including
+     *  the resolved secretRef so the host can drive external re-encryption
+     *  or telemetry. */
+    onCredentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void;
+};
+declare function createCredentialBackedAdapterProvider(options: CredentialBackedAdapterProviderOptions): IntegrationProvider;
+declare function revokeConnection(input: {
+    connection: IntegrationConnection;
+    connections?: IntegrationConnectionStore;
+    secrets?: IntegrationSecretStore;
+    now?: () => Date;
+}): Promise<IntegrationConnection>;
+
+/**
+ * Workspace capability discovery — answers "what can this workspace do?"
+ * with a typed list of MCP-shape tool descriptors that the agent runtime
+ * can flatten into a planner's tool registry.
+ *
+ * The agent runtime's gating question is one level above the existing
+ * connector catalog ("which integrations exist?") and one level below
+ * the issued capability-token surface ("temporarily delegate scope X
+ * via this signed token"). This module bridges the two:
+ *
+ *   discoverWorkspaceCapabilities({ owner, connectors, connections, scopes })
+ *     → WorkspaceCapability[]
+ *
+ * A `WorkspaceCapability` is hand-shaped to be cheap to emit alongside a
+ * connector manifest and trivial to render into:
+ *   - an LLM tool-choice JSON array
+ *   - an MCP `tools/list` response
+ *   - a UI surface ("Connect Gmail to enable: send_reply, list_messages…")
+ *
+ * What this is NOT:
+ *   - A capability-token issuer. That stays in IntegrationHub.issueCapability.
+ *   - A connector registry. That stays in IntegrationRegistry / catalog.
+ *
+ * Scopes are the load-bearing input: a connector advertises N actions,
+ * but only the subset whose `requiredScopes` are a subset of the
+ * connection's `grantedScopes` is reachable. The discovery function
+ * filters on that automatically.
+ *
+ * Stability: `@stable` — additions to WorkspaceCapability must be
+ * additive and non-breaking.
+ */
+
+/** MCP-shape tool descriptor. Mirrors the
+ *  [Model Context Protocol tool schema](https://modelcontextprotocol.io/specification)
+ *  closely enough that consumers can pipe a WorkspaceCapability straight
+ *  into a `tools/list` response. */
+interface WorkspaceToolSchema {
+    name: string;
+    description?: string;
+    /** JSON-schema describing the action's input. */
+    inputSchema?: unknown;
+    /** Optional JSON-schema describing the action's output. */
+    outputSchema?: unknown;
+}
+/** One discoverable capability — an action a connector exposes that the
+ *  workspace has the connection + scopes to invoke. */
+interface WorkspaceCapability {
+    /** Stable, fully-qualified id. Format `<connector-id>.<action-id>`. */
+    id: string;
+    /** Human label safe for UI. */
+    title: string;
+    /** Optional one-line description. */
+    description?: string;
+    /** Connector category for grouping. */
+    category: IntegrationConnectorCategory;
+    /** Connector that hosts this capability. */
+    connectorId: string;
+    /** Provider that hosts this connector (first-party, gateway, …). */
+    providerId: string;
+    /** Underlying action id on the connector. */
+    actionId: string;
+    /** Scopes required to invoke. The discovery function only returns
+     *  capabilities whose required scopes are a subset of the connection's
+     *  grantedScopes. */
+    scopes: string[];
+    /** Risk class — useful for UI ("write" / "destructive" lights). */
+    risk: IntegrationActionRisk;
+    /** Data class of the action's output, when known. */
+    dataClass: IntegrationDataClass;
+    /** MCP-shape tool schema the agent runtime can register directly. */
+    toolSchema: WorkspaceToolSchema;
+    /** True iff the workspace has an active connection backing this
+     *  capability. False capabilities (advertised by the connector but
+     *  not yet connected) are included when `includeUnconnected: true`
+     *  is passed — useful for "connect to unlock" UI affordances. */
+    connected: boolean;
+    /** Connection id backing this capability. Undefined when
+     *  `connected: false`. */
+    connectionId?: string;
+    /** Whether the action requires explicit approval before invocation. */
+    approvalRequired?: boolean;
+}
+/** Optional inbound trigger surface. Same shape as a capability so the
+ *  consumer can render both with one component. */
+interface WorkspaceTrigger {
+    id: string;
+    title: string;
+    description?: string;
+    category: IntegrationConnectorCategory;
+    connectorId: string;
+    providerId: string;
+    triggerId: string;
+    scopes: string[];
+    dataClass: IntegrationDataClass;
+    connected: boolean;
+    connectionId?: string;
+}
+interface DiscoverWorkspaceCapabilitiesInput {
+    /** Workspace owner. Used to scope the connection lookup when `store`
+     *  is supplied (the canonical production path). */
+    owner: IntegrationActor;
+    /** Either an explicit connection list (test/fixture path) or a store
+     *  the function should query for connections by owner. Exactly one
+     *  of `connections` / `store` MUST be provided. */
+    connections?: IntegrationConnection[];
+    store?: IntegrationConnectionStore;
+    /** Either an explicit connector list (test/fixture path) or a set of
+     *  providers the function should query via `listConnectors()`. */
+    connectors?: IntegrationConnector[];
+    providers?: IntegrationProvider[];
+    /** Include capabilities whose connector is in the catalog but the
+     *  workspace has no active connection for. Useful to render
+     *  "connect to unlock" affordances. Default: false. */
+    includeUnconnected?: boolean;
+    /** When true, include capabilities even if some required scopes are
+     *  missing from the connection grant. The default `false` hides such
+     *  capabilities — the agent runtime never sees them. */
+    includeMissingScopes?: boolean;
+}
+interface WorkspaceCapabilityDiscovery {
+    capabilities: WorkspaceCapability[];
+    triggers: WorkspaceTrigger[];
+    /** Counts grouped by connector for telemetry / UI badges. */
+    countsByConnector: Record<string, number>;
+    /** Connectors the workspace is connected to but the planner cannot
+     *  reach any actions on (e.g., zero scopes granted, or all actions
+     *  require an additional scope). */
+    unreachableConnectors: Array<{
+        connectorId: string;
+        reason: string;
+    }>;
+}
+/** Resolve workspace-visible capabilities + triggers. Pure with respect
+ *  to the inputs — caller decides whether to back `connections` and
+ *  `connectors` with persistent state or static fixtures. */
+declare function discoverWorkspaceCapabilities(input: DiscoverWorkspaceCapabilitiesInput): Promise<WorkspaceCapabilityDiscovery>;
+/**
+ * Filter a {@link WorkspaceCapabilityDiscovery} result by the calling
+ * user's effective id.tangle.tools workspace scopes. Pair with the
+ * `tangleIdentity()` adapter's `list_workspaces` / `switch_workspace`
+ * output to keep what the agent runtime sees aligned with what the
+ * workspace's plan actually permits.
+ *
+ * Semantics:
+ *   - Every workspace scope is matched against every capability's
+ *     `scopes` list. Wildcard scopes (`tangle:*`, `<connectorId>:*`) are
+ *     respected — a workspace with `tangle:*` sees everything; a
+ *     workspace with `gmail:*` sees every gmail capability regardless of
+ *     the upstream OAuth scope.
+ *   - When `workspaceScopes` is empty, returns the discovery as-is (no
+ *     workspace gate). Pass an explicit `denyByDefault: true` to flip
+ *     that to "empty workspace sees nothing" — matches the platform's
+ *     fail-closed posture for production tenants.
+ *
+ * Pure with respect to the inputs — no side effects.
+ */
+declare function filterDiscoveryByWorkspaceScopes(discovery: WorkspaceCapabilityDiscovery, workspaceScopes: string[], opts?: {
+    denyByDefault?: boolean;
+}): WorkspaceCapabilityDiscovery;
+
+interface IntegrationWorkflowDefinition {
+    id: string;
+    title?: string;
+    manifest: IntegrationManifest;
+    trigger: {
+        requirementId: string;
+        triggerId: string;
+        targetUrl?: string;
+    };
+    metadata?: Record<string, unknown>;
+}
+interface InstalledIntegrationWorkflow {
+    id: string;
+    workflowId: string;
+    manifestId: string;
+    owner: IntegrationActor;
+    grantee: IntegrationActor;
+    triggerGrantId: string;
+    subscription: IntegrationTriggerSubscription;
+    status: 'active' | 'paused' | 'error';
+    createdAt: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationWorkflowStore {
+    put(workflow: InstalledIntegrationWorkflow): Promise<void> | void;
+    get(id: string): Promise<InstalledIntegrationWorkflow | undefined> | InstalledIntegrationWorkflow | undefined;
+    list(): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): Promise<InstalledIntegrationWorkflow[]> | InstalledIntegrationWorkflow[];
+}
+interface IntegrationWorkflowRuntimeHub {
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+}
+interface IntegrationWorkflowRuntimeOptions {
+    runtime: IntegrationRuntime;
+    hub: IntegrationWorkflowRuntimeHub;
+    grants: IntegrationGrantStore;
+    store?: IntegrationWorkflowStore;
+    now?: () => Date;
+}
+declare class InMemoryIntegrationWorkflowStore implements IntegrationWorkflowStore {
+    private readonly workflows;
+    put(workflow: InstalledIntegrationWorkflow): void;
+    get(id: string): InstalledIntegrationWorkflow | undefined;
+    list(): InstalledIntegrationWorkflow[];
+    listByWorkflow(workflowId: string): InstalledIntegrationWorkflow[];
+    listByOwner(owner: IntegrationActor): InstalledIntegrationWorkflow[];
+}
+declare class IntegrationWorkflowRuntime {
+    private readonly runtime;
+    private readonly hub;
+    private readonly grants;
+    private readonly store;
+    private readonly now;
+    constructor(options: IntegrationWorkflowRuntimeOptions);
+    install(input: {
+        workflow: IntegrationWorkflowDefinition;
+        owner: IntegrationActor;
+        grantee: IntegrationActor;
+    }): Promise<InstalledIntegrationWorkflow>;
+    dispatchEvent<T = unknown>(event: IntegrationTriggerEvent<T>, handler: (input: {
+        event: IntegrationTriggerEvent<T>;
+        workflows: InstalledIntegrationWorkflow[];
+    }) => Promise<void> | void): Promise<{
+        matched: InstalledIntegrationWorkflow[];
+    }>;
+}
+declare function createIntegrationWorkflowRuntime(options: IntegrationWorkflowRuntimeOptions): IntegrationWorkflowRuntime;
+
+interface StoredIntegrationEvent {
+    id: string;
+    sourceId: string;
+    connectorId: string;
+    eventType: string;
+    providerEventId?: string;
+    receivedAt: string;
+    payload: Record<string, unknown>;
+    dispatchedAt?: string;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationEventStore {
+    put(event: StoredIntegrationEvent): Promise<void> | void;
+    hasProviderEvent(sourceId: string, providerEventId: string): Promise<boolean> | boolean;
+    list(): Promise<StoredIntegrationEvent[]> | StoredIntegrationEvent[];
+}
+interface IntegrationWebhookReceiverResult {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+    received: StoredIntegrationEvent[];
+    duplicates: StoredIntegrationEvent[];
+}
+declare class InMemoryIntegrationEventStore implements IntegrationEventStore {
+    private readonly events;
+    private readonly providerIds;
+    put(event: StoredIntegrationEvent): void;
+    hasProviderEvent(sourceId: string, providerEventId: string): boolean;
+    list(): StoredIntegrationEvent[];
+}
+declare function receiveIntegrationWebhook(input: {
+    adapter: ConnectorAdapter;
+    source: ResolvedDataSource;
+    rawBody: string;
+    headers: Record<string, string | string[] | undefined>;
+    store: IntegrationEventStore;
+    workflowRuntime?: IntegrationWorkflowRuntime;
+    allowUnsignedWebhook?: boolean;
+    now?: () => Date;
+}): Promise<IntegrationWebhookReceiverResult>;
+declare function storedEventToTriggerEvent(event: StoredIntegrationEvent, source: ResolvedDataSource): IntegrationTriggerEvent;
+
+interface IntegrationIdempotencyRecord {
+    key: string;
+    requestHash: string;
+    result: IntegrationActionResult;
+    createdAt: string;
+}
+interface IntegrationIdempotencyStore {
+    get(key: string): Promise<IntegrationIdempotencyRecord | undefined> | IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): Promise<void> | void;
+}
+interface IntegrationRateLimitDecision {
+    allowed: boolean;
+    retryAfterMs?: number;
+    reason?: string;
+}
+interface IntegrationRateLimiter {
+    check(ctx: IntegrationGuardContext): Promise<IntegrationRateLimitDecision> | IntegrationRateLimitDecision;
+}
+declare class InMemoryIntegrationIdempotencyStore implements IntegrationIdempotencyStore {
+    private readonly records;
+    get(key: string): IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): void;
+}
+declare class DefaultIntegrationActionGuard implements IntegrationActionGuard {
+    private readonly idempotency;
+    private readonly audit;
+    private readonly rateLimiter;
+    private readonly requireIdempotencyForMutations;
+    private readonly now;
+    constructor(options?: {
+        idempotency?: IntegrationIdempotencyStore;
+        audit?: IntegrationAuditSink;
+        rateLimiter?: IntegrationRateLimiter;
+        requireIdempotencyForMutations?: boolean;
+        now?: () => Date;
+    });
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+    private writeIdempotency;
+}
+declare function createDefaultIntegrationActionGuard(options?: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0]): DefaultIntegrationActionGuard;
+
+interface ManifestValidationIssue {
+    path: string;
+    message: string;
+}
+interface ManifestValidationResult {
+    ok: boolean;
+    issues: ManifestValidationIssue[];
+}
+interface InferIntegrationRequirementsOptions {
+    manifestId: string;
+    title?: string;
+    tools: Array<string | {
+        action: string;
+        reason?: string;
+        mode?: IntegrationRequirementMode;
+        connectorId?: string;
+        scopes?: string[];
+    }>;
+    metadata?: Record<string, unknown>;
+}
+interface MissingRequirementExplanation {
+    requirementId: string;
+    connectorId: string;
+    status: string;
+    message: string;
+    userAction: 'connect' | 'enable' | 'ignore_optional';
+}
+declare function validateIntegrationManifest(manifest: IntegrationManifest): ManifestValidationResult;
+declare function assertValidIntegrationManifest(manifest: IntegrationManifest): void;
+declare function inferIntegrationManifestFromTools(options: InferIntegrationRequirementsOptions): IntegrationManifest;
+declare function explainMissingRequirements(resolution: IntegrationManifestResolution): MissingRequirementExplanation[];
+declare function calendarExercisePlannerManifest(id?: string): IntegrationManifest;
+
+interface ProviderHttpRequestInput {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+    body?: unknown;
+}
+interface ProviderPassthroughPolicy {
+    enabled: boolean;
+    allowedMethods?: ProviderHttpRequestInput['method'][];
+    allowedPathPrefixes?: string[];
+    maxBodyBytes?: number;
+}
+declare const PROVIDER_PASSTHROUGH_ACTION: "provider.http.request";
+declare function validateProviderPassthroughRequest(input: ProviderHttpRequestInput, policy: ProviderPassthroughPolicy): void;
+
+type IntegrationPolicyEffect = 'allow' | 'require_approval' | 'deny';
+interface IntegrationPolicyRule {
+    id: string;
+    effect: IntegrationPolicyEffect;
+    reason: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    maxRisk?: IntegrationActionRisk;
+    risk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+}
+interface StaticIntegrationPolicyOptions {
+    rules?: IntegrationPolicyRule[];
+    defaultReadEffect?: IntegrationPolicyEffect;
+    defaultWriteEffect?: IntegrationPolicyEffect;
+    defaultDestructiveEffect?: IntegrationPolicyEffect;
+    now?: () => Date;
+}
+interface IntegrationApprovalResolution {
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: string;
+    resolvedAt: string;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class StaticIntegrationPolicyEngine implements IntegrationPolicyEngine {
+    private readonly rules;
+    private readonly defaultReadEffect;
+    private readonly defaultWriteEffect;
+    private readonly defaultDestructiveEffect;
+    private readonly now;
+    constructor(options?: StaticIntegrationPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: {
+            type: string;
+            id: string;
+        };
+    }): IntegrationPolicyDecision;
+    private defaultEffect;
+}
+declare function createDefaultIntegrationPolicyEngine(options?: Omit<StaticIntegrationPolicyOptions, 'rules'>): StaticIntegrationPolicyEngine;
+declare function buildApprovalRequest(ctx: IntegrationGuardContext & {
+    subject: {
+        type: string;
+        id: string;
+    };
+}, reason: string, requestedAt: Date): IntegrationApprovalRequest;
+declare function redactApprovalRequest(request: IntegrationApprovalRequest): IntegrationApprovalRequest;
+
+interface PlatformIntegrationPolicyPresetOptions extends Omit<StaticIntegrationPolicyOptions, 'defaultReadEffect' | 'defaultWriteEffect' | 'defaultDestructiveEffect'> {
+    allowWritesWithoutApproval?: boolean;
+    allowDestructiveActions?: boolean;
+    allowProviderPassthrough?: boolean;
+}
+declare function createPlatformIntegrationPolicyPreset(options?: PlatformIntegrationPolicyPresetOptions): StaticIntegrationPolicyEngine;
+
+interface CatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    action: IntegrationConnector['actions'][number];
+}
+interface CatalogExecutorProviderOptions {
+    id: string;
+    kind: IntegrationProviderKind;
+    connectors: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: CatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (connection: IntegrationConnection, trigger: NonNullable<IntegrationConnector['triggers']>[number], targetUrl?: string) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+declare function createCatalogExecutorProvider(options: CatalogExecutorProviderOptions): IntegrationProvider;
+
+interface IntegrationInvocationEnvelope {
+    kind: 'integration.invocation';
+    capabilityToken: string;
+    toolName: string;
+    action: string;
+    input?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface IntegrationInvocationEnvelopeValidationOptions {
+    connectors?: IntegrationConnector[];
+    maxInputBytes?: number;
+    requireKnownTool?: boolean;
+}
+type NormalizedIntegrationResult = {
+    status: 'ok';
+    action: string;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'approval_required';
+    action: string;
+    approval: IntegrationApprovalRequest;
+    metadata?: Record<string, unknown>;
+} | {
+    status: 'failed';
+    action: string;
+    error: string;
+    metadata?: Record<string, unknown>;
+};
+interface IntegrationSandboxHostHub {
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult> | IntegrationActionResult;
+}
+interface IntegrationSandboxHostOptions extends IntegrationInvocationEnvelopeValidationOptions {
+    hub: IntegrationSandboxHostHub;
+}
+declare function buildIntegrationInvocationEnvelope(input: {
+    capabilityToken: string;
+    toolName: string;
+    args?: unknown;
+    idempotencyKey: string;
+    dryRun?: boolean;
+    metadata?: Record<string, unknown>;
+}): IntegrationInvocationEnvelope;
+declare function invocationRequestFromEnvelope(envelope: IntegrationInvocationEnvelope): InvokeWithCapabilityRequest;
+declare function validateIntegrationInvocationEnvelope(envelope: IntegrationInvocationEnvelope, options?: IntegrationInvocationEnvelopeValidationOptions): void;
+declare function redactInvocationEnvelope(envelope: IntegrationInvocationEnvelope): Omit<IntegrationInvocationEnvelope, 'capabilityToken'> & {
+    capabilityToken: '[REDACTED]';
+};
+declare function redactCapability(capability: IntegrationCapability): IntegrationCapability;
+declare function normalizeIntegrationResult(result: IntegrationActionResult): NormalizedIntegrationResult;
+declare function dispatchIntegrationInvocation(envelope: IntegrationInvocationEnvelope, options: IntegrationSandboxHostOptions): Promise<NormalizedIntegrationResult>;
+declare class IntegrationSandboxHost {
+    private readonly options;
+    constructor(options: IntegrationSandboxHostOptions);
+    dispatch(envelope: IntegrationInvocationEnvelope): Promise<NormalizedIntegrationResult>;
+}
+
+interface ImportCatalogOptions {
+    providerId: string;
+    connectorId: string;
+    connectorTitle: string;
+    category?: IntegrationConnectorCategory;
+    auth?: IntegrationConnector['auth'];
+    scopes?: string[];
+    dataClass?: IntegrationDataClass;
+    defaultRisk?: IntegrationActionRisk;
+}
+interface OpenApiDocument {
+    openapi?: string;
+    swagger?: string;
+    info?: {
+        title?: string;
+    };
+    paths?: Record<string, Record<string, OpenApiOperation | unknown>>;
+}
+interface OpenApiOperation {
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: unknown;
+    security?: Array<Record<string, string[]>>;
+    tags?: string[];
+}
+interface GraphqlOperationSpec {
+    name: string;
+    kind: 'query' | 'mutation';
+    description?: string;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    requiredScopes?: string[];
+}
+interface McpCatalogTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        openWorldHint?: boolean;
+        title?: string;
+    };
+}
+interface McpCatalog {
+    tools: McpCatalogTool[];
+}
+declare function importOpenApiConnector(document: OpenApiDocument, options: ImportCatalogOptions): IntegrationConnector;
+declare function importGraphqlConnector(operations: GraphqlOperationSpec[], options: ImportCatalogOptions): IntegrationConnector;
+declare function importMcpConnector(catalog: McpCatalog, options: ImportCatalogOptions): IntegrationConnector;
+
+interface GatewayCatalogProviderOptions {
+    id: string;
+    kind: Extract<IntegrationProviderKind, 'nango' | 'pipedream' | 'activepieces' | 'tangle_catalog' | 'zapier' | 'executor' | 'custom'>;
+    fetchCatalog: () => Promise<GatewayCatalogEntry[]> | GatewayCatalogEntry[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    invokeAction?: (connection: IntegrationConnection, request: IntegrationActionRequest) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    cacheTtlMs?: number;
+    now?: () => Date;
+}
+interface GatewayCatalogEntry {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    category?: string;
+    auth?: 'oauth2' | 'api_key' | 'none' | 'custom' | string;
+    scopes?: string[];
+    actions?: GatewayCatalogAction[];
+    triggers?: GatewayCatalogTrigger[];
+    metadata?: Record<string, unknown>;
+}
+interface GatewayCatalogAction {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    risk?: 'read' | 'write' | 'destructive' | string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    approvalRequired?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+}
+interface GatewayCatalogTrigger {
+    id?: string;
+    key?: string;
+    name?: string;
+    title?: string;
+    description?: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    dataClass?: IntegrationDataClass | string;
+    payloadSchema?: unknown;
+}
+declare function createGatewayCatalogProvider(options: GatewayCatalogProviderOptions): IntegrationProvider;
+declare function normalizeGatewayCatalog(entries: GatewayCatalogEntry[], options: {
+    providerId: string;
+    providerKind: IntegrationProviderKind;
+}): IntegrationConnector[];
+
+interface ActivepiecesPieceOverride {
+    category?: IntegrationConnectorCategory;
+    actionRisks?: Record<string, IntegrationActionRisk>;
+    approvalRequired?: Record<string, boolean>;
+}
+declare const ACTIVEPIECES_OVERRIDES: Record<string, ActivepiecesPieceOverride>;
+declare function getActivepiecesOverride(id: string): ActivepiecesPieceOverride | undefined;
+
+interface IntegrationCatalogFreshnessOptions {
+    liveActivepieces?: boolean;
+    minActivepiecesConnectors?: number;
+    staleConnectorDelta?: number;
+    fetchImpl?: typeof fetch;
+}
+interface IntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        activepiecesEntries: number;
+        activepiecesConnectors: number;
+        activepiecesActions: number;
+        activepiecesTriggers: number;
+        executableActivepiecesConnectors: number;
+        executableActivepiecesActions: number;
+        executableActivepiecesTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: IntegrationRegistrySummary;
+        conflictSamples: IntegrationRegistryConflict[];
+    };
+    upstream?: {
+        activepiecesPieces?: number;
+        activepiecesDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare const ACTIVEPIECES_PUBLIC_CATALOG_URL = "https://www.activepieces.com/pieces";
+declare function extractActivepiecesPublicPieceCount(html: string): number | undefined;
+declare function auditIntegrationCatalogFreshness(options?: IntegrationCatalogFreshnessOptions): Promise<IntegrationCatalogFreshnessResult>;
+
+declare const TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID = "tangle-catalog";
+declare const TANGLE_INTEGRATIONS_CATALOG_SOURCE = "tangle-integrations-catalog";
+type TangleIntegrationImplementationKind = 'native_adapter' | 'package_runtime';
+type TangleIntegrationContractStatus = 'contract_ready' | 'runtime_backed' | 'native_backed';
+interface TangleIntegrationCatalogEntry {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields?: ActivepiecesCatalogEntry['authFields'];
+    domains: string[];
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName?: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName?: string;
+    }>;
+}
+interface TangleIntegrationContract {
+    id: string;
+    title: string;
+    description: string;
+    category: IntegrationConnector['category'];
+    auth: IntegrationConnector['auth'];
+    authFields: NonNullable<ActivepiecesCatalogEntry['authFields']>;
+    actions: Array<{
+        id: string;
+        title: string;
+        risk: IntegrationConnector['actions'][number]['risk'];
+        upstreamName: string;
+    }>;
+    triggers: Array<{
+        id: string;
+        title: string;
+        upstreamName: string;
+    }>;
+    implementation: {
+        kind: TangleIntegrationImplementationKind;
+        runtimePackage?: string;
+        version?: string;
+    };
+    status: TangleIntegrationContractStatus;
+    quality: {
+        tangleContract: true;
+        authFieldsMapped: boolean;
+        actionNamesMapped: boolean;
+        triggerNamesMapped: boolean;
+        runtimePackageMapped: boolean;
+        nativeAdapter: boolean;
+    };
+}
+interface TangleCatalogRuntimePackageManifestOptions {
+    name?: string;
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+    additionalDependencies?: Record<string, string>;
+}
+interface TangleCatalogRuntimePackageManifest {
+    name: string;
+    private: true;
+    type: 'module';
+    dependencies: Record<string, string>;
+    tangle: {
+        integrationContracts: number;
+        packageRuntimeBackends: number;
+        generatedFrom: typeof TANGLE_INTEGRATIONS_CATALOG_SOURCE;
+    };
+}
+interface TangleCatalogExecutorInvocation {
+    connection: IntegrationConnection;
+    request: IntegrationActionRequest;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        actionId: string;
+        upstreamActionName?: string;
+    };
+}
+interface TangleCatalogTriggerInvocation {
+    connection: IntegrationConnection;
+    connector: IntegrationConnector;
+    catalogEntry: TangleIntegrationCatalogEntry;
+    trigger: NonNullable<IntegrationConnector['triggers']>[number];
+    targetUrl?: string;
+    piece: {
+        id: string;
+        packageName?: string;
+        version?: string;
+        triggerId: string;
+        upstreamTriggerName?: string;
+    };
+}
+interface TangleCatalogExecutorProviderOptions {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    startAuth?: (request: StartAuthRequest) => Promise<StartAuthResult> | StartAuthResult;
+    completeAuth?: (request: CompleteAuthRequest) => Promise<IntegrationConnection> | IntegrationConnection;
+    executeAction: (invocation: TangleCatalogExecutorInvocation) => Promise<IntegrationActionResult> | IntegrationActionResult;
+    subscribeTrigger?: (invocation: TangleCatalogTriggerInvocation) => Promise<IntegrationTriggerSubscription> | IntegrationTriggerSubscription;
+    unsubscribeTrigger?: (subscriptionId: string) => Promise<void> | void;
+    normalizeTriggerEvent?: (raw: unknown) => Promise<IntegrationTriggerEvent> | IntegrationTriggerEvent;
+}
+type TangleIntegrationCatalogFreshnessOptions = IntegrationCatalogFreshnessOptions;
+interface TangleIntegrationCatalogFreshnessResult {
+    ok: boolean;
+    generatedAt: string;
+    local: {
+        catalogEntries: number;
+        catalogConnectors: number;
+        catalogActions: number;
+        catalogTriggers: number;
+        executableCatalogConnectors: number;
+        executableCatalogActions: number;
+        executableCatalogTriggers: number;
+        executableToolDefinitions: number;
+        unsupportedExecutableConnectorIds: string[];
+        registryEntries: number;
+        registrySummary: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['registrySummary'];
+        conflictSamples: Awaited<ReturnType<typeof auditIntegrationCatalogFreshness>>['local']['conflictSamples'];
+    };
+    upstream?: {
+        externalEntries?: number;
+        externalDelta?: number;
+        checkedUrl: string;
+        warning?: string;
+    };
+    warnings: string[];
+}
+declare function listTangleIntegrationCatalogEntries(): TangleIntegrationCatalogEntry[];
+declare function listTangleIntegrationContracts(): TangleIntegrationContract[];
+declare function listTangleIntegrationCatalogRuntimePackages(): Array<{
+    connectorId: string;
+    packageName: string;
+    version?: string;
+}>;
+declare function buildTangleCatalogRuntimePackageManifest(options?: TangleCatalogRuntimePackageManifestOptions): TangleCatalogRuntimePackageManifest;
+declare function renderTangleCatalogRuntimePnpmAddCommand(options?: {
+    includeAgentIntegrationsPackage?: boolean;
+    agentIntegrationsVersion?: string;
+}): string;
+declare function buildTangleIntegrationCatalogConnectors(options?: {
+    providerId?: string;
+    includeCatalogActions?: boolean;
+    executable?: boolean;
+}): IntegrationConnector[];
+declare function createTangleCatalogExecutorProvider(options: TangleCatalogExecutorProviderOptions): IntegrationProvider;
+declare const extractExternalCatalogPublicCount: typeof extractActivepiecesPublicPieceCount;
+declare function auditTangleIntegrationCatalogFreshness(options?: TangleIntegrationCatalogFreshnessOptions): Promise<TangleIntegrationCatalogFreshnessResult>;
+
+interface TangleCatalogRuntimeNodeServerOptions {
+    secret: string;
+    host?: string;
+    port?: number;
+    path?: string;
+    maxBodyBytes?: number;
+    requireSignature?: boolean;
+    authResolver?: false | TangleCatalogHttpAuthResolverOptions;
+    executor?: Omit<TangleCatalogInstalledPackageExecutorOptions, 'resolveAuth'> & {
+        resolveAuth?: TangleCatalogInstalledPackageExecutorOptions['resolveAuth'];
+    };
+    onLog?: (event: {
+        level: 'info' | 'warn' | 'error';
+        message: string;
+        metadata?: Record<string, unknown>;
+    }) => void;
+}
+interface StartedTangleCatalogRuntimeNodeServer {
+    server: Server;
+    url: string;
+    close: () => Promise<void>;
+}
+declare function createTangleCatalogRuntimeNodeRequestListener(options: TangleCatalogRuntimeNodeServerOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+declare function startTangleCatalogRuntimeNodeServer(options: TangleCatalogRuntimeNodeServerOptions): Promise<StartedTangleCatalogRuntimeNodeServer>;
+
+type IntegrationCoveragePriority = 'tier_0' | 'tier_1' | 'tier_2' | 'long_tail';
+interface IntegrationCoverageSpec {
+    id: string;
+    title: string;
+    category: IntegrationConnectorCategory;
+    auth: IntegrationConnector['auth'];
+    priority: IntegrationCoveragePriority;
+    providerKinds: IntegrationProviderKind[];
+    domains: string[];
+    actionPack: IntegrationActionPack;
+    scopes?: string[];
+}
+type IntegrationActionPack = 'email' | 'calendar' | 'chat' | 'crm' | 'storage' | 'docs' | 'database' | 'project' | 'support' | 'marketing' | 'sales' | 'commerce' | 'finance' | 'hr' | 'dev' | 'ai' | 'analytics' | 'workflow' | 'webhook';
+declare function listIntegrationCoverageSpecs(): IntegrationCoverageSpec[];
+declare function buildIntegrationCoverageConnectors(options?: {
+    providerId?: string;
+    priorities?: IntegrationCoveragePriority[];
+    categories?: IntegrationConnectorCategory[];
+    actionPacks?: IntegrationActionPack[];
+}): IntegrationConnector[];
+declare function integrationCoverageChecklistMarkdown(): string;
+
+declare class InMemoryConnectionStore implements IntegrationConnectionStore {
+    private readonly connections;
+    get(connectionId: string): IntegrationConnection | undefined;
+    put(connection: IntegrationConnection): void;
+    listByOwner(owner: IntegrationActor): IntegrationConnection[];
+    delete(connectionId: string): void;
+}
+declare class IntegrationHub {
+    private readonly providers;
+    private readonly store;
+    private readonly capabilitySecret;
+    private readonly guard;
+    private readonly policy;
+    /** Host-injected (or in-memory default) secret store. The hub re-persists
+     *  rotated credentials here when a connection carries a secretRef. */
+    readonly secretStore: IntegrationHubOptions['secretStore'];
+    private readonly oauthStateStore;
+    private readonly oauthStateTtlMs;
+    private readonly credentialsRotated;
+    private readonly now;
+    constructor(options: IntegrationHubOptions);
+    listConnectors(): Promise<IntegrationConnector[]>;
+    listRegistry(options?: ComposeIntegrationRegistryOptions): Promise<IntegrationRegistry>;
+    startAuth(providerId: string, request: StartAuthRequest): Promise<StartAuthResult>;
+    completeAuth(providerId: string, request: CompleteAuthRequest): Promise<IntegrationConnection>;
+    upsertConnection(connection: IntegrationConnection): Promise<IntegrationConnection>;
+    listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]>;
+    getConnection(connectionId: string): Promise<IntegrationConnection | undefined>;
+    issueCapability(request: IssueCapabilityRequest): Promise<IssuedIntegrationCapability>;
+    verifyCapability(token: string): IntegrationCapability;
+    invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult>;
+    subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription>;
+    private requireProvider;
+    private requireConnector;
+    private requireConnection;
+    private assertConnectionActive;
+}
+declare function sanitizeConnection(connection: IntegrationConnection): Record<string, unknown>;
+declare function createMockIntegrationProvider(options?: {
+    id?: string;
+    connectors?: IntegrationConnector[];
+    onInvoke?: (connection: IntegrationConnection, request: IntegrationActionRequest) => IntegrationActionResult | Promise<IntegrationActionResult>;
+}): IntegrationProvider;
+declare function createHttpIntegrationProvider(options: HttpIntegrationProviderOptions): IntegrationProvider;
+declare function signCapability(capability: IntegrationCapability, secret: string): string;
+declare function verifyCapabilityToken(token: string, secret: string): IntegrationCapability;
+
+export { ACTIVEPIECES_OVERRIDES, ACTIVEPIECES_PUBLIC_CATALOG_URL, ActivepiecesCatalogEntry, type ActivepiecesPieceOverride, type AppSummary, ApprovalBackedPolicyEngine, type ApprovalBackedPolicyOptions, type BrokerToken, CANONICAL_INTEGRATION_ACTIONS, type CanonicalIntegrationActionId, type CanonicalLaunchConnectorOptions, type CatalogExecutorInvocation, type CatalogExecutorProviderOptions, CompleteAuthRequest, ComposeIntegrationRegistryOptions, type ConnectionCredentialResolverOptions, ConnectorAdapter, type ConnectorAdapterProviderOptions, ConnectorCredentials, type ConsentSummary, type CredentialBackedAdapterProviderOptions, DEFAULT_INTEGRATION_BRIDGE_ENV, DefaultIntegrationActionGuard, type DiscoverWorkspaceCapabilitiesInput, type GatewayCatalogAction, type GatewayCatalogEntry, type GatewayCatalogProviderOptions, type GatewayCatalogTrigger, type GraphqlOperationSpec, HttpIntegrationProviderOptions, type ImportCatalogOptions, InMemoryConnectionStore, InMemoryIntegrationApprovalStore, InMemoryIntegrationEventStore, InMemoryIntegrationIdempotencyStore, InMemoryIntegrationOAuthStateStore, InMemoryIntegrationSecretStore, InMemoryIntegrationWorkflowStore, type InferIntegrationRequirementsOptions, type InstalledIntegrationWorkflow, IntegrationActionGuard, type IntegrationActionPack, IntegrationActionRequest, IntegrationActionResult, IntegrationActionRisk, IntegrationActor, type IntegrationApprovalFilter, type IntegrationApprovalRecord, IntegrationApprovalRequest, type IntegrationApprovalResolution, type IntegrationApprovalStatus, type IntegrationApprovalStore, IntegrationAuditSink, type IntegrationBridgePayload, type IntegrationBridgeToolBinding, IntegrationCapability, type IntegrationCatalogFreshnessOptions, type IntegrationCatalogFreshnessResult, IntegrationCatalogSource, IntegrationConnection, IntegrationConnectionStore, IntegrationConnector, IntegrationConnectorAction, IntegrationConnectorCategory, type IntegrationCoveragePriority, type IntegrationCoverageSpec, IntegrationCredentialsRotatedEvent, IntegrationDataClass, IntegrationError, type IntegrationErrorRuntimeCode, type IntegrationEventStore, IntegrationGrantStore, IntegrationGuardContext, IntegrationHub, IntegrationHubOptions, type IntegrationIdempotencyRecord, type IntegrationIdempotencyStore, type IntegrationInvocationEnvelope, type IntegrationInvocationEnvelopeValidationOptions, IntegrationManifest, IntegrationManifestResolution, IntegrationOAuthState, IntegrationOAuthStateOutcome, IntegrationOAuthStateStore, IntegrationPolicyDecision, type IntegrationPolicyEffect, IntegrationPolicyEngine, type IntegrationPolicyRule, IntegrationProvider, IntegrationProviderKind, type IntegrationRateLimitDecision, type IntegrationRateLimiter, IntegrationRegistry, IntegrationRegistryConflict, IntegrationRegistrySummary, IntegrationRequirementMode, IntegrationRuntime, IntegrationSandboxBundle, IntegrationSandboxHost, type IntegrationSandboxHostHub, type IntegrationSandboxHostOptions, IntegrationSecretStore, IntegrationTriggerEvent, IntegrationTriggerSubscription, type IntegrationWebhookReceiverResult, type IntegrationWorkflowDefinition, IntegrationWorkflowRuntime, type IntegrationWorkflowRuntimeHub, type IntegrationWorkflowRuntimeOptions, type IntegrationWorkflowStore, InvokeWithCapabilityRequest, IssueCapabilityRequest, IssuedIntegrationCapability, type ManifestValidationIssue, type ManifestValidationResult, type McpCatalog, type McpCatalogTool, type MissingRequirementExplanation, type NormalizedIntegrationResult, type OAuthClientCredentials, type OpenApiDocument, type OpenApiOperation, PROVIDER_PASSTHROUGH_ACTION, type PlatformIntegrationPolicyPresetOptions, type ProviderHttpRequestInput, type ProviderPassthroughPolicy, type RegisterAppInput, type RegisteredApp, type RenderConsentOptions, ResolvedDataSource, SecretRef, StartAuthRequest, StartAuthResult, type StartedTangleCatalogRuntimeNodeServer, StaticIntegrationPolicyEngine, type StaticIntegrationPolicyOptions, type StoredIntegrationEvent, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, TANGLE_INTEGRATIONS_CATALOG_SOURCE, TangleAppsClient, type TangleAppsClientOptions, type TangleCatalogExecutorInvocation, type TangleCatalogExecutorProviderOptions, TangleCatalogHttpAuthResolverOptions, TangleCatalogInstalledPackageExecutorOptions, type TangleCatalogRuntimeNodeServerOptions, type TangleCatalogRuntimePackageManifest, type TangleCatalogRuntimePackageManifestOptions, type TangleCatalogTriggerInvocation, type TangleIntegrationCatalogEntry, type TangleIntegrationCatalogFreshnessOptions, type TangleIntegrationCatalogFreshnessResult, type TangleIntegrationContract, type TangleIntegrationContractStatus, type TangleIntegrationImplementationKind, type TangleIntegrationInvokeInput, type TangleIntegrationInvokeResult, TangleIntegrationsClient, type TangleIntegrationsClientOptions, type WorkspaceCapability, type WorkspaceCapabilityDiscovery, type WorkspaceToolSchema, type WorkspaceTrigger, adapterManifestsToConnectors, assertValidIntegrationManifest, auditIntegrationCatalogFreshness, auditTangleIntegrationCatalogFreshness, buildApprovalRequest, buildCanonicalLaunchConnectors, buildIntegrationBridgeEnvironment, buildIntegrationBridgePayload, buildIntegrationCoverageConnectors, buildIntegrationInvocationEnvelope, buildTangleCatalogRuntimePackageManifest, buildTangleIntegrationCatalogConnectors, calendarExercisePlannerManifest, canonicalActionConnectorId, createApprovalBackedPolicyEngine, createCatalogExecutorProvider, createConnectionCredentialResolver, createConnectorAdapterCatalogSource, createConnectorAdapterProvider, createCredentialBackedAdapterProvider, createDefaultIntegrationActionGuard, createDefaultIntegrationPolicyEngine, createGatewayCatalogProvider, createHttpIntegrationProvider, createIntegrationWorkflowRuntime, createMockIntegrationProvider, createPlatformIntegrationPolicyPreset, createTangleAppsClient, createTangleCatalogExecutorProvider, createTangleCatalogRuntimeNodeRequestListener, createTangleIntegrationsClient, decodeIntegrationBridgePayload, discoverWorkspaceCapabilities, dispatchIntegrationInvocation, encodeIntegrationBridgePayload, explainMissingRequirements, extractActivepiecesPublicPieceCount, extractExternalCatalogPublicCount, filterDiscoveryByWorkspaceScopes, getActivepiecesOverride, importGraphqlConnector, importMcpConnector, importOpenApiConnector, inferIntegrationManifestFromTools, integrationCoverageChecklistMarkdown, invocationRequestFromEnvelope, listIntegrationCoverageSpecs, listTangleIntegrationCatalogEntries, listTangleIntegrationCatalogRuntimePackages, listTangleIntegrationContracts, manifestToConnector, normalizeGatewayCatalog, normalizeIntegrationResult, parseIntegrationBridgeEnvironment, receiveIntegrationWebhook, redactApprovalRequest, redactCapability, redactIntegrationBridgePayload, redactInvocationEnvelope, renderApprovalCopy, renderConsentSummary, renderTangleCatalogRuntimePnpmAddCommand, resolveConnectionCredentials, resolveIntegrationApproval, revokeConnection, sanitizeConnection, signCapability, startTangleCatalogRuntimeNodeServer, storedEventToTriggerEvent, validateIntegrationInvocationEnvelope, validateIntegrationManifest, validateProviderPassthroughRequest, verifyCapabilityToken };