@tangle-network/agent-integrations 0.53.53 → 0.53.54

package/dist/chunk-ZC3ZE7TN.js

@@ -1,4849 +0,0 @@
-import {
-  IntegrationRuntimeError,
-  normalizeIntegrationError
-} from "./chunk-H4XYLS7T.js";
-import {
-  INTEGRATION_KIND_ALIASES,
-  canonicalIntegrationKind,
-  integrationSpecToConnector,
-  listIntegrationSpecs
-} from "./chunk-2GEGKSL5.js";
-import {
-  listBundledConnectorAdapters
-} from "./chunk-E2QYXDJQ.js";
-import {
-  CONNECTOR_ADAPTER_FACTORIES,
-  createOAuthBasicAuthorizationHeader,
-  createOAuthTokenRequestHeaders,
-  oauthClientCredentialRedactionValues,
-  redactOAuthSensitiveText
-} from "./chunk-QL6CRJ3E.js";
-
-// src/activepieces-catalog.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-import { dirname, resolve } from "path";
-
-// src/activepieces-overrides.ts
-var ACTIVEPIECES_OVERRIDES = {
-  slack: {
-    category: "chat",
-    actionRisks: {
-      "slack.send.message": "write",
-      "slack.send.direct.message": "write",
-      "request.action.message": "write",
-      "request.action.direct.message": "write",
-      "request.approval.direct.message": "write",
-      "request.send.approval.message": "write",
-      "upload.file": "write",
-      "search.messages": "read"
-    }
-  },
-  discord: { category: "chat" },
-  "microsoft-teams": { category: "chat" },
-  whatsapp: { category: "chat" },
-  telegram: { category: "chat" },
-  gmail: {
-    category: "email",
-    actionRisks: {
-      "gmail.send.email": "write",
-      "gmail.reply.to.email": "write",
-      "gmail.create.draft.reply": "write",
-      "gmail.search.mail": "read",
-      "gmail.get.email": "read",
-      "request.approval.in.email": "write"
-    }
-  },
-  "microsoft-outlook": { category: "email" },
-  sendgrid: { category: "email" },
-  postmark: { category: "email" },
-  mailchimp: { category: "email" },
-  resend: { category: "email" },
-  "google-calendar": { category: "calendar" },
-  "microsoft-outlook-calendar": { category: "calendar" },
-  cal: { category: "calendar" },
-  calendly: { category: "calendar" },
-  zoom: { category: "calendar" },
-  "google-drive": { category: "storage" },
-  dropbox: { category: "storage" },
-  onedrive: { category: "storage" },
-  "google-sheets": { category: "database" },
-  "google-docs": { category: "docs" },
-  airtable: { category: "database" },
-  notion: { category: "docs" },
-  hubspot: { category: "crm" },
-  salesforce: { category: "crm" },
-  pipedrive: { category: "crm" },
-  intercom: { category: "crm" },
-  zendesk: { category: "crm" },
-  neverbounce: { category: "crm" },
-  stripe: {
-    category: "crm",
-    actionRisks: {
-      "stripe.create.customer": "write",
-      "stripe.update.customer": "write",
-      "stripe.retrieve.customer": "read",
-      "stripe.search.customer": "read",
-      "stripe.search.subscriptions": "read",
-      "stripe.create.invoice": "write",
-      "stripe.retrieve.invoice": "read",
-      "stripe.find.invoice": "read",
-      "stripe.create.subscription": "write",
-      "stripe.cancel.subscription": "destructive",
-      "stripe.create.payment.intent": "write",
-      "stripe.retrieve.payment.intent": "read",
-      "stripe.create.refund": "destructive",
-      "stripe.create.product": "write",
-      "stripe.create.price": "write",
-      "stripe.create.payment.link": "write",
-      "stripe.deactivate.payment.link": "destructive",
-      "stripe.retrieve.payout": "read"
-    },
-    approvalRequired: {
-      "stripe.create.refund": true,
-      "stripe.cancel.subscription": true,
-      "stripe.deactivate.payment.link": true
-    }
-  },
-  twilio: {
-    category: "chat",
-    actionRisks: {
-      "send.sms": "write",
-      "send.whatsapp.message": "write",
-      "make.phone.call": "write"
-    }
-  },
-  shopify: { category: "crm" },
-  square: { category: "crm" }
-};
-function getActivepiecesOverride(id) {
-  return ACTIVEPIECES_OVERRIDES[id];
-}
-
-// src/activepieces-catalog.ts
-var CATALOG_RESOURCE_RELATIVE = "../data/activepieces-catalog.json";
-var CACHED_CATALOG;
-function loadCatalog() {
-  if (CACHED_CATALOG) return CACHED_CATALOG;
-  const here = dirname(fileURLToPath(import.meta.url));
-  const path = resolve(here, CATALOG_RESOURCE_RELATIVE);
-  const raw = readFileSync(path, "utf8");
-  const parsed = JSON.parse(raw);
-  CACHED_CATALOG = parsed;
-  return parsed;
-}
-function listActivepiecesCatalogEntries() {
-  return loadCatalog().map((entry) => ({
-    ...entry,
-    actions: [...entry.actions],
-    triggers: [...entry.triggers],
-    domains: [...entry.domains],
-    source: { ...entry.source }
-  }));
-}
-function buildActivepiecesConnectors(options = {}) {
-  const providerId = options.providerId ?? "activepieces";
-  const executable = options.executable === true;
-  return listActivepiecesCatalogEntries().map((entry) => {
-    const override = getActivepiecesOverride(entry.id);
-    const category = override?.category ?? entry.category;
-    const scopes = [`${entry.id}.read`, `${entry.id}.write`];
-    const catalogActions = entry.actions.map((action) => toAction(applyActionOverride(action, override), scopes, dataClassFor(category)));
-    const catalogTriggers = entry.triggers.map((trigger2) => toTrigger(trigger2, scopes, dataClassFor(category)));
-    const entryExecutable = executable && catalogActions.length > 0;
-    return {
-      id: entry.id,
-      providerId,
-      title: entry.title,
-      category,
-      auth: entry.auth,
-      scopes: options.includeCatalogActions ? scopes : [],
-      actions: options.includeCatalogActions ? catalogActions : [],
-      triggers: options.includeCatalogActions ? catalogTriggers : void 0,
-      metadata: {
-        source: "activepieces-community",
-        executable: entryExecutable,
-        runtime: "activepieces-piece",
-        catalogOnly: !entryExecutable,
-        supportTier: entryExecutable ? "gatewayExecutable" : "catalogOnly",
-        catalogActionCount: catalogActions.length,
-        catalogTriggerCount: catalogTriggers.length,
-        npmPackage: entry.npmPackage,
-        version: entry.version,
-        license: entry.source.license,
-        sourcePath: entry.source.path,
-        domains: entry.domains,
-        authFields: entry.authFields,
-        ...override ? { overridden: true } : {}
-      }
-    };
-  });
-}
-function applyActionOverride(action, override) {
-  if (!override) return action;
-  const risk = override.actionRisks?.[action.id] ?? action.risk;
-  return { ...action, risk };
-}
-function toAction(action, scopes, dataClass) {
-  return {
-    id: action.id,
-    title: action.title,
-    risk: action.risk,
-    requiredScopes: action.risk === "read" ? [scopes[0]] : [scopes[1]],
-    dataClass,
-    approvalRequired: action.risk !== "read",
-    inputSchema: { type: "object", additionalProperties: true, properties: {} }
-  };
-}
-function toTrigger(trigger2, scopes, dataClass) {
-  return {
-    id: trigger2.id,
-    title: trigger2.title,
-    requiredScopes: [scopes[0]],
-    dataClass,
-    payloadSchema: { type: "object", additionalProperties: true, properties: {} }
-  };
-}
-function dataClassFor(category) {
-  if (category === "database" || category === "storage" || category === "email") return "private";
-  if (category === "crm" || category === "chat" || category === "docs") return "private";
-  if (category === "internal") return "sensitive";
-  return "internal";
-}
-
-// src/index.ts
-import { createHash as createHash3, createHmac, randomBytes, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
-
-// src/core-error.ts
-var IntegrationError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "IntegrationError";
-  }
-  code;
-};
-
-// src/adapter-provider.ts
-function createConnectorAdapterProvider(options) {
-  const providerId = options.id ?? "first-party";
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch?.bind(globalThis);
-  const adapters = /* @__PURE__ */ new Map();
-  for (const adapter of options.adapters) {
-    adapters.set(adapter.manifest.kind, adapter);
-  }
-  return {
-    id: providerId,
-    kind: options.kind ?? "first_party",
-    listConnectors: () => [...adapters.values()].map((adapter) => manifestToConnector(providerId, adapter)),
-    async startAuth(request) {
-      const adapter = adapters.get(request.connectorId);
-      if (!adapter) {
-        throw new IntegrationError(
-          `Connector adapter ${request.connectorId} not found.`,
-          "connector_not_found"
-        );
-      }
-      const auth = oauthManifestAuth(adapter.manifest.auth);
-      if (!auth) {
-        throw new IntegrationError(
-          `Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`,
-          "auth_not_supported"
-        );
-      }
-      if ((auth.grantType ?? "authorization_code") !== "authorization_code") {
-        throw new IntegrationError(
-          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,
-          "auth_not_supported"
-        );
-      }
-      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
-      const tokenClientAuthMethod = resolveTokenClientAuthMethod(
-        auth.tokenClientAuthMethod,
-        request.connectorId
-      );
-      if (!options.resolveOAuthClient) {
-        throw new IntegrationError(
-          `OAuth client resolver missing on adapter provider; cannot start auth for ${request.connectorId}.`,
-          "config_missing"
-        );
-      }
-      const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
-      if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) {
-        throw new IntegrationError(
-          `OAuth client credentials unavailable for ${request.connectorId}.`,
-          "config_missing"
-        );
-      }
-      if (!auth.authorizationUrl) {
-        throw new IntegrationError(
-          `Connector ${request.connectorId} uses the ${auth.grantType ?? "authorization_code"} grant and has no authorization URL to redirect to.`,
-          "auth_not_supported"
-        );
-      }
-      const scopes = request.requestedScopes && request.requestedScopes.length > 0 ? request.requestedScopes : auth.scopes;
-      const url = new URL(resolveOAuthUrlTemplate(
-        auth.authorizationUrl,
-        request.metadata,
-        request.connectorId,
-        auth.urlTemplateMetadata
-      ));
-      url.searchParams.set("response_type", "code");
-      url.searchParams.set(
-        resolveOAuthParameterName(
-          auth.authorizationClientIdParam,
-          "client_id",
-          request.connectorId
-        ),
-        client.clientId
-      );
-      url.searchParams.set("redirect_uri", request.redirectUri);
-      if (auth.sendScopeParam !== false && scopes.length > 0) {
-        url.searchParams.set("scope", scopes.join(auth.scopeSeparator ?? " "));
-      }
-      const state = request.state ?? randomState();
-      url.searchParams.set("state", state);
-      if (auth.extraAuthParams) {
-        for (const [key, value] of Object.entries(auth.extraAuthParams)) {
-          url.searchParams.set(key, value);
-        }
-      }
-      if (pkce === "unsupported") {
-        url.searchParams.delete("code_challenge");
-        url.searchParams.delete("code_challenge_method");
-      } else {
-        url.searchParams.set(
-          "code_challenge",
-          requirePkceChallenge(request.codeChallenge, request.connectorId)
-        );
-        url.searchParams.set("code_challenge_method", "S256");
-      }
-      return {
-        providerId,
-        connectorId: request.connectorId,
-        authUrl: url.toString(),
-        state,
-        metadata: request.metadata
-      };
-    },
-    async completeAuth(request) {
-      const adapter = adapters.get(request.connectorId);
-      if (!adapter) {
-        throw new IntegrationError(
-          `Connector adapter ${request.connectorId} not found.`,
-          "connector_not_found"
-        );
-      }
-      const auth = oauthManifestAuth(adapter.manifest.auth);
-      if (!auth) {
-        throw new IntegrationError(
-          `Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`,
-          "auth_not_supported"
-        );
-      }
-      if ((auth.grantType ?? "authorization_code") !== "authorization_code") {
-        throw new IntegrationError(
-          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,
-          "auth_not_supported"
-        );
-      }
-      const tokenClientAuthMethod = resolveTokenClientAuthMethod(
-        auth.tokenClientAuthMethod,
-        request.connectorId
-      );
-      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
-      if (!request.code) {
-        throw new IntegrationError(
-          `Authorization code missing on completeAuth for ${request.connectorId}.`,
-          "config_missing"
-        );
-      }
-      if (!options.resolveOAuthClient) {
-        throw new IntegrationError(
-          `OAuth client resolver missing on adapter provider; cannot complete auth for ${request.connectorId}.`,
-          "config_missing"
-        );
-      }
-      const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
-      if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) {
-        throw new IntegrationError(
-          `OAuth client credentials unavailable for ${request.connectorId}.`,
-          "config_missing"
-        );
-      }
-      if (!fetchImpl) {
-        throw new IntegrationError(
-          "No fetch implementation available; inject fetchImpl into createConnectorAdapterProvider.",
-          "config_missing"
-        );
-      }
-      const body = new URLSearchParams({
-        grant_type: "authorization_code",
-        code: request.code,
-        redirect_uri: request.redirectUri
-      });
-      const codeVerifier = pkce === "unsupported" ? void 0 : requirePkceVerifier(request.codeVerifier, request.connectorId);
-      if (codeVerifier) body.set("code_verifier", codeVerifier);
-      const headers = createOAuthTokenRequestHeaders(auth.tokenRequestHeaders);
-      if (tokenClientAuthMethod === "none") {
-        body.set(
-          resolveOAuthParameterName(
-            auth.tokenClientIdParam,
-            "client_id",
-            request.connectorId
-          ),
-          client.clientId
-        );
-      } else if (tokenClientAuthMethod === "client_secret_post") {
-        body.set(
-          resolveOAuthParameterName(
-            auth.tokenClientIdParam,
-            "client_id",
-            request.connectorId
-          ),
-          client.clientId
-        );
-        body.set(
-          resolveOAuthParameterName(
-            auth.tokenClientSecretParam,
-            "client_secret",
-            request.connectorId
-          ),
-          client.clientSecret
-        );
-      } else {
-        const authorization = createOAuthBasicAuthorizationHeader(
-          client.clientId,
-          client.clientSecret,
-          base64Encode
-        );
-        headers.authorization = authorization;
-      }
-      const redactionValues = [
-        request.code,
-        ...codeVerifier ? [codeVerifier] : [],
-        ...oauthClientCredentialRedactionValues(
-          client.clientId,
-          client.clientSecret,
-          headers.authorization
-        )
-      ];
-      const tokenUrl = resolveOAuthUrlTemplate(
-        auth.tokenUrl,
-        request.metadata,
-        request.connectorId,
-        auth.urlTemplateMetadata
-      );
-      let res;
-      try {
-        res = await fetchImpl(tokenUrl, {
-          method: "POST",
-          headers,
-          body
-        });
-      } catch (cause) {
-        const detail = redactOAuthSensitiveText(
-          cause?.message ?? "unknown",
-          redactionValues
-        );
-        throw new IntegrationError(
-          `OAuth token exchange transport error for ${request.connectorId}: ${detail}`,
-          "provider_failure"
-        );
-      }
-      if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
-        const redactedText = redactOAuthSensitiveText(text, redactionValues);
-        const detail = `${res.status} ${statusText} \u2014 ${redactedText.slice(0, 200)}`;
-        throw new IntegrationError(
-          `OAuth token exchange failed for ${request.connectorId}: ${detail}`,
-          "provider_failure"
-        );
-      }
-      let json;
-      try {
-        json = await res.json();
-      } catch {
-        throw new IntegrationError(
-          `OAuth token exchange returned non-JSON body for ${request.connectorId}.`,
-          "provider_failure"
-        );
-      }
-      if (!json.access_token) {
-        throw new IntegrationError(
-          `OAuth token exchange returned no access_token for ${request.connectorId}.`,
-          "provider_failure"
-        );
-      }
-      const grantedScopes = typeof json.scope === "string" && json.scope.length > 0 ? json.scope.split(/[\s,]+/).filter(Boolean) : [];
-      const issued = now();
-      const issuedIso = issued.toISOString();
-      const expiresAt = typeof json.expires_in === "number" && json.expires_in > 0 ? new Date(issued.getTime() + json.expires_in * 1e3).toISOString() : void 0;
-      const capturedMetadata = captureTokenMetadata(auth.tokenMetadata, json, request.connectorId);
-      return {
-        id: randomConnectionId(),
-        owner: request.owner,
-        providerId,
-        connectorId: request.connectorId,
-        status: "active",
-        grantedScopes,
-        createdAt: issuedIso,
-        updatedAt: issuedIso,
-        expiresAt,
-        metadata: { ...request.metadata, ...capturedMetadata }
-      };
-    },
-    async invokeAction(connection, request) {
-      const adapter = adapters.get(connection.connectorId);
-      if (!adapter) {
-        throw new IntegrationError(`Connector adapter ${connection.connectorId} not found.`, "connector_not_found");
-      }
-      const capability = adapter.manifest.capabilities.find((candidate) => candidate.name === request.action);
-      if (!capability) {
-        throw new IntegrationError(`Capability ${request.action} is not defined by ${connection.connectorId}.`, "action_not_found");
-      }
-      const source = await options.resolveDataSource(connection);
-      let rotationPersistence = Promise.resolve();
-      const persistRotation = (credentials) => {
-        if (!options.onCredentialsRotated) return Promise.resolve();
-        rotationPersistence = rotationPersistence.then(
-          () => options.onCredentialsRotated({ connection, credentials })
-        );
-        void rotationPersistence.catch(() => {
-        });
-        return rotationPersistence;
-      };
-      const invocation = {
-        source,
-        capabilityName: request.action,
-        args: toRecord(request.input),
-        idempotencyKey: request.idempotencyKey ?? `idem_${connection.id}_${request.action}_${now().getTime()}`,
-        expectedEtag: typeof request.metadata?.expectedEtag === "string" ? request.metadata.expectedEtag : void 0,
-        callSessionId: typeof request.metadata?.callSessionId === "string" ? request.metadata.callSessionId : void 0,
-        onCredentialsRotated: options.onCredentialsRotated ? persistRotation : void 0
-      };
-      try {
-        if (capability.class === "read") {
-          if (!adapter.executeRead) {
-            throw new IntegrationError(`Connector ${connection.connectorId} does not implement reads.`, "action_not_found");
-          }
-          const result = await adapter.executeRead(invocation);
-          return readResultToAction(request, result);
-        }
-        if (capability.class === "mutation") {
-          if (!adapter.executeMutation) {
-            throw new IntegrationError(`Connector ${connection.connectorId} does not implement mutations.`, "action_not_found");
-          }
-          const result = await adapter.executeMutation(invocation);
-          return mutationResultToAction(request, result);
-        }
-        throw new IntegrationError(`Capability ${request.action} is not invokable as an action.`, "action_not_found");
-      } finally {
-        await rotationPersistence;
-      }
-    }
-  };
-}
-function adapterManifestsToConnectors(adapters, providerId = "first-party") {
-  return adapters.map((adapter) => manifestToConnector(providerId, adapter));
-}
-function createConnectorAdapterCatalogSource(options) {
-  const sourceId = options.id ?? "first-party";
-  return {
-    id: sourceId,
-    precedence: options.precedence,
-    connectors: adapterManifestsToConnectors(options.adapters, options.providerId ?? sourceId)
-  };
-}
-function manifestToConnector(providerId, adapter) {
-  const manifest = adapter.manifest;
-  const primaryAuth = primaryManifestAuth(manifest.auth);
-  const oauthAuth = oauthManifestAuth(manifest.auth);
-  return {
-    id: manifest.kind,
-    providerId,
-    title: manifest.displayName,
-    category: mapCategory(manifest.category),
-    auth: mapAuth(primaryAuth.kind),
-    scopes: primaryAuth.kind === "oauth2" ? primaryAuth.scopes : [],
-    actions: manifest.capabilities.filter((capability) => capability.class === "read" || capability.class === "mutation").map((capability) => ({
-      id: capability.name,
-      title: titleFromName(capability.name),
-      risk: capability.class === "read" ? "read" : capability.externalEffect ? "destructive" : "write",
-      requiredScopes: capability.requiredScopes ?? [],
-      dataClass: inferDataClass(manifest.category),
-      description: capability.description,
-      approvalRequired: capability.class === "mutation",
-      inputSchema: capability.parameters
-    })),
-    metadata: {
-      source: "first-party-adapter",
-      supportTier: "firstPartyExecutable",
-      executable: true,
-      oauthPkce: oauthAuth ? resolveOAuthPkceMode(oauthAuth.pkce, manifest.kind) : void 0,
-      authOptions: manifest.auth.kind === "one_of" ? manifest.auth.options.map((auth) => auth.kind) : [manifest.auth.kind],
-      preferredAuth: manifest.auth.kind === "one_of" ? manifest.auth.preferred : manifest.auth.kind
-    }
-  };
-}
-function readResultToAction(request, result) {
-  return {
-    ok: true,
-    action: request.action,
-    output: result.data,
-    metadata: {
-      etag: result.etag,
-      fetchedAt: result.fetchedAt
-    }
-  };
-}
-function mutationResultToAction(request, result) {
-  if (result.status === "committed") {
-    return {
-      ok: true,
-      action: request.action,
-      output: result.data,
-      metadata: {
-        etagAfter: result.etagAfter,
-        committedAt: result.committedAt,
-        idempotentReplay: result.idempotentReplay
-      }
-    };
-  }
-  if (result.status === "conflict") {
-    return {
-      ok: false,
-      action: request.action,
-      output: {
-        conflict: true,
-        message: result.message,
-        alternatives: result.alternatives,
-        currentState: result.currentState
-      }
-    };
-  }
-  return {
-    ok: false,
-    action: request.action,
-    output: {
-      rateLimited: true,
-      retryAfterMs: result.retryAfterMs,
-      message: result.message
-    }
-  };
-}
-function mapAuth(kind) {
-  if (kind === "one_of") return "custom";
-  if (kind === "oauth2") return "oauth2";
-  if (kind === "api-key") return "api_key";
-  if (kind === "none") return "none";
-  return "custom";
-}
-function primaryManifestAuth(auth) {
-  if (auth.kind !== "one_of") return auth;
-  return auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0];
-}
-function oauthManifestAuth(auth) {
-  if (auth.kind === "oauth2") return auth;
-  if (auth.kind !== "one_of") return void 0;
-  return auth.options.find((option) => option.kind === "oauth2");
-}
-function resolveTokenClientAuthMethod(value, connectorId) {
-  if (value === void 0 || value === "client_secret_post") {
-    return "client_secret_post";
-  }
-  if (value === "none" || value === "client_secret_basic") return value;
-  throw new IntegrationError(
-    `Connector ${connectorId} has an unsupported OAuth token client authentication method.`,
-    "config_missing"
-  );
-}
-function resolveOAuthPkceMode(value, connectorId) {
-  if (value === void 0 || value === "required") return "required";
-  if (value === "supported" || value === "unsupported") return value;
-  throw new IntegrationError(
-    `Connector ${connectorId} has an invalid OAuth PKCE posture.`,
-    "config_missing"
-  );
-}
-function requirePkceChallenge(value, connectorId) {
-  if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new IntegrationError(
-      `OAuth PKCE S256 challenge missing or invalid for ${connectorId}.`,
-      "config_missing"
-    );
-  }
-  return value;
-}
-function requirePkceVerifier(value, connectorId) {
-  if (!value || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) {
-    throw new IntegrationError(
-      `OAuth PKCE verifier missing or invalid for ${connectorId}.`,
-      "config_missing"
-    );
-  }
-  return value;
-}
-function resolveOAuthParameterName(value, fallback, connectorId) {
-  const name = value ?? fallback;
-  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
-    throw new IntegrationError(
-      `Connector ${connectorId} declares an invalid OAuth parameter name.`,
-      "config_missing"
-    );
-  }
-  return name;
-}
-function base64Encode(value) {
-  const btoa2 = globalThis.btoa;
-  if (typeof btoa2 !== "function") {
-    throw new IntegrationError(
-      "OAuth client_secret_basic requires a base64 encoder in this runtime.",
-      "config_missing"
-    );
-  }
-  const bytes = new TextEncoder().encode(value);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa2(binary);
-}
-function resolveOAuthUrlTemplate(template, metadata, connectorId, metadataSpecs) {
-  const placeholders = [...template.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)];
-  let resolved = template;
-  for (const match of placeholders) {
-    const key = match[1];
-    const raw = metadata?.[key];
-    const metadataSpec = metadataSpecs?.[key];
-    if (metadataSpec?.kind === "base-url") {
-      if (typeof raw !== "string") {
-        throw new IntegrationError(
-          `OAuth URL for ${connectorId} requires metadata.${key} as a provider base URL.`,
-          "config_missing"
-        );
-      }
-      resolved = resolved.replaceAll(
-        match[0],
-        resolveOAuthMetadataBaseUrl(raw, metadataSpec, connectorId, key)
-      );
-      continue;
-    }
-    if (metadataSpec?.kind === "path-segment") {
-      if (!isOAuthPathSegmentPlaceholder(template, match.index ?? -1, match[0])) {
-        throw new IntegrationError(
-          `OAuth URL for ${connectorId} declares metadata.${key} outside a complete path segment.`,
-          "config_missing"
-        );
-      }
-      if (typeof raw !== "string" || !isOAuthPathSegment(raw.trim())) {
-        throw new IntegrationError(
-          `OAuth URL for ${connectorId} requires metadata.${key} as a valid path segment.`,
-          "config_missing"
-        );
-      }
-      resolved = resolved.replaceAll(match[0], encodeURIComponent(raw.trim()));
-      continue;
-    }
-    if (typeof raw !== "string" || !isDnsLabel(raw.trim())) {
-      throw new IntegrationError(
-        `OAuth URL for ${connectorId} requires metadata.${key} as a valid tenant label.`,
-        "config_missing"
-      );
-    }
-    resolved = resolved.replaceAll(match[0], raw.trim().toLowerCase());
-  }
-  let url;
-  try {
-    url = new URL(resolved);
-  } catch {
-    throw new IntegrationError(
-      `OAuth URL for ${connectorId} is invalid.`,
-      "config_missing"
-    );
-  }
-  if (url.protocol !== "https:" || url.username || url.password) {
-    throw new IntegrationError(
-      `OAuth URL for ${connectorId} must be HTTPS without embedded credentials.`,
-      "config_missing"
-    );
-  }
-  return url.toString();
-}
-function isOAuthPathSegment(value) {
-  return value !== "." && value !== ".." && /^[A-Za-z0-9._~-]{1,128}$/.test(value);
-}
-function isOAuthPathSegmentPlaceholder(template, index, placeholder) {
-  if (index < 0) return false;
-  const schemeIndex = template.indexOf("://");
-  const rootEnd = schemeIndex >= 0 ? schemeIndex + 3 : template.startsWith("{") ? template.indexOf("}") + 1 : 0;
-  const pathStart = template.indexOf("/", rootEnd);
-  const end = index + placeholder.length;
-  const queryStart = template.search(/[?#]/);
-  return pathStart >= 0 && index >= pathStart && (queryStart < 0 || index < queryStart) && template[index - 1] === "/" && (end === template.length || template[end] === "/" || template[end] === "?" || template[end] === "#");
-}
-function resolveOAuthMetadataBaseUrl(value, spec, connectorId, metadataKey) {
-  let url;
-  try {
-    url = new URL(value.trim());
-  } catch {
-    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
-  }
-  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
-  }
-  const exactAllowed = spec.allowedBaseUrls?.some((candidate) => sameOrigin(candidate, url)) ?? false;
-  const suffixAllowed = spec.allowedBaseUrlSuffixes?.some(
-    (suffix) => !url.port && suffix.startsWith(".") && url.hostname.toLowerCase().endsWith(suffix.toLowerCase())
-  ) ?? false;
-  const hasExplicitAllowlist = Boolean(
-    spec.allowedBaseUrls?.length || spec.allowedBaseUrlSuffixes?.length
-  );
-  if (hasExplicitAllowlist && !exactAllowed && !suffixAllowed) {
-    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
-  }
-  if (spec.requirePublicHttps && !isPublicDnsHostname(url.hostname)) {
-    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
-  }
-  return url.origin;
-}
-function invalidOAuthMetadataBaseUrl(connectorId, metadataKey) {
-  return new IntegrationError(
-    `OAuth URL for ${connectorId} requires metadata.${metadataKey} as an allowed HTTPS provider root.`,
-    "config_missing"
-  );
-}
-function sameOrigin(candidate, actual) {
-  try {
-    const allowed = new URL(candidate);
-    return allowed.protocol === "https:" && !allowed.username && !allowed.password && allowed.pathname === "/" && !allowed.search && !allowed.hash && allowed.origin === actual.origin;
-  } catch {
-    return false;
-  }
-}
-function isPublicDnsHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa")) {
-    return false;
-  }
-  if (/^[0-9.]+$/.test(normalized) || normalized.includes(":")) return false;
-  return normalized.includes(".") && normalized.split(".").every(isDnsLabel);
-}
-function isDnsLabel(value) {
-  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(value);
-}
-function captureTokenMetadata(tokenMetadata, json, connectorId) {
-  if (!tokenMetadata) return {};
-  const captured = {};
-  for (const [metaKey, source] of Object.entries(tokenMetadata)) {
-    const field = typeof source === "string" ? source : source.field;
-    const required = typeof source === "string" ? false : source.required === true;
-    const raw = json[field];
-    const value = typeof raw === "string" ? raw.trim() : raw;
-    if (value === void 0 || value === null || value === "") {
-      if (required) {
-        throw new IntegrationError(
-          `OAuth token exchange for ${connectorId} did not return required field "${field}" for metadata.${metaKey}.`,
-          "provider_failure"
-        );
-      }
-      continue;
-    }
-    captured[metaKey] = String(value);
-  }
-  return captured;
-}
-function mapCategory(category) {
-  if (category === "comms") return "chat";
-  if (category === "spreadsheet") return "database";
-  if (category === "doc") return "docs";
-  if (category === "commerce") return "workflow";
-  if (category === "sales-intelligence") return "crm";
-  if (category === "market-intelligence" || category === "hr") return "other";
-  return category === "other" ? "other" : category;
-}
-function inferDataClass(category) {
-  if (category === "commerce") return "sensitive";
-  if (category === "webhook") return "internal";
-  return "private";
-}
-function titleFromName(name) {
-  return name.split(/[._-]/g).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
-}
-function toRecord(input) {
-  if (input && typeof input === "object" && !Array.isArray(input)) return input;
-  return {};
-}
-function randomState() {
-  const bytes = new Uint8Array(24);
-  globalThis.crypto.getRandomValues(bytes);
-  return base64UrlEncode(bytes);
-}
-function randomConnectionId() {
-  if (typeof globalThis.crypto?.randomUUID === "function") {
-    return `conn_${globalThis.crypto.randomUUID().replace(/-/g, "")}`;
-  }
-  const bytes = new Uint8Array(16);
-  globalThis.crypto.getRandomValues(bytes);
-  return `conn_${base64UrlEncode(bytes)}`;
-}
-function base64UrlEncode(bytes) {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(bin) : Buffer.from(bin, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-// src/credentials.ts
-var CredentialRefreshRevokedError = class extends Error {
-  constructor() {
-    super("Connection was revoked during credential refresh.");
-    this.name = "CredentialRefreshRevokedError";
-  }
-};
-var credentialRefreshes = /* @__PURE__ */ new WeakMap();
-var credentialPersistences = /* @__PURE__ */ new WeakMap();
-var credentialRevocations = /* @__PURE__ */ new WeakMap();
-var InMemoryIntegrationSecretStore = class {
-  secrets = /* @__PURE__ */ new Map();
-  get(ref) {
-    return this.secrets.get(secretKey(ref));
-  }
-  put(ref, credentials) {
-    this.secrets.set(secretKey(ref), credentials);
-  }
-  delete(ref) {
-    this.secrets.delete(secretKey(ref));
-  }
-};
-var InMemoryIntegrationOAuthStateStore = class {
-  states = /* @__PURE__ */ new Map();
-  put(state) {
-    this.states.set(state.state, state);
-  }
-  consume(state) {
-    const record = this.states.get(state);
-    this.states.delete(state);
-    if (!record) return { ok: false, reason: "unknown" };
-    if (record.expiresAt <= Date.now()) return { ok: false, reason: "expired" };
-    return { ok: true, state: record };
-  }
-  sweep(now) {
-    for (const [key, record] of this.states) {
-      if (record.expiresAt <= now) this.states.delete(key);
-    }
-  }
-};
-function createConnectionCredentialResolver(options) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  return async function resolveDataSource(connection) {
-    const credentials = await resolveConnectionCredentials(connection, {
-      secrets: options.secrets,
-      connections: options.connections,
-      adapters: options.adapters,
-      now,
-      markConnectionError: options.markConnectionError
-    });
-    return {
-      id: connection.id,
-      projectId: String(connection.metadata?.projectId ?? connection.owner.id),
-      publishedAgentId: typeof connection.metadata?.publishedAgentId === "string" ? connection.metadata.publishedAgentId : null,
-      kind: connection.connectorId,
-      label: connection.account?.displayName ?? connection.account?.email ?? connection.connectorId,
-      consistencyModel: typeof connection.metadata?.consistencyModel === "string" ? connection.metadata.consistencyModel : "authoritative",
-      scopes: connection.grantedScopes,
-      metadata: connection.metadata ?? {},
-      credentials,
-      status: connection.status === "active" ? "active" : connection.status === "revoked" ? "revoked" : "error"
-    };
-  };
-}
-async function resolveConnectionCredentials(input, options) {
-  if (input.status !== "active") throw new Error(`Connection ${input.id} is ${input.status}.`);
-  if (!input.secretRef) return { kind: "none" };
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const current = await options.secrets.get(input.secretRef);
-  if (!current) throw new Error(`Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`);
-  if (!isExpiredOauth(current, now)) return current;
-  const adapter = options.adapters?.find((candidate) => candidate.manifest.kind === input.connectorId);
-  if (!adapter?.refreshToken) return current;
-  let refresh;
-  try {
-    await assertCredentialRefreshActive(input, options, now);
-    refresh = acquireCredentialRefresh({
-      connectorId: input.connectorId,
-      secretRef: input.secretRef,
-      secrets: options.secrets,
-      now,
-      refreshToken: adapter.refreshToken.bind(adapter)
-    });
-    const refreshed = await refresh.promise;
-    await assertCredentialRefreshActive(input, options, now, refresh);
-    if (options.connections) {
-      await options.connections.put({
-        ...input,
-        status: "active",
-        updatedAt: now().toISOString(),
-        expiresAt: refreshed.kind === "oauth2" && refreshed.expiresAt ? new Date(refreshed.expiresAt).toISOString() : input.expiresAt
-      });
-      await assertCredentialRefreshActive(input, options, now, refresh);
-    }
-    return refreshed;
-  } catch (error) {
-    const err = error instanceof Error ? error : new Error("Credential refresh failed.");
-    if (err instanceof CredentialRefreshRevokedError) throw err;
-    await options.markConnectionError?.(input, err);
-    if (options.connections) {
-      await options.connections.put({
-        ...input,
-        status: "expired",
-        updatedAt: now().toISOString()
-      });
-    }
-    throw err;
-  } finally {
-    if (refresh) {
-      releaseCredentialRefresh(
-        options.secrets,
-        input.connectorId,
-        input.secretRef,
-        refresh
-      );
-    }
-  }
-}
-function acquireCredentialRefresh(input) {
-  let refreshes = credentialRefreshes.get(input.secrets);
-  if (!refreshes) {
-    refreshes = /* @__PURE__ */ new Map();
-    credentialRefreshes.set(input.secrets, refreshes);
-  }
-  const key = credentialRefreshKey(input.connectorId, input.secretRef);
-  if (credentialRevocations.get(input.secrets)?.has(key)) {
-    throw new CredentialRefreshRevokedError();
-  }
-  const existing = refreshes.get(key);
-  if (existing) {
-    existing.waiters += 1;
-    return existing;
-  }
-  let flight;
-  const promise = Promise.resolve().then(async () => {
-    const latest = await input.secrets.get(input.secretRef);
-    if (!latest) {
-      throw new Error(
-        `Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`
-      );
-    }
-    if (!isExpiredOauth(latest, input.now)) return latest;
-    const refreshed = await input.refreshToken(latest);
-    if (flight.cancelled) throw new CredentialRefreshRevokedError();
-    await input.secrets.put(input.secretRef, refreshed);
-    if (flight.cancelled) {
-      await input.secrets.delete?.(input.secretRef);
-      throw new CredentialRefreshRevokedError();
-    }
-    return refreshed;
-  });
-  flight = {
-    promise,
-    cancelled: false,
-    settled: false,
-    waiters: 1
-  };
-  refreshes.set(key, flight);
-  const settle = () => {
-    flight.settled = true;
-    clearCredentialRefresh(input.secrets, key, flight);
-  };
-  void promise.then(settle, settle);
-  return flight;
-}
-function releaseCredentialRefresh(secrets, connectorId, secretRef, flight) {
-  flight.waiters -= 1;
-  clearCredentialRefresh(
-    secrets,
-    credentialRefreshKey(connectorId, secretRef),
-    flight
-  );
-}
-function clearCredentialRefresh(secrets, key, flight) {
-  if (!flight.settled || flight.waiters !== 0) return;
-  const refreshes = credentialRefreshes.get(secrets);
-  if (refreshes?.get(key) !== flight) return;
-  refreshes.delete(key);
-  if (refreshes.size === 0) credentialRefreshes.delete(secrets);
-}
-async function assertCredentialRefreshActive(input, options, now, operation) {
-  const key = input.secretRef ? credentialRefreshKey(input.connectorId, input.secretRef) : void 0;
-  let revoked = operation?.cancelled === true || key !== void 0 && credentialRevocations.get(options.secrets)?.has(key) === true;
-  let stored;
-  if (options.connections) {
-    stored = await options.connections.get(input.id);
-    revoked ||= stored?.status === "revoked";
-  }
-  if (!revoked && input.secretRef) {
-    revoked = await options.secrets.get(input.secretRef) === void 0;
-  }
-  if (!revoked) return;
-  if (operation) operation.cancelled = true;
-  if (input.secretRef) await options.secrets.delete?.(input.secretRef);
-  if (options.connections && stored?.status !== "revoked") {
-    await options.connections.put({
-      ...stored ?? input,
-      status: "revoked",
-      updatedAt: now().toISOString()
-    });
-  }
-  throw new CredentialRefreshRevokedError();
-}
-function createCredentialBackedAdapterProvider(options) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  return createConnectorAdapterProvider({
-    ...options,
-    resolveDataSource: createConnectionCredentialResolver(options),
-    onCredentialsRotated: async ({ connection, credentials }) => {
-      const persistence = connection.secretRef ? acquireCredentialPersistence(
-        options.secrets,
-        connection.connectorId,
-        connection.secretRef
-      ) : void 0;
-      try {
-        await assertCredentialRefreshActive(connection, options, now, persistence);
-        if (connection.secretRef) {
-          await options.secrets.put(connection.secretRef, credentials);
-        }
-        await assertCredentialRefreshActive(connection, options, now, persistence);
-        if (options.connections) {
-          await options.connections.put({
-            ...connection,
-            status: "active",
-            updatedAt: now().toISOString(),
-            expiresAt: credentials.kind === "oauth2" && credentials.expiresAt ? new Date(credentials.expiresAt).toISOString() : connection.expiresAt
-          });
-          await assertCredentialRefreshActive(connection, options, now, persistence);
-        }
-        await options.onCredentialsRotated?.({ connection, secretRef: connection.secretRef, credentials });
-        await assertCredentialRefreshActive(connection, options, now, persistence);
-      } finally {
-        if (persistence && connection.secretRef) {
-          releaseCredentialPersistence(
-            options.secrets,
-            connection.connectorId,
-            connection.secretRef,
-            persistence
-          );
-        }
-      }
-    }
-  });
-}
-function acquireCredentialPersistence(secrets, connectorId, secretRef) {
-  let persistences = credentialPersistences.get(secrets);
-  if (!persistences) {
-    persistences = /* @__PURE__ */ new Map();
-    credentialPersistences.set(secrets, persistences);
-  }
-  const key = credentialRefreshKey(connectorId, secretRef);
-  let leases = persistences.get(key);
-  if (!leases) {
-    leases = /* @__PURE__ */ new Set();
-    persistences.set(key, leases);
-  }
-  const lease = {
-    cancelled: credentialRevocations.get(secrets)?.has(key) === true
-  };
-  leases.add(lease);
-  return lease;
-}
-function releaseCredentialPersistence(secrets, connectorId, secretRef, lease) {
-  const persistences = credentialPersistences.get(secrets);
-  if (!persistences) return;
-  const key = credentialRefreshKey(connectorId, secretRef);
-  const leases = persistences.get(key);
-  leases?.delete(lease);
-  if (leases?.size === 0) persistences.delete(key);
-  if (persistences.size === 0) credentialPersistences.delete(secrets);
-}
-async function revokeConnection(input) {
-  const finishRevocation = input.connection.secretRef && input.secrets ? beginCredentialRevocation(
-    input.secrets,
-    input.connection.connectorId,
-    input.connection.secretRef
-  ) : void 0;
-  try {
-    if (input.connection.secretRef) await input.secrets?.delete?.(input.connection.secretRef);
-    const revoked = {
-      ...input.connection,
-      status: "revoked",
-      updatedAt: (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
-    };
-    await input.connections?.put(revoked);
-    return revoked;
-  } finally {
-    finishRevocation?.();
-  }
-}
-function beginCredentialRevocation(secrets, connectorId, secretRef) {
-  const key = credentialRefreshKey(connectorId, secretRef);
-  let revocations = credentialRevocations.get(secrets);
-  if (!revocations) {
-    revocations = /* @__PURE__ */ new Map();
-    credentialRevocations.set(secrets, revocations);
-  }
-  revocations.set(key, (revocations.get(key) ?? 0) + 1);
-  const flight = credentialRefreshes.get(secrets)?.get(key);
-  if (flight) flight.cancelled = true;
-  for (const persistence of credentialPersistences.get(secrets)?.get(key) ?? []) {
-    persistence.cancelled = true;
-  }
-  return () => {
-    const remaining = (revocations?.get(key) ?? 1) - 1;
-    if (remaining > 0) revocations?.set(key, remaining);
-    else revocations?.delete(key);
-    if (revocations?.size === 0) credentialRevocations.delete(secrets);
-  };
-}
-function isExpiredOauth(credentials, now) {
-  return credentials.kind === "oauth2" && typeof credentials.expiresAt === "number" && credentials.expiresAt <= now().getTime() && Boolean(credentials.refreshToken);
-}
-function secretKey(ref) {
-  return `${ref.provider}:${ref.id}`;
-}
-function credentialRefreshKey(connectorId, ref) {
-  return JSON.stringify([connectorId, ref.provider, ref.id]);
-}
-
-// src/audit.ts
-import { randomUUID } from "crypto";
-var InMemoryIntegrationAuditStore = class {
-  events = [];
-  record(event) {
-    this.events.push(event);
-  }
-  list(filter = {}) {
-    return this.events.filter((event) => matchesFilter(event, filter));
-  }
-};
-function createIntegrationAuditEvent(input) {
-  const occurredAt = input.occurredAt instanceof Date ? input.occurredAt.toISOString() : input.occurredAt ?? (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  return {
-    ...input,
-    id: input.id ?? `audit_${randomUUID()}`,
-    occurredAt,
-    metadata: input.metadata ? redactUnknown(input.metadata) : void 0
-  };
-}
-function createAuditingActionGuard(options) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  return {
-    async invokeAction(ctx, proceed) {
-      const startedAt = now();
-      try {
-        const result = await proceed();
-        await options.sink.record(actionEvent({
-          ctx,
-          request: ctx.request,
-          result,
-          type: result.ok ? "action.invoked" : "action.failed",
-          subject: options.subject,
-          occurredAt: startedAt,
-          includeInputPreview: options.includeInputPreview
-        }));
-        return result;
-      } catch (error) {
-        await options.sink.record(actionEvent({
-          ctx,
-          request: ctx.request,
-          type: "action.failed",
-          subject: options.subject,
-          occurredAt: startedAt,
-          includeInputPreview: options.includeInputPreview,
-          message: error instanceof Error ? error.message : "Integration action failed."
-        }));
-        throw error;
-      }
-    }
-  };
-}
-function sanitizeAuditConnection(connection) {
-  return {
-    id: connection.id,
-    owner: connection.owner,
-    providerId: connection.providerId,
-    connectorId: connection.connectorId,
-    status: connection.status,
-    grantedScopes: connection.grantedScopes,
-    account: connection.account,
-    hasSecretRef: Boolean(connection.secretRef),
-    createdAt: connection.createdAt,
-    updatedAt: connection.updatedAt,
-    expiresAt: connection.expiresAt,
-    lastUsedAt: connection.lastUsedAt
-  };
-}
-function actionEvent(input) {
-  return createIntegrationAuditEvent({
-    type: input.type,
-    occurredAt: input.occurredAt,
-    actor: input.subject ?? input.ctx.connection.owner,
-    connectionId: input.ctx.connection.id,
-    providerId: input.ctx.connection.providerId,
-    connectorId: input.ctx.connection.connectorId,
-    action: input.request.action,
-    risk: input.ctx.action?.risk,
-    dataClass: input.ctx.action?.dataClass,
-    ok: input.result?.ok ?? false,
-    message: input.message,
-    metadata: {
-      idempotencyKey: input.request.idempotencyKey,
-      dryRun: input.request.dryRun,
-      externalId: input.result?.externalId,
-      warnings: input.result?.warnings,
-      inputPreview: input.includeInputPreview ? redactUnknown(input.request.input) : void 0
-    }
-  });
-}
-function matchesFilter(event, filter) {
-  if (filter.type && event.type !== filter.type) return false;
-  if (filter.actor && (!event.actor || event.actor.type !== filter.actor.type || event.actor.id !== filter.actor.id)) return false;
-  if (filter.connectionId && event.connectionId !== filter.connectionId) return false;
-  if (filter.providerId && event.providerId !== filter.providerId) return false;
-  if (filter.connectorId && event.connectorId !== filter.connectorId) return false;
-  if (filter.action && event.action !== filter.action) return false;
-  return true;
-}
-function redactUnknown(value) {
-  if (Array.isArray(value)) return value.map(redactUnknown);
-  if (!value || typeof value !== "object") return value;
-  const out = {};
-  for (const [key, child] of Object.entries(value)) {
-    if (/token|secret|password|authorization|api[_-]?key|credential|refresh/i.test(key)) {
-      out[key] = "[REDACTED]";
-    } else {
-      out[key] = redactUnknown(child);
-    }
-  }
-  return out;
-}
-
-// src/approval.ts
-import { createHash } from "crypto";
-var InMemoryIntegrationApprovalStore = class {
-  records = /* @__PURE__ */ new Map();
-  get(approvalId) {
-    return this.records.get(approvalId);
-  }
-  put(record) {
-    this.records.set(record.id, record);
-  }
-  list(filter = {}) {
-    return [...this.records.values()].filter((record) => matchesFilter2(record, filter));
-  }
-};
-var ApprovalBackedPolicyEngine = class {
-  base;
-  store;
-  audit;
-  now;
-  approvalTtlMs;
-  constructor(options) {
-    this.base = options.base;
-    this.store = options.store;
-    this.audit = options.audit;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.approvalTtlMs = options.approvalTtlMs;
-  }
-  async decide(ctx) {
-    const approved = await this.findApprovedRecord(ctx);
-    if (approved) return { decision: "allow", reason: `Approved by ${approved.resolvedBy?.type ?? "actor"} ${approved.resolvedBy?.id ?? "unknown"}.`, metadata: { approvalId: approved.id } };
-    const decision = await this.base.decide(ctx);
-    if (decision.decision !== "require_approval") return decision;
-    const requestedAt = decision.approval.requestedAt;
-    const expiresAt = this.approvalTtlMs ? new Date(Date.parse(requestedAt) + this.approvalTtlMs).toISOString() : void 0;
-    const record = {
-      id: decision.approval.id,
-      request: decision.approval,
-      status: "pending",
-      requestedAt,
-      expiresAt,
-      metadata: { ...decision.metadata ?? {}, inputHash: approvalInputHash(ctx.request.input) }
-    };
-    await this.store.put(record);
-    await this.audit?.record(createIntegrationAuditEvent({
-      type: "approval.requested",
-      actor: ctx.subject,
-      connectionId: ctx.connection.id,
-      providerId: ctx.connection.providerId,
-      connectorId: ctx.connection.connectorId,
-      action: ctx.request.action,
-      risk: ctx.action?.risk,
-      dataClass: ctx.action?.dataClass,
-      message: decision.reason,
-      metadata: { approvalId: record.id },
-      now: this.now
-    }));
-    return decision;
-  }
-  async findApprovedRecord(ctx) {
-    const approvalId = typeof ctx.request.metadata?.approvalId === "string" ? ctx.request.metadata.approvalId : void 0;
-    if (!approvalId) return void 0;
-    const record = await this.store.get(approvalId);
-    if (!record || record.status !== "approved") return void 0;
-    if (record.expiresAt && Date.parse(record.expiresAt) <= this.now().getTime()) {
-      await this.store.put({ ...record, status: "expired" });
-      return void 0;
-    }
-    if (!approvalMatches(record, ctx)) return void 0;
-    return record;
-  }
-};
-function createApprovalBackedPolicyEngine(options) {
-  return new ApprovalBackedPolicyEngine(options);
-}
-async function resolveIntegrationApproval(input) {
-  const record = await input.store.get(input.approvalId);
-  if (!record) throw new Error(`Approval ${input.approvalId} not found.`);
-  const now = input.now ?? (() => /* @__PURE__ */ new Date());
-  const next = {
-    ...record,
-    status: input.approved ? "approved" : "denied",
-    resolvedAt: now().toISOString(),
-    resolvedBy: input.resolvedBy,
-    reason: input.reason,
-    metadata: { ...record.metadata ?? {}, ...input.metadata ?? {} }
-  };
-  await input.store.put(next);
-  await input.audit?.record(createIntegrationAuditEvent({
-    type: "approval.resolved",
-    actor: input.resolvedBy,
-    connectionId: record.request.connectionId,
-    providerId: record.request.providerId,
-    connectorId: record.request.connectorId,
-    action: record.request.action,
-    risk: record.request.risk,
-    dataClass: record.request.dataClass,
-    ok: input.approved,
-    message: input.reason,
-    metadata: { approvalId: record.id, status: next.status },
-    now
-  }));
-  return next;
-}
-function approvalMatches(record, ctx) {
-  return record.request.connectionId === ctx.connection.id && record.request.providerId === ctx.connection.providerId && record.request.connectorId === ctx.connection.connectorId && record.request.action === ctx.request.action && record.request.actor.type === ctx.subject.type && record.request.actor.id === ctx.subject.id && record.metadata?.inputHash === approvalInputHash(ctx.request.input);
-}
-function matchesFilter2(record, filter) {
-  if (filter.status && record.status !== filter.status) return false;
-  if (filter.connectionId && record.request.connectionId !== filter.connectionId) return false;
-  if (filter.connectorId && record.request.connectorId !== filter.connectorId) return false;
-  if (filter.action && record.request.action !== filter.action) return false;
-  if (filter.actor && (record.request.actor.type !== filter.actor.type || record.request.actor.id !== filter.actor.id)) return false;
-  return true;
-}
-function approvalInputHash(input) {
-  return createHash("sha256").update(JSON.stringify(input ?? null)).digest("base64url");
-}
-
-// src/actions.ts
-var CANONICAL_INTEGRATION_ACTIONS = {
-  googleCalendarEventsList: "google-calendar.events.list",
-  googleCalendarEventsCreate: "google-calendar.events.create",
-  gmailMessagesSearch: "gmail.messages.search",
-  gmailMessagesSend: "gmail.messages.send",
-  googleDriveFilesSearch: "google-drive.files.search",
-  googleDriveFilesRead: "google-drive.files.read",
-  githubRepositoriesGet: "github.repositories.get",
-  githubIssuesSearch: "github.issues.search",
-  githubIssuesCreate: "github.issues.create",
-  githubPullRequestsComment: "github.pull-requests.comment",
-  slackChannelsList: "slack.channels.list",
-  slackMessagesSearch: "slack.messages.search",
-  slackMessagesPost: "slack.messages.post",
-  providerHttpRequest: "provider.http.request"
-};
-function buildCanonicalLaunchConnectors(options = {}) {
-  const providerId = options.providerId ?? "tangle-platform";
-  const connectors = [
-    googleCalendarConnector(providerId),
-    gmailConnector(providerId),
-    googleDriveConnector(providerId),
-    githubConnector(providerId),
-    slackConnector(providerId)
-  ];
-  if (!options.includeProviderPassthrough) return connectors;
-  return connectors.map((connector) => ({
-    ...connector,
-    actions: [...connector.actions, providerPassthroughAction(connector.id)]
-  }));
-}
-function canonicalActionConnectorId(actionId) {
-  if (actionId.startsWith("google-calendar.")) return "google-calendar";
-  if (actionId.startsWith("gmail.")) return "gmail";
-  if (actionId.startsWith("google-drive.")) return "google-drive";
-  if (actionId.startsWith("github.")) return "github";
-  if (actionId.startsWith("slack.")) return "slack";
-  if (actionId === CANONICAL_INTEGRATION_ACTIONS.providerHttpRequest) return void 0;
-  return actionId.split(".")[0];
-}
-function googleCalendarConnector(providerId) {
-  return {
-    id: "google-calendar",
-    providerId,
-    title: "Google Calendar",
-    category: "calendar",
-    auth: "oauth2",
-    scopes: ["https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/calendar.events"],
-    actions: [
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.googleCalendarEventsList,
-        title: "List calendar events",
-        risk: "read",
-        requiredScopes: ["https://www.googleapis.com/auth/calendar.readonly"],
-        dataClass: "private",
-        description: "Read events from a Google Calendar over a bounded time range.",
-        inputSchema: objectSchema({
-          calendarId: { type: "string", default: "primary" },
-          timeMin: { type: "string", description: "RFC3339 lower bound." },
-          timeMax: { type: "string", description: "RFC3339 upper bound." }
-        }, ["timeMin", "timeMax"])
-      },
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.googleCalendarEventsCreate,
-        title: "Create calendar event",
-        risk: "write",
-        requiredScopes: ["https://www.googleapis.com/auth/calendar.events"],
-        dataClass: "private",
-        approvalRequired: true,
-        description: "Create an event on a Google Calendar after user approval.",
-        inputSchema: objectSchema({
-          calendarId: { type: "string", default: "primary" },
-          start: { type: "string", description: "RFC3339 start time." },
-          end: { type: "string", description: "RFC3339 end time." },
-          summary: { type: "string" },
-          description: { type: "string" },
-          attendees: { type: "array", items: { type: "string" } }
-        }, ["start", "end", "summary"])
-      }
-    ],
-    metadata: { source: "canonical-launch", supportTier: "setupReady" }
-  };
-}
-function gmailConnector(providerId) {
-  return {
-    id: "gmail",
-    providerId,
-    title: "Gmail",
-    category: "email",
-    auth: "oauth2",
-    scopes: ["https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.send"],
-    actions: [
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.gmailMessagesSearch,
-        title: "Search Gmail messages",
-        risk: "read",
-        requiredScopes: ["https://www.googleapis.com/auth/gmail.readonly"],
-        dataClass: "private",
-        description: "Search user Gmail messages and return bounded message metadata/snippets.",
-        inputSchema: objectSchema({ query: { type: "string" }, maxResults: { type: "integer", minimum: 1, maximum: 50 } }, ["query"])
-      },
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.gmailMessagesSend,
-        title: "Send Gmail message",
-        risk: "write",
-        requiredScopes: ["https://www.googleapis.com/auth/gmail.send"],
-        dataClass: "private",
-        approvalRequired: true,
-        description: "Send an email from the user account after approval.",
-        inputSchema: objectSchema({
-          to: { type: "array", items: { type: "string" } },
-          subject: { type: "string" },
-          body: { type: "string" }
-        }, ["to", "subject", "body"])
-      }
-    ],
-    triggers: [{
-      id: "gmail.messages.received",
-      title: "Gmail message received",
-      requiredScopes: ["https://www.googleapis.com/auth/gmail.readonly"],
-      dataClass: "private",
-      description: "Triggered when a new matching Gmail message is received."
-    }],
-    metadata: { source: "canonical-launch", supportTier: "setupReady" }
-  };
-}
-function googleDriveConnector(providerId) {
-  return {
-    id: "google-drive",
-    providerId,
-    title: "Google Drive",
-    category: "storage",
-    auth: "oauth2",
-    scopes: ["https://www.googleapis.com/auth/drive.readonly", "https://www.googleapis.com/auth/drive.file"],
-    actions: [
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.googleDriveFilesSearch,
-        title: "Search Drive files",
-        risk: "read",
-        requiredScopes: ["https://www.googleapis.com/auth/drive.readonly"],
-        dataClass: "private",
-        description: "Search user-visible Google Drive files.",
-        inputSchema: objectSchema({ query: { type: "string" }, maxResults: { type: "integer", minimum: 1, maximum: 50 } }, ["query"])
-      },
-      {
-        id: CANONICAL_INTEGRATION_ACTIONS.googleDriveFilesRead,
-        title: "Read Drive file",
-        risk: "read",
-        requiredScopes: ["https://www.googleapis.com/auth/drive.readonly"],
-        dataClass: "private",
-        description: "Read metadata and content for an authorized Drive file.",
-        inputSchema: objectSchema({ fileId: { type: "string" } }, ["fileId"])
-      }
-    ],
-    metadata: { source: "canonical-launch", supportTier: "setupReady" }
-  };
-}
-function githubConnector(providerId) {
-  return {
-    id: "github",
-    providerId,
-    title: "GitHub",
-    category: "workflow",
-    auth: "oauth2",
-    scopes: ["repo", "read:user"],
-    actions: [
-      readAction(CANONICAL_INTEGRATION_ACTIONS.githubRepositoriesGet, "Read repository metadata", ["repo"], objectSchema({ owner: { type: "string" }, repo: { type: "string" } }, ["owner", "repo"])),
-      readAction(CANONICAL_INTEGRATION_ACTIONS.githubIssuesSearch, "Search issues and pull requests", ["repo"], objectSchema({ query: { type: "string" }, limit: { type: "integer", minimum: 1, maximum: 50 } }, ["query"])),
-      writeAction(CANONICAL_INTEGRATION_ACTIONS.githubIssuesCreate, "Create issue", ["repo"], objectSchema({ owner: { type: "string" }, repo: { type: "string" }, title: { type: "string" }, body: { type: "string" } }, ["owner", "repo", "title"])),
-      writeAction(CANONICAL_INTEGRATION_ACTIONS.githubPullRequestsComment, "Comment on pull request", ["repo"], objectSchema({ owner: { type: "string" }, repo: { type: "string" }, pullNumber: { type: "integer" }, body: { type: "string" } }, ["owner", "repo", "pullNumber", "body"]))
-    ],
-    metadata: { source: "canonical-launch", supportTier: "setupReady" }
-  };
-}
-function slackConnector(providerId) {
-  return {
-    id: "slack",
-    providerId,
-    title: "Slack",
-    category: "chat",
-    auth: "oauth2",
-    scopes: ["channels:read", "search:read", "chat:write"],
-    actions: [
-      readAction(CANONICAL_INTEGRATION_ACTIONS.slackChannelsList, "List Slack channels", ["channels:read"], objectSchema({ limit: { type: "integer", minimum: 1, maximum: 200 } })),
-      readAction(CANONICAL_INTEGRATION_ACTIONS.slackMessagesSearch, "Search Slack messages", ["search:read"], objectSchema({ query: { type: "string" }, count: { type: "integer", minimum: 1, maximum: 50 } }, ["query"])),
-      writeAction(CANONICAL_INTEGRATION_ACTIONS.slackMessagesPost, "Post Slack message", ["chat:write"], objectSchema({ channel: { type: "string" }, text: { type: "string" }, blocks: { type: "array" } }, ["channel", "text"]))
-    ],
-    triggers: [trigger("slack.message.posted", "Slack message posted", ["channels:read"])],
-    metadata: { source: "canonical-launch", supportTier: "setupReady" }
-  };
-}
-function readAction(id, title, scopes, inputSchema) {
-  return { id, title, risk: "read", requiredScopes: scopes, dataClass: "private", inputSchema };
-}
-function writeAction(id, title, scopes, inputSchema) {
-  return { id, title, risk: "write", requiredScopes: scopes, dataClass: "private", approvalRequired: true, inputSchema };
-}
-function trigger(id, title, scopes) {
-  return { id, title, requiredScopes: scopes, dataClass: "private" };
-}
-function providerPassthroughAction(connectorId) {
-  return {
-    id: CANONICAL_INTEGRATION_ACTIONS.providerHttpRequest,
-    title: "Provider HTTP request",
-    risk: "write",
-    requiredScopes: [],
-    dataClass: "sensitive",
-    approvalRequired: true,
-    description: `Controlled provider-native passthrough for ${connectorId}. Disabled by default by platform policy.`,
-    inputSchema: objectSchema({
-      method: { type: "string", enum: ["GET", "POST", "PUT", "PATCH", "DELETE"] },
-      path: { type: "string" },
-      query: { type: "object" },
-      body: { type: "object" }
-    }, ["method", "path"])
-  };
-}
-function objectSchema(properties, required = []) {
-  return { type: "object", additionalProperties: false, properties, required };
-}
-
-// src/bridge.ts
-var DEFAULT_INTEGRATION_BRIDGE_ENV = "TANGLE_INTEGRATION_BUNDLE";
-function buildIntegrationBridgePayload(bundle) {
-  return {
-    version: 1,
-    manifestId: bundle.manifestId,
-    subject: bundle.subject,
-    expiresAt: bundle.expiresAt,
-    tools: bundle.tools.flatMap((tool) => {
-      const binding = bundle.capabilities.find(
-        (candidate) => candidate.connectorId === tool.connectorId && candidate.connectionId && candidate.allowedActions.includes(tool.action.id)
-      );
-      if (!binding) return [];
-      return [{
-        name: tool.name,
-        title: tool.title,
-        connectorId: tool.connectorId,
-        connectionId: binding.connectionId,
-        action: tool.action.id,
-        risk: tool.risk,
-        dataClass: tool.dataClass,
-        requiredScopes: tool.requiredScopes,
-        capabilityToken: binding.capability.token
-      }];
-    })
-  };
-}
-function encodeIntegrationBridgePayload(payload) {
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-}
-function decodeIntegrationBridgePayload(encoded) {
-  const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-  assertBridgePayload(parsed);
-  return parsed;
-}
-function buildIntegrationBridgeEnvironment(bundle, options = {}) {
-  const envVar = options.envVar ?? DEFAULT_INTEGRATION_BRIDGE_ENV;
-  return {
-    [envVar]: encodeIntegrationBridgePayload(buildIntegrationBridgePayload(bundle))
-  };
-}
-function parseIntegrationBridgeEnvironment(env, options = {}) {
-  const envVar = options.envVar ?? DEFAULT_INTEGRATION_BRIDGE_ENV;
-  const encoded = env[envVar];
-  if (!encoded) throw new Error(`Missing ${envVar}.`);
-  return decodeIntegrationBridgePayload(encoded);
-}
-function redactIntegrationBridgePayload(payload) {
-  return {
-    ...payload,
-    tools: payload.tools.map((tool) => ({
-      ...tool,
-      capabilityToken: "[REDACTED]"
-    }))
-  };
-}
-function assertBridgePayload(value) {
-  if (!value || typeof value !== "object") throw new Error("Invalid integration bridge payload.");
-  const payload = value;
-  if (payload.version !== 1) throw new Error("Unsupported integration bridge payload version.");
-  if (typeof payload.manifestId !== "string") throw new Error("Invalid integration bridge manifestId.");
-  if (typeof payload.expiresAt !== "string") throw new Error("Invalid integration bridge expiresAt.");
-  if (!Array.isArray(payload.tools)) throw new Error("Invalid integration bridge tools.");
-}
-
-// src/apps.ts
-var TangleAppsClient = class {
-  endpoint;
-  fetchImpl;
-  constructor(options) {
-    this.endpoint = options.endpoint.replace(/\/$/, "");
-    this.fetchImpl = options.fetchImpl ?? fetch;
-  }
-  /**
-   * Register a product as an app (ONE-TIME, with the owner's bearer — a Tangle
-   * session or `sk-tan-*` key). Returns the client_id + the once-shown
-   * client_secret; persist the secret immediately (never retrievable again).
-   */
-  async registerApp(input, ownerBearer) {
-    const data = await this.request(
-      "POST",
-      "/v1/apps",
-      input,
-      ownerBearer
-    );
-    return { ...data.app, clientSecret: data.clientSecret };
-  }
-  /** List the caller's registered apps (no secrets). */
-  async listApps(ownerBearer) {
-    const data = await this.request("GET", "/v1/apps", void 0, ownerBearer);
-    return data.apps ?? [];
-  }
-  /** Revoke an app and cascade-kill its grants + tokens. */
-  revokeApp(appId, ownerBearer) {
-    return this.request("POST", `/v1/apps/${encodeURIComponent(appId)}/revoke`, {}, ownerBearer);
-  }
-  /**
-   * Durable re-mint: mint a fresh single-use `sk-tan-broker-` token against an
-   * existing consented grant using ONLY the app credentials — no user session,
-   * no `agc_` code. The runtime path: one call per `/v1/hub/exec`.
-   */
-  async mintBrokerToken(input) {
-    const data = await this.request(
-      "POST",
-      `/v1/apps/grants/${encodeURIComponent(input.grantId)}/mint-broker-token`,
-      {
-        client_id: input.clientId,
-        client_secret: input.clientSecret,
-        grant_id: input.grantId,
-        ...input.ttlSeconds ? { ttl_seconds: input.ttlSeconds } : {}
-      }
-    );
-    return toBrokerToken(data);
-  }
-  /**
-   * Exchange an `agc_` authorization code (from the user's one-time consent)
-   * for the first broker token + the durable grant. Use on the consent
-   * callback; afterward `mintBrokerToken` is enough.
-   */
-  async exchangeAuthCode(input) {
-    const data = await this.request("POST", "/v1/apps/oauth/token", {
-      grant_type: "authorization_code",
-      client_id: input.clientId,
-      client_secret: input.clientSecret,
-      code: input.code,
-      redirect_uri: input.redirectUri,
-      ...input.connectionId ? { connection_id: input.connectionId } : {}
-    });
-    return toBrokerToken(data);
-  }
-  async request(method, path, body, bearer) {
-    try {
-      const headers = { accept: "application/json" };
-      if (bearer) headers.authorization = `Bearer ${bearer}`;
-      if (body !== void 0) headers["content-type"] = "application/json";
-      const response = await this.fetchImpl(`${this.endpoint}${path}`, {
-        method,
-        headers,
-        body: body !== void 0 ? JSON.stringify(body) : void 0
-      });
-      const json = await response.json().catch(() => void 0);
-      if (!response.ok || json && json.success === false) {
-        const platformCode = json?.error && typeof json.error === "object" ? json.error.code : void 0;
-        const message = json?.error && typeof json.error === "object" && json.error.message || (typeof json?.error === "string" ? json.error : `Tangle apps request failed (HTTP ${response.status})`);
-        throw new IntegrationRuntimeError({
-          code: platformCode === "BROKER_DISABLED" ? "passthrough_disabled" : "unknown",
-          message,
-          status: response.status,
-          metadata: { platformCode, path }
-        });
-      }
-      return (json && "data" in json ? json.data : json) ?? {};
-    } catch (error) {
-      if (error instanceof IntegrationRuntimeError) throw error;
-      const normalized = normalizeIntegrationError(error);
-      throw new IntegrationRuntimeError({
-        code: normalized.code,
-        message: normalized.message,
-        metadata: { path, userAction: normalized.userAction }
-      });
-    }
-  }
-};
-function createTangleAppsClient(options) {
-  return new TangleAppsClient(options);
-}
-function toBrokerToken(data) {
-  return {
-    accessToken: data.access_token,
-    expiresIn: data.expires_in,
-    scope: data.scope,
-    connectionId: data.connection_id
-  };
-}
-
-// src/client.ts
-var TangleIntegrationsClient = class {
-  endpoint;
-  bridge;
-  fetchImpl;
-  getCapabilityToken;
-  constructor(options) {
-    this.endpoint = options.endpoint.replace(/\/$/, "");
-    this.bridge = options.bridge ?? parseIntegrationBridgeEnvironment(
-      options.env ?? readProcessEnv(),
-      { envVar: options.envVar ?? DEFAULT_INTEGRATION_BRIDGE_ENV }
-    );
-    this.fetchImpl = options.fetchImpl ?? fetch;
-    this.getCapabilityToken = options.getCapabilityToken ?? ((tool) => tool.capabilityToken);
-  }
-  tools() {
-    return [...this.bridge.tools];
-  }
-  findTool(toolOrAction) {
-    const found = this.bridge.tools.find(
-      (tool) => tool.name === toolOrAction || tool.action === toolOrAction || `${tool.connectorId}.${tool.action}` === toolOrAction
-    );
-    if (!found) {
-      throw new IntegrationRuntimeError({
-        code: "action_not_found",
-        message: `Integration tool ${toolOrAction} is not available in this runtime.`,
-        metadata: { available: this.bridge.tools.map((tool) => ({ name: tool.name, action: tool.action, connectorId: tool.connectorId })) }
-      });
-    }
-    return found;
-  }
-  async invoke(input) {
-    try {
-      const tool = this.findTool(input.tool);
-      const token = await this.getCapabilityToken(tool);
-      const response = await this.fetchImpl(`${this.endpoint}/v1/integrations/invoke`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          authorization: `Bearer ${token}`
-        },
-        body: JSON.stringify({
-          action: tool.action,
-          input: input.input,
-          idempotencyKey: input.idempotencyKey ?? defaultIdempotencyKey(tool.action),
-          dryRun: input.dryRun,
-          metadata: input.metadata
-        })
-      });
-      const json = await response.json().catch(() => void 0);
-      if (!response.ok && !json) {
-        return { status: "failed", action: tool.action, error: `Integration invoke failed with HTTP ${response.status}` };
-      }
-      return json ?? { status: "failed", action: tool.action, error: "Integration invoke returned an empty response." };
-    } catch (error) {
-      const normalized = normalizeIntegrationError(error);
-      return { status: "failed", action: input.tool, error: normalized.message, metadata: { code: normalized.code, userAction: normalized.userAction } };
-    }
-  }
-};
-function createTangleIntegrationsClient(options) {
-  return new TangleIntegrationsClient(options);
-}
-function defaultIdempotencyKey(action) {
-  return `${action}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
-}
-function readProcessEnv() {
-  if (typeof process !== "undefined" && process.env) return process.env;
-  return {};
-}
-
-// src/consent.ts
-function renderConsentSummary(manifestOrResolution, options = {}) {
-  const manifest = "manifest" in manifestOrResolution ? manifestOrResolution.manifest : manifestOrResolution;
-  const appName = options.appName ?? manifest.title ?? manifest.id;
-  const requirements = manifest.requirements;
-  const risk = aggregateRisk(requirements, options.connectors);
-  const connectorIds = unique(requirements.map((requirement) => requirement.connectorId));
-  const first = requirements[0];
-  const body = first ? sentenceForRequirement(appName, first) : `${appName} does not request integrations.`;
-  return {
-    title: `${appName} wants to use ${humanList(connectorIds.map(titleize))}`,
-    body,
-    bullets: requirements.map((requirement) => bulletForRequirement(requirement, options.connectors)),
-    primaryAction: risk === "read" ? "Allow access" : risk === "write" ? "Review and allow" : "Review destructive access",
-    risk,
-    connectorIds
-  };
-}
-function renderApprovalCopy(input) {
-  return {
-    title: `${input.appName} wants to ${input.action.title.toLowerCase()}`,
-    body: `${input.appName} is requesting permission to run "${input.action.title}" on ${input.connectorTitle}.`,
-    bullets: [
-      `Risk: ${input.action.risk}`,
-      `Data: ${input.action.dataClass}`,
-      ...input.approvalId ? [`Approval id: ${input.approvalId}`] : []
-    ],
-    primaryAction: input.action.risk === "read" ? "Allow" : "Approve action",
-    risk: input.action.risk,
-    connectorIds: []
-  };
-}
-function sentenceForRequirement(appName, requirement) {
-  if (requirement.connectorId === "google-calendar" && requirement.mode === "read") {
-    return `${appName} wants to read your Google Calendar to find schedule-aware recommendations.`;
-  }
-  if (requirement.connectorId === "google-calendar" && requirement.mode === "write") {
-    return `${appName} wants to create or update Google Calendar events after your approval.`;
-  }
-  if (requirement.mode === "read") return `${appName} wants to read ${titleize(requirement.connectorId)} data.`;
-  if (requirement.mode === "write") return `${appName} wants to write ${titleize(requirement.connectorId)} data after approval.`;
-  return `${appName} wants to subscribe to ${titleize(requirement.connectorId)} events.`;
-}
-function bulletForRequirement(requirement, connectors = []) {
-  const connector = connectors.find((candidate) => candidate.id === requirement.connectorId);
-  const actions = requirement.requiredActions?.length ? requirement.requiredActions.map((id) => connector?.actions.find((action) => action.id === id)?.title ?? id) : requirement.requiredTriggers ?? [];
-  return `${titleize(requirement.connectorId)}: ${requirement.reason}${actions.length ? ` (${actions.join(", ")})` : ""}`;
-}
-function aggregateRisk(requirements, connectors = []) {
-  let rank = 0;
-  for (const requirement of requirements) {
-    if (requirement.mode === "write") rank = Math.max(rank, 1);
-    const connector = connectors.find((candidate) => candidate.id === requirement.connectorId);
-    for (const actionId of requirement.requiredActions ?? []) {
-      const risk = connector?.actions.find((action) => action.id === actionId)?.risk;
-      if (risk === "write") rank = Math.max(rank, 1);
-      if (risk === "destructive") rank = Math.max(rank, 2);
-    }
-  }
-  return rank === 2 ? "destructive" : rank === 1 ? "write" : "read";
-}
-function humanList(values) {
-  if (values.length <= 1) return values[0] ?? "integrations";
-  if (values.length === 2) return `${values[0]} and ${values[1]}`;
-  return `${values.slice(0, -1).join(", ")}, and ${values.at(-1)}`;
-}
-function titleize(value) {
-  return value.split(/[-_.]/g).filter(Boolean).map((part) => part[0].toUpperCase() + part.slice(1)).join(" ");
-}
-function unique(values) {
-  return [...new Set(values)];
-}
-
-// src/discovery.ts
-async function discoverWorkspaceCapabilities(input) {
-  const connections = await resolveConnections(input);
-  const connectors = await resolveConnectors(input);
-  const activeConnectionsByConnector = /* @__PURE__ */ new Map();
-  for (const conn of connections) {
-    if (conn.status !== "active") continue;
-    if (!activeConnectionsByConnector.has(conn.connectorId)) {
-      activeConnectionsByConnector.set(conn.connectorId, conn);
-    }
-  }
-  const capabilities = [];
-  const triggers = [];
-  const countsByConnector = {};
-  const unreachableConnectors = [];
-  for (const connector of connectors) {
-    const connection = activeConnectionsByConnector.get(connector.id);
-    const connected = Boolean(connection);
-    if (!connected && !input.includeUnconnected) continue;
-    const grantedScopes = new Set(connection?.grantedScopes ?? []);
-    let actionsAdded = 0;
-    for (const action of connector.actions) {
-      const missing2 = action.requiredScopes.filter((scope) => !grantedScopes.has(scope));
-      if (connected && missing2.length > 0 && !input.includeMissingScopes) continue;
-      capabilities.push(toCapability(connector, action, connection));
-      actionsAdded += 1;
-    }
-    for (const trigger2 of connector.triggers ?? []) {
-      const missing2 = trigger2.requiredScopes.filter((scope) => !grantedScopes.has(scope));
-      if (connected && missing2.length > 0 && !input.includeMissingScopes) continue;
-      triggers.push(toTrigger2(connector, trigger2, connection));
-    }
-    countsByConnector[connector.id] = actionsAdded;
-    if (connected && actionsAdded === 0 && connector.actions.length > 0) {
-      unreachableConnectors.push({
-        connectorId: connector.id,
-        reason: "all_actions_missing_scope"
-      });
-    }
-  }
-  return { capabilities, triggers, countsByConnector, unreachableConnectors };
-}
-async function resolveConnections(input) {
-  if (input.connections) return input.connections;
-  if (input.store) return await input.store.listByOwner(input.owner);
-  throw new Error("discoverWorkspaceCapabilities: provide either connections or store");
-}
-async function resolveConnectors(input) {
-  if (input.connectors) return input.connectors;
-  if (input.providers) {
-    const lists = await Promise.all(input.providers.map((p) => Promise.resolve(p.listConnectors())));
-    return lists.flat();
-  }
-  throw new Error("discoverWorkspaceCapabilities: provide either connectors or providers");
-}
-function toCapability(connector, action, connection) {
-  return {
-    id: `${connector.id}.${action.id}`,
-    title: action.title,
-    description: action.description,
-    category: connector.category,
-    connectorId: connector.id,
-    providerId: connector.providerId,
-    actionId: action.id,
-    scopes: action.requiredScopes,
-    risk: action.risk,
-    dataClass: action.dataClass,
-    toolSchema: {
-      name: `${connector.id}.${action.id}`,
-      description: action.description,
-      inputSchema: action.inputSchema,
-      outputSchema: action.outputSchema
-    },
-    connected: Boolean(connection),
-    connectionId: connection?.id,
-    approvalRequired: action.approvalRequired
-  };
-}
-function toTrigger2(connector, trigger2, connection) {
-  return {
-    id: `${connector.id}.${trigger2.id}`,
-    title: trigger2.title,
-    description: trigger2.description,
-    category: connector.category,
-    connectorId: connector.id,
-    providerId: connector.providerId,
-    triggerId: trigger2.id,
-    scopes: trigger2.requiredScopes,
-    dataClass: trigger2.dataClass,
-    connected: Boolean(connection),
-    connectionId: connection?.id
-  };
-}
-function filterDiscoveryByWorkspaceScopes(discovery, workspaceScopes, opts = {}) {
-  if (workspaceScopes.length === 0 && !opts.denyByDefault) return discovery;
-  const granted = new Set(workspaceScopes);
-  const hasWildcard = granted.has("tangle:*");
-  function allowed(connectorId, scopes) {
-    if (hasWildcard) return true;
-    if (granted.has(`${connectorId}:*`)) return true;
-    for (const scope of scopes) {
-      if (!granted.has(scope)) return false;
-    }
-    return true;
-  }
-  const capabilities = discovery.capabilities.filter((cap) => allowed(cap.connectorId, cap.scopes));
-  const triggers = discovery.triggers.filter((t) => allowed(t.connectorId, t.scopes));
-  const countsByConnector = {};
-  for (const cap of capabilities) {
-    countsByConnector[cap.connectorId] = (countsByConnector[cap.connectorId] ?? 0) + 1;
-  }
-  return {
-    capabilities,
-    triggers,
-    countsByConnector,
-    unreachableConnectors: discovery.unreachableConnectors
-  };
-}
-
-// src/events.ts
-var InMemoryIntegrationEventStore = class {
-  events = /* @__PURE__ */ new Map();
-  providerIds = /* @__PURE__ */ new Set();
-  put(event) {
-    this.events.set(event.id, event);
-    if (event.providerEventId) this.providerIds.add(providerKey(event.sourceId, event.providerEventId));
-  }
-  hasProviderEvent(sourceId, providerEventId) {
-    return this.providerIds.has(providerKey(sourceId, providerEventId));
-  }
-  list() {
-    return [...this.events.values()];
-  }
-};
-async function receiveIntegrationWebhook(input) {
-  if (!input.adapter.handleInboundEvent) {
-    return { status: 405, body: { ok: false, error: "Connector does not support inbound webhooks." }, received: [], duplicates: [] };
-  }
-  if (!input.adapter.verifySignature && !input.allowUnsignedWebhook) {
-    return { status: 401, body: { ok: false, error: "Webhook signature verification is required." }, received: [], duplicates: [] };
-  }
-  const signature = input.adapter.verifySignature?.({
-    rawBody: input.rawBody,
-    headers: input.headers,
-    source: input.source
-  });
-  if (signature && !signature.valid) {
-    return { status: 401, body: { ok: false, error: signature.reason ?? "Invalid webhook signature." }, received: [], duplicates: [] };
-  }
-  const handled = await input.adapter.handleInboundEvent({
-    source: input.source,
-    rawBody: input.rawBody,
-    headers: input.headers
-  });
-  const received = [];
-  const duplicates = [];
-  for (const inbound of handled.events) {
-    const event = storedEvent(input.source, inbound, input.now ?? (() => /* @__PURE__ */ new Date()));
-    if (event.providerEventId && await input.store.hasProviderEvent(event.sourceId, event.providerEventId)) {
-      duplicates.push(event);
-      continue;
-    }
-    await input.store.put(event);
-    received.push(event);
-    await dispatchStoredEvent(event, input.source, input.workflowRuntime);
-  }
-  return {
-    status: handled.response?.status ?? 200,
-    body: handled.response?.body ?? { received: true, count: received.length, duplicateCount: duplicates.length },
-    headers: handled.response?.headers,
-    received,
-    duplicates
-  };
-}
-function storedEventToTriggerEvent(event, source) {
-  return {
-    id: event.id,
-    providerId: String(source.metadata.providerId ?? "first-party"),
-    connectorId: event.connectorId,
-    connectionId: source.id,
-    trigger: event.eventType,
-    occurredAt: event.receivedAt,
-    payload: event.payload,
-    metadata: {
-      providerEventId: event.providerEventId,
-      sourceId: event.sourceId,
-      ...event.metadata
-    }
-  };
-}
-async function dispatchStoredEvent(event, source, workflowRuntime) {
-  if (!workflowRuntime) return;
-  await workflowRuntime.dispatchEvent(storedEventToTriggerEvent(event, source), () => void 0);
-}
-function storedEvent(source, event, now) {
-  return {
-    id: `evt_${source.id}_${event.providerEventId ?? `${event.eventType}_${now().getTime()}`}`,
-    sourceId: source.id,
-    connectorId: source.kind,
-    eventType: event.eventType,
-    providerEventId: event.providerEventId,
-    receivedAt: now().toISOString(),
-    payload: event.payload
-  };
-}
-function providerKey(sourceId, providerEventId) {
-  return `${sourceId}:${providerEventId}`;
-}
-
-// src/guard.ts
-import { createHash as createHash2 } from "crypto";
-var InMemoryIntegrationIdempotencyStore = class {
-  records = /* @__PURE__ */ new Map();
-  get(key) {
-    return this.records.get(key);
-  }
-  put(record) {
-    this.records.set(record.key, record);
-  }
-};
-var DefaultIntegrationActionGuard = class {
-  idempotency;
-  audit;
-  rateLimiter;
-  requireIdempotencyForMutations;
-  now;
-  constructor(options = {}) {
-    this.idempotency = options.idempotency;
-    this.audit = options.audit;
-    this.rateLimiter = options.rateLimiter;
-    this.requireIdempotencyForMutations = options.requireIdempotencyForMutations ?? false;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  async invokeAction(ctx, proceed) {
-    const idempotencyKey = ctx.request.idempotencyKey;
-    const requestHash = hashRequest(ctx);
-    if (this.requireIdempotencyForMutations && ctx.action?.risk !== "read" && !idempotencyKey) {
-      return {
-        ok: false,
-        action: ctx.request.action,
-        output: {
-          idempotencyRequired: true,
-          message: "State-changing integration actions require an idempotency key."
-        }
-      };
-    }
-    if (idempotencyKey && this.idempotency) {
-      const existing = await this.idempotency.get(idempotencyKey);
-      if (existing) {
-        if (existing.requestHash !== requestHash) {
-          return {
-            ok: false,
-            action: ctx.request.action,
-            output: { idempotencyConflict: true, message: "Idempotency key was reused with different integration input." }
-          };
-        }
-        return {
-          ...existing.result,
-          metadata: { ...existing.result.metadata ?? {}, idempotentReplay: true }
-        };
-      }
-    }
-    if (ctx.request.dryRun && ctx.action?.risk !== "read") {
-      const result = {
-        ok: true,
-        action: ctx.request.action,
-        output: { dryRun: true },
-        metadata: { dryRun: true }
-      };
-      await this.writeIdempotency(idempotencyKey, requestHash, result);
-      return result;
-    }
-    const rateLimit = await this.rateLimiter?.check(ctx);
-    if (rateLimit && !rateLimit.allowed) {
-      return {
-        ok: false,
-        action: ctx.request.action,
-        output: { rateLimited: true, retryAfterMs: rateLimit.retryAfterMs, message: rateLimit.reason ?? "Integration rate limit exceeded." }
-      };
-    }
-    try {
-      const result = await proceed();
-      if (result.ok) {
-        await this.writeIdempotency(idempotencyKey, requestHash, result);
-      }
-      await this.audit?.record(createIntegrationAuditEvent({
-        type: result.ok ? "action.invoked" : "action.failed",
-        actor: ctx.connection.owner,
-        connectionId: ctx.connection.id,
-        providerId: ctx.connection.providerId,
-        connectorId: ctx.connection.connectorId,
-        action: ctx.request.action,
-        risk: ctx.action?.risk,
-        dataClass: ctx.action?.dataClass,
-        ok: result.ok,
-        metadata: { idempotencyKey, externalId: result.externalId, warnings: result.warnings },
-        now: this.now
-      }));
-      return result;
-    } catch (error) {
-      await this.audit?.record(createIntegrationAuditEvent({
-        type: "action.failed",
-        actor: ctx.connection.owner,
-        connectionId: ctx.connection.id,
-        providerId: ctx.connection.providerId,
-        connectorId: ctx.connection.connectorId,
-        action: ctx.request.action,
-        risk: ctx.action?.risk,
-        dataClass: ctx.action?.dataClass,
-        ok: false,
-        message: error instanceof Error ? error.message : "Integration action failed.",
-        metadata: { idempotencyKey },
-        now: this.now
-      }));
-      throw error;
-    }
-  }
-  async writeIdempotency(key, requestHash, result) {
-    if (!key || !this.idempotency) return;
-    await this.idempotency.put({
-      key,
-      requestHash,
-      result,
-      createdAt: this.now().toISOString()
-    });
-  }
-};
-function createDefaultIntegrationActionGuard(options = {}) {
-  return new DefaultIntegrationActionGuard(options);
-}
-function hashRequest(ctx) {
-  return createHash2("sha256").update(JSON.stringify({
-    connectionId: ctx.connection.id,
-    action: ctx.request.action,
-    input: ctx.request.input ?? null,
-    dryRun: ctx.request.dryRun ?? false
-  })).digest("base64url");
-}
-
-// src/healthcheck.ts
-var InMemoryIntegrationHealthcheckStore = class {
-  results = /* @__PURE__ */ new Map();
-  put(result) {
-    this.results.set(result.connectionId, result);
-  }
-  get(connectionId) {
-    return this.results.get(connectionId);
-  }
-  list() {
-    return [...this.results.values()];
-  }
-};
-async function runIntegrationHealthcheck(input) {
-  const now = input.now ?? (() => /* @__PURE__ */ new Date());
-  const checkedAt = now().toISOString();
-  const connector = input.connector ?? input.registry?.byId.get(input.connection.connectorId)?.connector;
-  const checks = [];
-  checks.push(connectionStatusCheck(input.connection, now));
-  if (!connector) {
-    checks.push({ id: "connector-known", status: "unknown", message: `Connector ${input.connection.connectorId} is not in the registry.` });
-  } else {
-    checks.push(connectorExecutableCheck(connector));
-    checks.push(scopeShapeCheck(input.connection, connector));
-    if (input.test && input.connection.status === "active") {
-      checks.push(await liveHealthcheck(input.connection, connector, input.test));
-    }
-  }
-  const result = {
-    connectionId: input.connection.id,
-    providerId: input.connection.providerId,
-    connectorId: input.connection.connectorId,
-    status: rollupHealthStatus(checks),
-    checkedAt,
-    checks
-  };
-  await input.audit?.record(createIntegrationAuditEvent({
-    type: "healthcheck.completed",
-    actor: input.connection.owner,
-    connectionId: input.connection.id,
-    providerId: input.connection.providerId,
-    connectorId: input.connection.connectorId,
-    ok: result.status === "healthy",
-    message: result.status,
-    metadata: { checks: checks.map((check) => ({ id: check.id, status: check.status, message: check.message })) },
-    occurredAt: checkedAt
-  }));
-  return result;
-}
-async function runIntegrationHealthchecks(input) {
-  const results = [];
-  for (const connection of input.connections) {
-    const result = await runIntegrationHealthcheck({
-      connection,
-      registry: input.registry,
-      test: input.test,
-      audit: input.audit,
-      now: input.now
-    });
-    await input.store?.put(result);
-    results.push(result);
-  }
-  return results;
-}
-function healthcheckRequest(action = "healthcheck") {
-  return {
-    connectionId: "__healthcheck__",
-    action,
-    input: {},
-    dryRun: true,
-    metadata: { healthcheck: true }
-  };
-}
-function connectionStatusCheck(connection, now) {
-  if (connection.status !== "active") {
-    return { id: "connection-active", status: "unhealthy", message: `Connection is ${connection.status}.` };
-  }
-  if (connection.expiresAt && Date.parse(connection.expiresAt) <= now().getTime()) {
-    return { id: "connection-active", status: "unhealthy", message: "Connection credentials are expired." };
-  }
-  return { id: "connection-active", status: "healthy", message: "Connection is active." };
-}
-function connectorExecutableCheck(connector) {
-  const executable = connector.actions.length > 0 || (connector.triggers?.length ?? 0) > 0;
-  if (!executable) {
-    return { id: "connector-executable", status: "degraded", message: `${connector.title} is catalog-only.` };
-  }
-  return { id: "connector-executable", status: "healthy", message: `${connector.title} has executable actions or triggers.` };
-}
-function scopeShapeCheck(connection, connector) {
-  const declaredScopes = new Set(connector.scopes);
-  const undeclared = connection.grantedScopes.filter((scope) => !declaredScopes.has(scope));
-  if (connector.scopes.length === 0 && connection.grantedScopes.length > 0) {
-    return { id: "scope-shape", status: "unknown", message: "Connector does not declare a scope catalog.", metadata: { grantedScopes: connection.grantedScopes } };
-  }
-  if (undeclared.length > 0) {
-    return { id: "scope-shape", status: "degraded", message: "Connection has scopes not declared by the connector.", metadata: { undeclared } };
-  }
-  return { id: "scope-shape", status: "healthy", message: "Granted scopes match the connector shape." };
-}
-async function liveHealthcheck(connection, connector, test) {
-  try {
-    const result = await test(connection, connector);
-    const ok = typeof result === "boolean" ? result : result.ok;
-    return {
-      id: "provider-live-test",
-      status: ok ? "healthy" : "unhealthy",
-      message: ok ? "Provider live test passed." : "Provider live test failed.",
-      metadata: typeof result === "boolean" ? void 0 : { action: result.action, warnings: result.warnings }
-    };
-  } catch (error) {
-    return {
-      id: "provider-live-test",
-      status: "unhealthy",
-      message: error instanceof Error ? error.message : "Provider live test failed."
-    };
-  }
-}
-function rollupHealthStatus(checks) {
-  if (checks.some((check) => check.status === "unhealthy")) return "unhealthy";
-  if (checks.some((check) => check.status === "degraded")) return "degraded";
-  if (checks.some((check) => check.status === "unknown")) return "unknown";
-  return "healthy";
-}
-
-// src/manifest.ts
-function validateIntegrationManifest(manifest) {
-  const issues = [];
-  if (!manifest.id?.trim()) issues.push({ path: "id", message: "Manifest id is required." });
-  if (!Array.isArray(manifest.requirements)) issues.push({ path: "requirements", message: "Requirements must be an array." });
-  const ids = /* @__PURE__ */ new Set();
-  for (const [index, requirement] of (manifest.requirements ?? []).entries()) {
-    const path = `requirements[${index}]`;
-    if (!requirement.id?.trim()) issues.push({ path: `${path}.id`, message: "Requirement id is required." });
-    if (ids.has(requirement.id)) issues.push({ path: `${path}.id`, message: `Duplicate requirement id ${requirement.id}.` });
-    ids.add(requirement.id);
-    if (!requirement.connectorId?.trim()) issues.push({ path: `${path}.connectorId`, message: "Connector id is required." });
-    if (!["read", "write", "trigger"].includes(requirement.mode)) issues.push({ path: `${path}.mode`, message: "Mode must be read, write, or trigger." });
-    if (!requirement.reason?.trim()) issues.push({ path: `${path}.reason`, message: "Human-readable reason is required." });
-    if (requirement.mode !== "trigger" && !requirement.requiredActions?.length) {
-      issues.push({ path: `${path}.requiredActions`, message: "Non-trigger requirements should list required actions." });
-    }
-    if (requirement.mode === "trigger" && !requirement.requiredTriggers?.length) {
-      issues.push({ path: `${path}.requiredTriggers`, message: "Trigger requirements should list required triggers." });
-    }
-  }
-  return { ok: issues.length === 0, issues };
-}
-function assertValidIntegrationManifest(manifest) {
-  const result = validateIntegrationManifest(manifest);
-  if (!result.ok) {
-    throw new Error(`Invalid integration manifest: ${result.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
-  }
-}
-function inferIntegrationManifestFromTools(options) {
-  const byConnector = /* @__PURE__ */ new Map();
-  for (const item of options.tools) {
-    const action = typeof item === "string" ? item : item.action;
-    const connectorId = typeof item === "string" ? canonicalActionConnectorId(action) : item.connectorId ?? canonicalActionConnectorId(action);
-    if (!connectorId) continue;
-    const mode = typeof item === "string" ? inferMode(action) : item.mode ?? inferMode(action);
-    const id = `${connectorId}-${mode}`;
-    const existing = byConnector.get(id);
-    const reason = typeof item === "string" ? defaultReason(connectorId, mode) : item.reason ?? defaultReason(connectorId, mode);
-    if (existing) {
-      byConnector.set(id, {
-        ...existing,
-        requiredActions: unique2([...existing.requiredActions ?? [], action]),
-        requiredScopes: unique2([...existing.requiredScopes ?? [], ...typeof item === "string" ? [] : item.scopes ?? []])
-      });
-    } else {
-      byConnector.set(id, {
-        id,
-        connectorId,
-        mode,
-        reason,
-        requiredActions: mode === "trigger" ? void 0 : [action],
-        requiredScopes: typeof item === "string" ? void 0 : item.scopes
-      });
-    }
-  }
-  const manifest = {
-    id: options.manifestId,
-    title: options.title,
-    requirements: [...byConnector.values()],
-    metadata: options.metadata
-  };
-  assertValidIntegrationManifest(manifest);
-  return manifest;
-}
-function explainMissingRequirements(resolution) {
-  return [...resolution.missing, ...resolution.optionalMissing].map((item) => ({
-    requirementId: item.requirement.id,
-    connectorId: item.requirement.connectorId,
-    status: item.status,
-    message: item.message,
-    userAction: item.requirement.optional ? "ignore_optional" : item.status === "not_executable" ? "enable" : "connect"
-  }));
-}
-function calendarExercisePlannerManifest(id = "exercise-calendar-planner") {
-  return {
-    id,
-    title: "Exercise Calendar Planner",
-    requirements: [{
-      id: "calendar-read",
-      connectorId: "google-calendar",
-      mode: "read",
-      reason: "Read busy and free calendar windows to recommend exercise sessions.",
-      requiredActions: [CANONICAL_INTEGRATION_ACTIONS.googleCalendarEventsList],
-      requiredScopes: ["https://www.googleapis.com/auth/calendar.readonly"]
-    }]
-  };
-}
-function inferMode(action) {
-  if (/(create|send|post|update|delete|write|comment|request)$/i.test(action)) return "write";
-  return "read";
-}
-function defaultReason(connectorId, mode) {
-  if (connectorId === "google-calendar" && mode === "read") return "Read calendar availability for the generated app.";
-  if (connectorId === "google-calendar" && mode === "write") return "Create or update calendar events after user approval.";
-  return `${mode === "read" ? "Read from" : mode === "write" ? "Write to" : "Subscribe to"} ${connectorId} for this app.`;
-}
-function unique2(values) {
-  return [...new Set(values)];
-}
-
-// src/passthrough.ts
-var PROVIDER_PASSTHROUGH_ACTION = CANONICAL_INTEGRATION_ACTIONS.providerHttpRequest;
-function validateProviderPassthroughRequest(input, policy) {
-  if (!policy.enabled) {
-    throw new IntegrationRuntimeError({
-      code: "passthrough_disabled",
-      message: "Provider-native passthrough is disabled for this connector."
-    });
-  }
-  if (!input.path.startsWith("/")) {
-    throw new IntegrationRuntimeError({ code: "input_invalid", message: "Provider passthrough path must start with /." });
-  }
-  if (policy.allowedMethods?.length && !policy.allowedMethods.includes(input.method)) {
-    throw new IntegrationRuntimeError({ code: "action_denied", message: `Provider passthrough method ${input.method} is not allowed.` });
-  }
-  if (policy.allowedPathPrefixes?.length && !policy.allowedPathPrefixes.some((prefix) => input.path.startsWith(prefix))) {
-    throw new IntegrationRuntimeError({ code: "action_denied", message: `Provider passthrough path ${input.path} is not allowed.` });
-  }
-  const maxBodyBytes = policy.maxBodyBytes ?? 64 * 1024;
-  const bodyBytes = Buffer.byteLength(JSON.stringify(input.body ?? null), "utf8");
-  if (bodyBytes > maxBodyBytes) {
-    throw new IntegrationRuntimeError({ code: "input_invalid", message: `Provider passthrough body exceeds ${maxBodyBytes} bytes.` });
-  }
-  for (const key of Object.keys(input.headers ?? {})) {
-    if (/authorization|cookie|token|secret|api[_-]?key/i.test(key)) {
-      throw new IntegrationRuntimeError({ code: "input_invalid", message: `Provider passthrough header ${key} is not caller-settable.` });
-    }
-  }
-}
-
-// src/policy.ts
-import { randomUUID as randomUUID2 } from "crypto";
-var StaticIntegrationPolicyEngine = class {
-  rules;
-  defaultReadEffect;
-  defaultWriteEffect;
-  defaultDestructiveEffect;
-  now;
-  constructor(options = {}) {
-    this.rules = options.rules ?? [];
-    this.defaultReadEffect = options.defaultReadEffect ?? "allow";
-    this.defaultWriteEffect = options.defaultWriteEffect ?? "require_approval";
-    this.defaultDestructiveEffect = options.defaultDestructiveEffect ?? "deny";
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  decide(ctx) {
-    const action = ctx.action;
-    if (!action) return { decision: "deny", reason: "Integration action is missing from connector catalog." };
-    const matched = this.rules.find((rule) => ruleMatches(rule, ctx));
-    const effect = matched?.effect ?? this.defaultEffect(action.risk);
-    const reason = matched?.reason ?? defaultReason2(effect, action.risk);
-    if (effect === "allow") return { decision: "allow", reason, metadata: matched ? { ruleId: matched.id } : void 0 };
-    if (effect === "deny") return { decision: "deny", reason, metadata: matched ? { ruleId: matched.id } : void 0 };
-    return {
-      decision: "require_approval",
-      reason,
-      approval: buildApprovalRequest(ctx, reason, this.now()),
-      metadata: matched ? { ruleId: matched.id } : void 0
-    };
-  }
-  defaultEffect(risk) {
-    if (risk === "read") return this.defaultReadEffect;
-    if (risk === "write") return this.defaultWriteEffect;
-    return this.defaultDestructiveEffect;
-  }
-};
-function createDefaultIntegrationPolicyEngine(options = {}) {
-  return new StaticIntegrationPolicyEngine(options);
-}
-function buildApprovalRequest(ctx, reason, requestedAt) {
-  if (!ctx.action) {
-    throw new Error("Cannot build approval request without an action descriptor.");
-  }
-  return {
-    id: `approval_${randomUUID2()}`,
-    connectionId: ctx.connection.id,
-    providerId: ctx.connection.providerId,
-    connectorId: ctx.connection.connectorId,
-    action: ctx.request.action,
-    actor: { type: ctx.subject.type, id: ctx.subject.id },
-    risk: ctx.action.risk,
-    dataClass: ctx.action.dataClass,
-    reason,
-    requestedAt: requestedAt.toISOString(),
-    inputPreview: previewInput(ctx.request.input)
-  };
-}
-function redactApprovalRequest(request) {
-  return {
-    ...request,
-    inputPreview: redactUnknown2(request.inputPreview)
-  };
-}
-function ruleMatches(rule, ctx) {
-  if (!ctx.action) return false;
-  if (rule.providerId && rule.providerId !== ctx.connection.providerId) return false;
-  if (rule.connectorId && rule.connectorId !== ctx.connection.connectorId) return false;
-  if (rule.action && rule.action !== ctx.request.action) return false;
-  if (rule.risk && rule.risk !== ctx.action.risk) return false;
-  if (rule.maxRisk && riskRank(ctx.action.risk) > riskRank(rule.maxRisk)) return false;
-  if (rule.dataClass && rule.dataClass !== ctx.action.dataClass) return false;
-  return true;
-}
-function riskRank(risk) {
-  if (risk === "read") return 0;
-  if (risk === "write") return 1;
-  return 2;
-}
-function defaultReason2(effect, risk) {
-  if (effect === "allow") return `${risk} integration action allowed by default policy.`;
-  if (effect === "deny") return `${risk} integration action denied by default policy.`;
-  return `${risk} integration action requires approval by default policy.`;
-}
-function previewInput(input) {
-  return redactUnknown2(input);
-}
-function redactUnknown2(value) {
-  if (Array.isArray(value)) return value.map(redactUnknown2);
-  if (!value || typeof value !== "object") return value;
-  const out = {};
-  for (const [key, child] of Object.entries(value)) {
-    if (/token|secret|password|authorization|api[_-]?key|credential/i.test(key)) {
-      out[key] = "[REDACTED]";
-    } else {
-      out[key] = redactUnknown2(child);
-    }
-  }
-  return out;
-}
-
-// src/presets.ts
-function createPlatformIntegrationPolicyPreset(options = {}) {
-  return new StaticIntegrationPolicyEngine({
-    ...options,
-    defaultReadEffect: "allow",
-    defaultWriteEffect: options.allowWritesWithoutApproval ? "allow" : "require_approval",
-    defaultDestructiveEffect: options.allowDestructiveActions ? "require_approval" : "deny",
-    rules: [
-      ...options.allowProviderPassthrough ? [] : [{
-        id: "deny-provider-native-passthrough",
-        action: "provider.http.request",
-        effect: "deny",
-        reason: "Provider-native passthrough is disabled by default. Promote the connector action or enable passthrough explicitly."
-      }],
-      ...options.rules ?? []
-    ]
-  });
-}
-
-// src/sandbox.ts
-function buildIntegrationInvocationEnvelope(input) {
-  const parsed = parseIntegrationToolName(input.toolName);
-  const envelope = {
-    kind: "integration.invocation",
-    capabilityToken: input.capabilityToken,
-    toolName: input.toolName,
-    action: parsed.actionId,
-    input: input.args,
-    idempotencyKey: input.idempotencyKey,
-    dryRun: input.dryRun,
-    metadata: input.metadata
-  };
-  validateIntegrationInvocationEnvelope(envelope);
-  return envelope;
-}
-function invocationRequestFromEnvelope(envelope) {
-  validateIntegrationInvocationEnvelope(envelope);
-  return {
-    action: envelope.action,
-    input: envelope.input,
-    idempotencyKey: envelope.idempotencyKey,
-    dryRun: envelope.dryRun,
-    metadata: envelope.metadata
-  };
-}
-function validateIntegrationInvocationEnvelope(envelope, options = {}) {
-  if (!envelope || typeof envelope !== "object") throw new Error("Integration invocation envelope is required.");
-  if (envelope.kind !== "integration.invocation") throw new Error("Invalid integration invocation envelope kind.");
-  if (!isNonEmptyString(envelope.capabilityToken)) throw new Error("Integration invocation envelope is missing capabilityToken.");
-  if (!isNonEmptyString(envelope.toolName)) throw new Error("Integration invocation envelope is missing toolName.");
-  if (!isNonEmptyString(envelope.action)) throw new Error("Integration invocation envelope is missing action.");
-  if (!isNonEmptyString(envelope.idempotencyKey)) throw new Error("Integration invocation envelope is missing idempotencyKey.");
-  if (envelope.metadata !== void 0 && !isPlainRecord(envelope.metadata)) {
-    throw new Error("Integration invocation envelope metadata must be an object.");
-  }
-  const parsed = parseIntegrationToolName(envelope.toolName);
-  if (parsed.actionId !== envelope.action) {
-    throw new Error(`Integration invocation action ${envelope.action} does not match tool ${parsed.actionId}.`);
-  }
-  const inputBytes = Buffer.byteLength(JSON.stringify(envelope.input ?? null), "utf8");
-  const maxInputBytes = options.maxInputBytes ?? 256 * 1024;
-  if (inputBytes > maxInputBytes) {
-    throw new Error(`Integration invocation input exceeds ${maxInputBytes} bytes.`);
-  }
-  if (options.requireKnownTool || options.connectors) {
-    if (!options.connectors) throw new Error("connectors are required when requireKnownTool is true.");
-    const connector = options.connectors.find(
-      (candidate) => candidate.providerId === parsed.providerId && candidate.id === parsed.connectorId
-    );
-    const action = connector?.actions.find((candidate) => candidate.id === parsed.actionId);
-    if (!connector || !action) throw new Error(`Unknown integration tool ${envelope.toolName}.`);
-  }
-}
-function redactInvocationEnvelope(envelope) {
-  return {
-    ...envelope,
-    capabilityToken: "[REDACTED]",
-    input: redactUnknown3(envelope.input)
-  };
-}
-function redactCapability(capability) {
-  return {
-    ...capability,
-    metadata: redactUnknown3(capability.metadata)
-  };
-}
-function normalizeIntegrationResult(result) {
-  const output = result.output;
-  if (!result.ok && output?.approvalRequired === true && output.approval) {
-    return {
-      status: "approval_required",
-      action: result.action,
-      approval: output.approval,
-      metadata: result.metadata
-    };
-  }
-  if (!result.ok) {
-    return {
-      status: "failed",
-      action: result.action,
-      error: String(result.output ?? result.warnings?.[0] ?? "integration action failed"),
-      metadata: result.metadata
-    };
-  }
-  return {
-    status: "ok",
-    action: result.action,
-    output: result.output,
-    metadata: result.metadata
-  };
-}
-async function dispatchIntegrationInvocation(envelope, options) {
-  try {
-    validateIntegrationInvocationEnvelope(envelope, options);
-    const result = await options.hub.invokeWithCapability(
-      envelope.capabilityToken,
-      invocationRequestFromEnvelope(envelope)
-    );
-    return normalizeIntegrationResult(result);
-  } catch (error) {
-    return {
-      status: "failed",
-      action: typeof envelope?.action === "string" ? envelope.action : "unknown",
-      error: error instanceof Error ? error.message : "Integration invocation failed."
-    };
-  }
-}
-var IntegrationSandboxHost = class {
-  options;
-  constructor(options) {
-    this.options = options;
-  }
-  dispatch(envelope) {
-    return dispatchIntegrationInvocation(envelope, this.options);
-  }
-};
-function redactUnknown3(value) {
-  if (Array.isArray(value)) return value.map(redactUnknown3);
-  if (!value || typeof value !== "object") return value;
-  const out = {};
-  for (const [key, child] of Object.entries(value)) {
-    if (/token|secret|password|authorization|api[_-]?key|credential/i.test(key)) {
-      out[key] = "[REDACTED]";
-    } else {
-      out[key] = redactUnknown3(child);
-    }
-  }
-  return out;
-}
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-function isPlainRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-// src/importers.ts
-var HTTP_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete"]);
-function importOpenApiConnector(document, options) {
-  const actions = [];
-  for (const [path, methods] of Object.entries(document.paths ?? {})) {
-    for (const [method, rawOperation] of Object.entries(methods)) {
-      const normalizedMethod = method.toLowerCase();
-      if (!HTTP_METHODS.has(normalizedMethod) || !isObject(rawOperation)) continue;
-      const operation = rawOperation;
-      const operationId = operation.operationId ?? `${normalizedMethod}_${path.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "")}`;
-      actions.push({
-        id: operationId,
-        title: operation.summary ?? titleFromId(operationId),
-        risk: riskFromHttpMethod(normalizedMethod, operation, options.defaultRisk),
-        requiredScopes: scopesFromOpenApiOperation(operation, options.scopes ?? []),
-        dataClass: options.dataClass ?? "private",
-        description: operation.description ?? operation.summary ?? `${normalizedMethod.toUpperCase()} ${path}`,
-        approvalRequired: riskFromHttpMethod(normalizedMethod, operation, options.defaultRisk) !== "read",
-        inputSchema: openApiInputSchema(path, normalizedMethod, operation),
-        outputSchema: operation.responses
-      });
-    }
-  }
-  return connectorFromActions(options, actions);
-}
-function importGraphqlConnector(operations, options) {
-  return connectorFromActions(options, operations.map((operation) => ({
-    id: operation.name,
-    title: titleFromId(operation.name),
-    risk: operation.kind === "query" ? "read" : options.defaultRisk ?? "write",
-    requiredScopes: operation.requiredScopes ?? options.scopes ?? [],
-    dataClass: options.dataClass ?? "private",
-    description: operation.description,
-    approvalRequired: operation.kind === "mutation",
-    inputSchema: operation.inputSchema,
-    outputSchema: operation.outputSchema
-  })));
-}
-function importMcpConnector(catalog, options) {
-  return connectorFromActions(options, catalog.tools.map((tool) => {
-    const risk = riskFromMcpTool(tool, options.defaultRisk);
-    return {
-      id: tool.name,
-      title: tool.annotations?.title ?? titleFromId(tool.name),
-      risk,
-      requiredScopes: options.scopes ?? [],
-      dataClass: options.dataClass ?? "private",
-      description: tool.description,
-      approvalRequired: risk !== "read",
-      inputSchema: tool.inputSchema
-    };
-  }));
-}
-function connectorFromActions(options, actions) {
-  const scopes = unique3([
-    ...options.scopes ?? [],
-    ...actions.flatMap((action) => action.requiredScopes)
-  ]);
-  return {
-    id: options.connectorId,
-    providerId: options.providerId,
-    title: options.connectorTitle,
-    category: options.category ?? "other",
-    auth: options.auth ?? "custom",
-    scopes,
-    actions,
-    metadata: { source: "catalog-importer" }
-  };
-}
-function riskFromHttpMethod(method, operation, fallback) {
-  if (method === "get") return "read";
-  if (method === "delete") return "destructive";
-  const text = `${operation.operationId ?? ""} ${operation.summary ?? ""} ${operation.description ?? ""}`.toLowerCase();
-  if (/\b(delete|remove|destroy|cancel|void|revoke|drop)\b/.test(text)) return "destructive";
-  return fallback && fallback !== "read" ? fallback : "write";
-}
-function riskFromMcpTool(tool, fallback) {
-  if (tool.annotations?.destructiveHint) return "destructive";
-  if (tool.annotations?.readOnlyHint) return "read";
-  const text = `${tool.name} ${tool.description ?? ""}`.toLowerCase();
-  if (/\b(delete|remove|destroy|cancel|void|revoke|drop)\b/.test(text)) return "destructive";
-  if (/\b(get|list|read|search|find|fetch|query)\b/.test(text)) return "read";
-  return fallback ?? "write";
-}
-function scopesFromOpenApiOperation(operation, fallback) {
-  const scopes = (operation.security ?? []).flatMap((entry) => Object.values(entry).flat());
-  return unique3(scopes.length > 0 ? scopes : fallback);
-}
-function openApiInputSchema(path, method, operation) {
-  return {
-    type: "object",
-    additionalProperties: true,
-    properties: {
-      path: { const: path },
-      method: { const: method.toUpperCase() },
-      parameters: { type: "object", additionalProperties: true },
-      body: operation.requestBody ?? { type: "object", additionalProperties: true }
-    }
-  };
-}
-function titleFromId(id) {
-  return id.replace(/([a-z])([A-Z])/g, "$1 $2").split(/[^a-zA-Z0-9]+/g).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
-}
-function isObject(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function unique3(values) {
-  return [...new Set(values)];
-}
-
-// src/gateway-catalog.ts
-function createGatewayCatalogProvider(options) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  let cachedAt = 0;
-  let cached;
-  async function listConnectors() {
-    const ttl = options.cacheTtlMs ?? 6e4;
-    const current = now().getTime();
-    if (cached && current - cachedAt < ttl) return cached;
-    const entries = await options.fetchCatalog();
-    cached = normalizeGatewayCatalog(entries, {
-      providerId: options.id,
-      providerKind: options.kind
-    });
-    cachedAt = current;
-    return cached;
-  }
-  return {
-    id: options.id,
-    kind: options.kind,
-    listConnectors,
-    startAuth: options.startAuth,
-    completeAuth: options.completeAuth,
-    async invokeAction(connection, request) {
-      if (!options.invokeAction) {
-        throw new IntegrationError(`Gateway provider ${options.id} does not implement action invocation.`, "action_not_found");
-      }
-      await assertKnownGatewayAction(await listConnectors(), connection.connectorId, request.action);
-      return options.invokeAction(connection, request);
-    }
-  };
-}
-function normalizeGatewayCatalog(entries, options) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    const id = slug(entry.id ?? entry.key ?? entry.name ?? entry.title ?? "");
-    if (!id || seen.has(id)) continue;
-    seen.add(id);
-    const title = entry.title ?? entry.name ?? titleFromId2(id);
-    const actions = normalizeActions(entry.actions ?? [], entry.scopes ?? []);
-    out.push({
-      id,
-      providerId: options.providerId,
-      title,
-      category: normalizeCategory(entry.category),
-      auth: normalizeAuth(entry.auth),
-      scopes: unique4([
-        ...entry.scopes ?? [],
-        ...actions.flatMap((action) => action.requiredScopes)
-      ]),
-      actions: actions.length > 0 ? actions : defaultActionsFor(entry.category, entry.scopes ?? []),
-      triggers: normalizeTriggers(entry.triggers ?? [], entry.scopes ?? []),
-      metadata: {
-        ...entry.metadata ?? {},
-        source: "gateway-catalog",
-        providerKind: options.providerKind,
-        executable: true
-      }
-    });
-  }
-  return out;
-}
-async function assertKnownGatewayAction(connectors, connectorId, actionId) {
-  const connector = connectors.find((candidate) => candidate.id === connectorId);
-  if (!connector) throw new IntegrationError(`Connector ${connectorId} not found.`, "connector_not_found");
-  if (!connector.actions.some((action) => action.id === actionId)) {
-    throw new IntegrationError(`Action ${actionId} is not defined by connector ${connectorId}.`, "action_not_found");
-  }
-}
-function normalizeActions(actions, fallbackScopes) {
-  return actions.map((action) => {
-    const id = slug(action.id ?? action.key ?? action.name ?? action.title ?? "");
-    return {
-      id,
-      title: action.title ?? action.name ?? titleFromId2(id),
-      risk: normalizeRisk(action.risk),
-      requiredScopes: unique4([
-        ...action.requiredScopes ?? [],
-        ...action.scopes ?? [],
-        ...action.requiredScopes?.length || action.scopes?.length ? [] : fallbackScopes
-      ]),
-      dataClass: normalizeDataClass(action.dataClass),
-      description: action.description,
-      approvalRequired: action.approvalRequired ?? normalizeRisk(action.risk) !== "read",
-      inputSchema: action.inputSchema,
-      outputSchema: action.outputSchema
-    };
-  }).filter((action) => action.id);
-}
-function normalizeTriggers(triggers, fallbackScopes) {
-  const normalized = triggers.map((trigger2) => {
-    const id = slug(trigger2.id ?? trigger2.key ?? trigger2.name ?? trigger2.title ?? "");
-    return {
-      id,
-      title: trigger2.title ?? trigger2.name ?? titleFromId2(id),
-      requiredScopes: unique4([
-        ...trigger2.requiredScopes ?? [],
-        ...trigger2.scopes ?? [],
-        ...trigger2.requiredScopes?.length || trigger2.scopes?.length ? [] : fallbackScopes
-      ]),
-      dataClass: normalizeDataClass(trigger2.dataClass),
-      description: trigger2.description,
-      payloadSchema: trigger2.payloadSchema
-    };
-  }).filter((trigger2) => trigger2.id);
-  return normalized.length > 0 ? normalized : void 0;
-}
-function defaultActionsFor(category, scopes) {
-  const readScope = scopes.find((scope) => scope.endsWith(".read")) ?? scopes[0];
-  const writeScope = scopes.find((scope) => scope.endsWith(".write")) ?? scopes[1] ?? readScope;
-  const requiredRead = readScope ? [readScope] : [];
-  const requiredWrite = writeScope ? [writeScope] : [];
-  const dataClass = normalizeDataClass(category === "finance" || category === "commerce" || category === "hr" ? "sensitive" : "private");
-  return [
-    {
-      id: "records.search",
-      title: "Search records",
-      risk: "read",
-      requiredScopes: requiredRead,
-      dataClass,
-      description: "Search provider records."
-    },
-    {
-      id: "records.read",
-      title: "Read record",
-      risk: "read",
-      requiredScopes: requiredRead,
-      dataClass,
-      description: "Read a provider record."
-    },
-    {
-      id: "records.upsert",
-      title: "Upsert record",
-      risk: "write",
-      requiredScopes: requiredWrite,
-      dataClass,
-      approvalRequired: true,
-      description: "Create or update a provider record."
-    }
-  ];
-}
-function normalizeCategory(category) {
-  const value = slug(category ?? "");
-  if (value === "mail") return "email";
-  if (value === "messaging" || value === "communication" || value === "communications") return "chat";
-  if (value === "file" || value === "files") return "storage";
-  if (value === "project-management" || value === "automation") return "workflow";
-  if (value === "developer" || value === "devops") return "workflow";
-  if (value === "support") return "crm";
-  if ([
-    "email",
-    "calendar",
-    "chat",
-    "crm",
-    "storage",
-    "docs",
-    "database",
-    "webhook",
-    "workflow",
-    "internal",
-    "other"
-  ].includes(value)) return value;
-  return "other";
-}
-function normalizeAuth(auth) {
-  if (auth === "oauth2") return "oauth2";
-  if (auth === "api_key" || auth === "api-key" || auth === "apikey") return "api_key";
-  if (auth === "none") return "none";
-  return "custom";
-}
-function normalizeRisk(risk) {
-  if (risk === "read" || risk === "write" || risk === "destructive") return risk;
-  return "write";
-}
-function normalizeDataClass(dataClass) {
-  if (dataClass === "public" || dataClass === "internal" || dataClass === "private" || dataClass === "sensitive" || dataClass === "secret") return dataClass;
-  return "private";
-}
-function slug(value) {
-  return value.trim().toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function titleFromId2(id) {
-  return id.split("-").filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
-}
-function unique4(values) {
-  return [...new Set(values)];
-}
-
-// src/activepieces-provider.ts
-function createActivepiecesExecutorProvider(options) {
-  const providerId = options.id ?? "activepieces";
-  const connectors = options.connectors ?? buildActivepiecesConnectors({
-    providerId,
-    includeCatalogActions: true,
-    executable: true
-  });
-  const byEntry = new Map(listActivepiecesCatalogEntries().map((entry) => [entry.id, entry]));
-  return createCatalogExecutorProvider({
-    id: providerId,
-    kind: "activepieces",
-    connectors,
-    startAuth: options.startAuth,
-    completeAuth: options.completeAuth,
-    executeAction: async ({ connection, request, connector, action }) => {
-      const catalogEntry = byEntry.get(connector.id);
-      if (!catalogEntry) {
-        throw new IntegrationError(`Activepieces catalog entry ${connector.id} not found.`, "connector_not_found");
-      }
-      const catalogAction = catalogEntry.actions.find((candidate) => candidate.id === action.id);
-      return options.executeAction({
-        connection,
-        request,
-        connector,
-        catalogEntry,
-        piece: {
-          id: catalogEntry.id,
-          npmPackage: catalogEntry.npmPackage,
-          version: catalogEntry.version,
-          actionId: action.id,
-          upstreamActionName: catalogAction?.upstreamName
-        }
-      });
-    }
-  });
-}
-
-// src/catalog-freshness.ts
-var ACTIVEPIECES_PUBLIC_CATALOG_URL = "https://www.activepieces.com/pieces";
-function parseCount(value) {
-  if (!value) return void 0;
-  const parsed = Number.parseInt(value.replace(/,/g, ""), 10);
-  return Number.isFinite(parsed) ? parsed : void 0;
-}
-function extractActivepiecesPublicPieceCount(html) {
-  const showingMatch = html.match(/Showing\s+([0-9,]+)\s+pieces/i);
-  const integrationMatch = html.match(/([0-9,]+)\+?\s+Integrations/i);
-  return parseCount(showingMatch?.[1]) ?? parseCount(integrationMatch?.[1]);
-}
-async function auditIntegrationCatalogFreshness(options = {}) {
-  const minActivepiecesConnectors = options.minActivepiecesConnectors ?? 600;
-  const staleConnectorDelta = options.staleConnectorDelta ?? 25;
-  const activepiecesEntries = listActivepiecesCatalogEntries();
-  const activepiecesConnectors = buildActivepiecesConnectors({
-    includeCatalogActions: true
-  });
-  const executableActivepiecesProvider = createActivepiecesExecutorProvider({
-    executeAction: () => ({ ok: true, action: "audit.noop" })
-  });
-  const executableActivepiecesConnectors = await executableActivepiecesProvider.listConnectors();
-  const executableRegistry = composeIntegrationRegistry([
-    {
-      id: executableActivepiecesProvider.id,
-      connectors: executableActivepiecesConnectors
-    }
-  ]);
-  const executableTools = buildIntegrationToolCatalog(executableRegistry.connectors);
-  const unsupportedExecutableConnectorIds = executableActivepiecesConnectors.filter((connector) => connector.actions.length === 0).map((connector) => connector.id);
-  const registry = buildDefaultIntegrationRegistry({
-    includeSpecs: true,
-    includeActivepieces: true
-  });
-  const warnings = [];
-  if (activepiecesConnectors.length < minActivepiecesConnectors) {
-    warnings.push(
-      `Activepieces catalog has ${activepiecesConnectors.length} connectors, below floor ${minActivepiecesConnectors}.`
-    );
-  }
-  let upstream;
-  if (options.liveActivepieces) {
-    upstream = await checkActivepiecesPublicCatalog({
-      localConnectorCount: activepiecesConnectors.length,
-      staleConnectorDelta,
-      fetchImpl: options.fetchImpl,
-      warnings
-    });
-  }
-  return {
-    ok: warnings.length === 0,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    local: {
-      activepiecesEntries: activepiecesEntries.length,
-      activepiecesConnectors: activepiecesConnectors.length,
-      activepiecesActions: activepiecesConnectors.reduce(
-        (sum, connector) => sum + connector.actions.length,
-        0
-      ),
-      activepiecesTriggers: activepiecesConnectors.reduce(
-        (sum, connector) => sum + (connector.triggers?.length ?? 0),
-        0
-      ),
-      executableActivepiecesConnectors: executableActivepiecesConnectors.length,
-      executableActivepiecesActions: executableActivepiecesConnectors.reduce(
-        (sum, connector) => sum + connector.actions.length,
-        0
-      ),
-      executableActivepiecesTriggers: executableActivepiecesConnectors.reduce(
-        (sum, connector) => sum + (connector.triggers?.length ?? 0),
-        0
-      ),
-      executableToolDefinitions: executableTools.length,
-      unsupportedExecutableConnectorIds,
-      registryEntries: registry.entries.length,
-      registrySummary: summarizeIntegrationRegistry(registry),
-      conflictSamples: registry.entries.flatMap((entry) => entry.conflicts).slice(0, 10)
-    },
-    upstream,
-    warnings
-  };
-}
-async function checkActivepiecesPublicCatalog(input) {
-  try {
-    const res = await (input.fetchImpl ?? fetch)(ACTIVEPIECES_PUBLIC_CATALOG_URL, {
-      headers: { accept: "text/html" },
-      signal: AbortSignal.timeout(15e3)
-    });
-    if (!res.ok) {
-      const warning = `Activepieces freshness request failed with HTTP ${res.status}.`;
-      input.warnings.push(warning);
-      return {
-        checkedUrl: ACTIVEPIECES_PUBLIC_CATALOG_URL,
-        warning
-      };
-    }
-    const activepiecesPieces = extractActivepiecesPublicPieceCount(await res.text());
-    const activepiecesDelta = activepiecesPieces === void 0 ? void 0 : activepiecesPieces - input.localConnectorCount;
-    if (activepiecesDelta !== void 0 && activepiecesDelta > input.staleConnectorDelta) {
-      input.warnings.push(
-        `Activepieces upstream appears ${activepiecesDelta} connectors ahead of the vendored package catalog.`
-      );
-    }
-    return {
-      activepiecesPieces,
-      activepiecesDelta,
-      checkedUrl: ACTIVEPIECES_PUBLIC_CATALOG_URL,
-      warning: activepiecesPieces === void 0 ? "Could not parse upstream piece count." : void 0
-    };
-  } catch (error) {
-    const warning = error instanceof Error ? error.message : "Activepieces freshness request failed.";
-    input.warnings.push(warning);
-    return {
-      checkedUrl: ACTIVEPIECES_PUBLIC_CATALOG_URL,
-      warning
-    };
-  }
-}
-
-// src/runtime.ts
-var InMemoryIntegrationGrantStore = class {
-  grants = /* @__PURE__ */ new Map();
-  get(grantId) {
-    return this.grants.get(grantId);
-  }
-  put(grant) {
-    this.grants.set(grant.id, grant);
-  }
-  listByManifest(manifestId, grantee) {
-    return [...this.grants.values()].filter(
-      (grant) => grant.manifestId === manifestId && (!grantee || sameActor(grant.grantee, grantee))
-    );
-  }
-  listByGrantee(grantee) {
-    return [...this.grants.values()].filter((grant) => sameActor(grant.grantee, grantee));
-  }
-  listByIds(grantIds) {
-    const wanted = new Set(grantIds);
-    return [...this.grants.values()].filter((grant) => wanted.has(grant.id));
-  }
-  delete(grantId) {
-    this.grants.delete(grantId);
-  }
-};
-var IntegrationRuntime = class {
-  hub;
-  grants;
-  now;
-  constructor(options) {
-    this.hub = options.hub;
-    this.grants = options.grants ?? new InMemoryIntegrationGrantStore();
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  async registry() {
-    return this.hub.listRegistry();
-  }
-  async resolveManifest(manifest, owner) {
-    const registry = await this.registry();
-    const connections = await this.hub.listConnections(owner);
-    const resolutions = manifest.requirements.map(
-      (requirement) => resolveRequirement(requirement, owner, registry, connections)
-    );
-    return {
-      manifest,
-      owner,
-      ready: resolutions.filter((resolution) => resolution.status === "ready"),
-      missing: resolutions.filter((resolution) => resolution.status !== "ready" && !resolution.requirement.optional),
-      optionalMissing: resolutions.filter((resolution) => resolution.status !== "ready" && resolution.requirement.optional === true)
-    };
-  }
-  async createGrants(input) {
-    const resolution = await this.resolveManifest(input.manifest, input.owner);
-    if (resolution.missing.length > 0) {
-      throw new Error(`Cannot create integration grants; missing requirements: ${resolution.missing.map((r) => r.requirement.id).join(", ")}`);
-    }
-    const now = this.now().toISOString();
-    const grants = resolution.ready.map((ready) => ({
-      id: `grant_${input.manifest.id}_${ready.requirement.id}_${ready.connection.id}`,
-      manifestId: input.manifest.id,
-      requirementId: ready.requirement.id,
-      owner: input.owner,
-      grantee: input.grantee,
-      connectionId: ready.connection.id,
-      connectorId: ready.connector.id,
-      scopes: requiredScopes(ready.requirement, ready.connector),
-      allowedActions: requiredActions(ready.requirement, ready.connector),
-      allowedTriggers: requiredTriggers(ready.requirement, ready.connector),
-      status: "active",
-      createdAt: now,
-      updatedAt: now,
-      metadata: input.metadata
-    }));
-    for (const grant of grants) await this.grants.put(grant);
-    return grants;
-  }
-  async buildSandboxBundle(input) {
-    const grants = await this.resolveBundleGrants(input);
-    if (grants.length === 0) {
-      throw new Error("Cannot build integration bundle; no active integration grants matched the request.");
-    }
-    const registry = await this.registry();
-    const bindings = [];
-    const connectors = [];
-    let expiresAt = "";
-    for (const grant of grants) {
-      const connection = await this.hub.getConnection(grant.connectionId);
-      if (!connection) {
-        throw new Error(`Cannot build integration bundle; connection ${grant.connectionId} not found.`);
-      }
-      if (!sameActor(connection.owner, input.owner)) {
-        throw new Error(`Cannot build integration bundle; connection ${connection.id} belongs to a different owner.`);
-      }
-      if (connection.status !== "active") {
-        throw new Error(`Cannot build integration bundle; connection ${connection.id} is ${connection.status}.`);
-      }
-      const entry = registry.byId.get(grant.connectorId);
-      if (!entry) continue;
-      const connector = {
-        ...entry.connector,
-        actions: entry.connector.actions.filter((action) => grant.allowedActions.includes(action.id)),
-        triggers: entry.connector.triggers?.filter((trigger2) => grant.allowedTriggers.includes(trigger2.id)),
-        scopes: entry.connector.scopes.filter((scope) => grant.scopes.includes(scope))
-      };
-      const capability = await this.hub.issueCapability({
-        subject: input.subject,
-        connectionId: grant.connectionId,
-        scopes: grant.scopes,
-        allowedActions: grant.allowedActions,
-        ttlMs: input.ttlMs,
-        metadata: {
-          manifestId: grant.manifestId,
-          grantId: grant.id,
-          requirementId: grant.requirementId
-        }
-      });
-      bindings.push({
-        requirementId: grant.requirementId,
-        connectorId: grant.connectorId,
-        connectionId: grant.connectionId,
-        grantId: grant.id,
-        scopes: grant.scopes,
-        allowedActions: grant.allowedActions,
-        allowedTriggers: grant.allowedTriggers,
-        capability
-      });
-      connectors.push(connector);
-      expiresAt = capability.capability.expiresAt;
-    }
-    return {
-      manifestId: input.manifestId ?? grants[0]?.manifestId ?? "explicit-grants",
-      subject: input.subject,
-      capabilities: bindings,
-      connectors,
-      tools: buildIntegrationToolCatalog(connectors),
-      expiresAt
-    };
-  }
-  async resolveBundleGrants(input) {
-    if (input.grantIds?.length) {
-      const uniqueGrantIds = unique5(input.grantIds);
-      const grants = this.grants.listByIds ? await this.grants.listByIds(uniqueGrantIds) : await Promise.all(uniqueGrantIds.map((grantId) => this.grants.get(grantId)));
-      const found = grants.filter((grant) => Boolean(grant));
-      const foundIds = new Set(found.map((grant) => grant.id));
-      const missing2 = uniqueGrantIds.filter((grantId) => !foundIds.has(grantId));
-      if (missing2.length > 0) {
-        throw new Error(`Cannot build integration bundle; unknown grant id(s): ${missing2.join(", ")}`);
-      }
-      const badOwner = found.find((grant) => !sameActor(grant.owner, input.owner));
-      if (badOwner) {
-        throw new Error(`Cannot build integration bundle; grant ${badOwner.id} belongs to a different owner.`);
-      }
-      const badGrantee = input.grantee ? found.find((grant) => !sameActor(grant.grantee, input.grantee)) : void 0;
-      if (badGrantee) {
-        throw new Error(`Cannot build integration bundle; grant ${badGrantee.id} belongs to a different grantee.`);
-      }
-      const badManifest = input.manifestId ? found.find((grant) => grant.manifestId !== input.manifestId) : void 0;
-      if (badManifest) {
-        throw new Error(`Cannot build integration bundle; grant ${badManifest.id} is not for manifest ${input.manifestId}.`);
-      }
-      const inactive = found.find((grant) => grant.status !== "active");
-      if (inactive) {
-        throw new Error(`Cannot build integration bundle; grant ${inactive.id} is ${inactive.status}.`);
-      }
-      return found;
-    }
-    if (!input.manifestId) {
-      throw new Error("Cannot build integration bundle; manifestId or grantIds is required.");
-    }
-    return (await this.grants.listByManifest(input.manifestId, input.grantee)).filter((grant) => sameActor(grant.owner, input.owner)).filter((grant) => grant.status === "active");
-  }
-};
-function createIntegrationRuntime(options) {
-  return new IntegrationRuntime(options);
-}
-function resolveRequirement(requirement, owner, registry, connections) {
-  const entry = registry.byId.get(requirement.connectorId);
-  if (!entry) {
-    return missing(requirement, "unknown_connector", `Unknown connector ${requirement.connectorId}.`);
-  }
-  const connector = entry.connector;
-  if (connector.actions.length === 0 && (connector.triggers?.length ?? 0) === 0) {
-    return missing(requirement, "not_executable", `${connector.title} is catalog-only and cannot be invoked yet.`, connector, entry);
-  }
-  const scopes = requiredScopes(requirement, connector);
-  const actions = requiredActions(requirement, connector);
-  const triggers = requiredTriggers(requirement, connector);
-  const connection = connections.find(
-    (candidate) => sameActor(candidate.owner, owner) && candidate.status === "active" && (candidate.connectorId === connector.id || entry.aliases.includes(candidate.connectorId)) && scopes.every((scope) => candidate.grantedScopes.includes(scope))
-  );
-  if (!connection) {
-    return {
-      requirement,
-      status: "missing_connection",
-      connector,
-      registryEntry: entry,
-      missingScopes: scopes,
-      missingActions: actions,
-      missingTriggers: triggers,
-      message: `${connector.title} needs an active user connection with the required scopes.`
-    };
-  }
-  return {
-    requirement,
-    status: "ready",
-    connector,
-    registryEntry: entry,
-    connection,
-    missingScopes: [],
-    missingActions: [],
-    missingTriggers: [],
-    message: `${connector.title} is ready.`
-  };
-}
-function missing(requirement, status, message, connector, registryEntry2) {
-  return {
-    requirement,
-    status,
-    connector,
-    registryEntry: registryEntry2,
-    missingScopes: [],
-    missingActions: [],
-    missingTriggers: [],
-    message
-  };
-}
-function requiredActions(requirement, connector) {
-  if (requirement.mode === "trigger") return [];
-  if (requirement.requiredActions?.length) return unique5(requirement.requiredActions);
-  const actions = connector.actions.filter((action) => {
-    if (requirement.mode === "read") return action.risk === "read";
-    if (requirement.mode === "write") return action.risk === "write";
-    return false;
-  });
-  return unique5(actions.map((action) => action.id));
-}
-function requiredTriggers(requirement, connector) {
-  if (requirement.requiredTriggers?.length) return unique5(requirement.requiredTriggers);
-  if (requirement.mode !== "trigger") return [];
-  return unique5((connector.triggers ?? []).map((trigger2) => trigger2.id));
-}
-function requiredScopes(requirement, connector) {
-  if (requirement.requiredScopes?.length) return unique5(requirement.requiredScopes);
-  const actionIds = new Set(requiredActions(requirement, connector));
-  const triggerIds = new Set(requiredTriggers(requirement, connector));
-  return unique5([
-    ...connector.actions.filter((action) => actionIds.has(action.id)).flatMap((action) => action.requiredScopes),
-    ...(connector.triggers ?? []).filter((trigger2) => triggerIds.has(trigger2.id)).flatMap((trigger2) => trigger2.requiredScopes)
-  ]);
-}
-function sameActor(a, b) {
-  return a.type === b.type && a.id === b.id;
-}
-function unique5(values) {
-  return [...new Set(values)];
-}
-
-// src/workflow.ts
-var InMemoryIntegrationWorkflowStore = class {
-  workflows = /* @__PURE__ */ new Map();
-  put(workflow) {
-    this.workflows.set(workflow.id, workflow);
-  }
-  get(id) {
-    return this.workflows.get(id);
-  }
-  list() {
-    return [...this.workflows.values()];
-  }
-  listByWorkflow(workflowId) {
-    return [...this.workflows.values()].filter((workflow) => workflow.workflowId === workflowId);
-  }
-  listByOwner(owner) {
-    return [...this.workflows.values()].filter((workflow) => sameActor2(workflow.owner, owner));
-  }
-};
-var IntegrationWorkflowRuntime = class {
-  runtime;
-  hub;
-  grants;
-  store;
-  now;
-  constructor(options) {
-    this.runtime = options.runtime;
-    this.hub = options.hub;
-    this.grants = options.grants;
-    this.store = options.store ?? new InMemoryIntegrationWorkflowStore();
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  async install(input) {
-    const grants = await this.runtime.createGrants({
-      manifest: input.workflow.manifest,
-      owner: input.owner,
-      grantee: input.grantee,
-      metadata: { workflowId: input.workflow.id }
-    });
-    const triggerGrant = findTriggerGrant(grants, input.workflow.trigger.requirementId, input.workflow.trigger.triggerId);
-    const subscription = await this.hub.subscribeTrigger(
-      triggerGrant.connectionId,
-      input.workflow.trigger.triggerId,
-      input.workflow.trigger.targetUrl
-    );
-    const installed = {
-      id: `workflow_${input.workflow.id}_${triggerGrant.id}`,
-      workflowId: input.workflow.id,
-      manifestId: input.workflow.manifest.id,
-      owner: input.owner,
-      grantee: input.grantee,
-      triggerGrantId: triggerGrant.id,
-      subscription,
-      status: "active",
-      createdAt: this.now().toISOString(),
-      metadata: input.workflow.metadata
-    };
-    await this.store.put(installed);
-    return installed;
-  }
-  async dispatchEvent(event, handler) {
-    const workflows = (await this.store.list()).filter(
-      (workflow) => workflow.status === "active" && workflow.subscription.connectionId === event.connectionId && workflow.subscription.trigger === event.trigger
-    );
-    await handler({ event, workflows });
-    return { matched: workflows };
-  }
-};
-function createIntegrationWorkflowRuntime(options) {
-  return new IntegrationWorkflowRuntime(options);
-}
-function findTriggerGrant(grants, requirementId, triggerId) {
-  const grant = grants.find(
-    (candidate) => candidate.requirementId === requirementId && candidate.allowedTriggers.includes(triggerId)
-  );
-  if (!grant) throw new Error(`Missing trigger grant ${requirementId}/${triggerId}.`);
-  return grant;
-}
-function sameActor2(a, b) {
-  return a.type === b.type && a.id === b.id;
-}
-
-// src/index.ts
-var InMemoryConnectionStore = class {
-  connections = /* @__PURE__ */ new Map();
-  get(connectionId) {
-    return this.connections.get(connectionId);
-  }
-  put(connection) {
-    this.connections.set(connection.id, connection);
-  }
-  listByOwner(owner) {
-    return [...this.connections.values()].filter(
-      (connection) => connection.owner.type === owner.type && connection.owner.id === owner.id
-    );
-  }
-  delete(connectionId) {
-    this.connections.delete(connectionId);
-  }
-};
-var IntegrationHub = class {
-  providers = /* @__PURE__ */ new Map();
-  store;
-  capabilitySecret;
-  guard;
-  policy;
-  /** Host-injected (or in-memory default) secret store. The hub re-persists
-   *  rotated credentials here when a connection carries a secretRef. */
-  secretStore;
-  oauthStateStore;
-  oauthStateTtlMs;
-  credentialsRotated;
-  now;
-  constructor(options) {
-    if (!options.capabilitySecret) {
-      throw new IntegrationError("capabilitySecret is required.", "capability_invalid");
-    }
-    for (const provider of options.providers) this.providers.set(provider.id, provider);
-    this.store = options.store;
-    this.capabilitySecret = options.capabilitySecret;
-    this.guard = options.guard;
-    this.policy = options.policy;
-    this.secretStore = options.secretStore ?? new InMemoryIntegrationSecretStore();
-    this.oauthStateStore = options.oauthStateStore ?? new InMemoryIntegrationOAuthStateStore();
-    this.oauthStateTtlMs = options.oauthStateTtlMs ?? 10 * 60 * 1e3;
-    this.credentialsRotated = options.credentialsRotated;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  async listConnectors() {
-    const catalogs = await Promise.all([...this.providers.values()].map((provider) => provider.listConnectors()));
-    return catalogs.flat();
-  }
-  async listRegistry(options = {}) {
-    const sources = await Promise.all([...this.providers.values()].map(async (provider) => ({
-      id: provider.id,
-      connectors: await provider.listConnectors()
-    })));
-    return composeIntegrationRegistry(sources, options);
-  }
-  async startAuth(providerId, request) {
-    const provider = this.requireProvider(providerId);
-    if (!provider.startAuth) throw new IntegrationError(`Provider ${providerId} does not support auth start.`, "auth_not_supported");
-    const connector = await this.requireConnector(provider, request.connectorId);
-    const pkce = connectorOAuthPkceMode(connector);
-    const pkcePair = pkce === "unsupported" ? void 0 : createPkcePair();
-    const result = await provider.startAuth({
-      ...request,
-      codeChallenge: pkcePair?.challenge
-    });
-    const record = {
-      state: result.state,
-      providerId,
-      connectorId: request.connectorId,
-      owner: request.owner,
-      requestedScopes: request.requestedScopes,
-      redirectUri: request.redirectUri,
-      codeVerifier: pkcePair?.verifier,
-      expiresAt: this.now().getTime() + this.oauthStateTtlMs,
-      metadata: request.metadata
-    };
-    await this.oauthStateStore.put(record);
-    return result;
-  }
-  async completeAuth(providerId, request) {
-    const provider = this.requireProvider(providerId);
-    if (!provider.completeAuth) throw new IntegrationError(`Provider ${providerId} does not support auth completion.`, "auth_not_supported");
-    const outcome = await this.oauthStateStore.consume(request.state);
-    if (!outcome.ok) {
-      throw new IntegrationError(`Integration OAuth state ${outcome.reason}: possible CSRF, replay, or stale flow.`, "capability_invalid");
-    }
-    if (outcome.state.providerId !== providerId || outcome.state.connectorId !== request.connectorId) {
-      throw new IntegrationError("Integration OAuth state does not match completion request.", "capability_invalid");
-    }
-    if (outcome.state.redirectUri !== request.redirectUri) {
-      throw new IntegrationError("Integration OAuth redirect URI does not match the start request.", "capability_invalid");
-    }
-    const pinnedMetadata = request.metadata || outcome.state.metadata ? { ...request.metadata, ...outcome.state.metadata } : void 0;
-    const connection = await provider.completeAuth({
-      ...request,
-      connectorId: outcome.state.connectorId,
-      owner: outcome.state.owner,
-      state: outcome.state.state,
-      redirectUri: outcome.state.redirectUri,
-      codeVerifier: outcome.state.codeVerifier,
-      metadata: pinnedMetadata
-    });
-    await this.store.put(connection);
-    return connection;
-  }
-  async upsertConnection(connection) {
-    await this.store.put(connection);
-    return connection;
-  }
-  async listConnections(owner) {
-    return this.store.listByOwner(owner);
-  }
-  async getConnection(connectionId) {
-    return this.store.get(connectionId);
-  }
-  async issueCapability(request) {
-    const connection = await this.requireConnection(request.connectionId);
-    this.assertConnectionActive(connection);
-    assertScopes(connection, request.scopes);
-    const now = this.now();
-    const capability = {
-      id: `cap_${randomUUID3()}`,
-      subject: request.subject,
-      connectionId: request.connectionId,
-      scopes: unique6(request.scopes),
-      allowedActions: unique6(request.allowedActions),
-      issuedAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + request.ttlMs).toISOString(),
-      metadata: request.metadata
-    };
-    return { capability, token: signCapability(capability, this.capabilitySecret) };
-  }
-  verifyCapability(token) {
-    const capability = verifyCapabilityToken(token, this.capabilitySecret);
-    if (Date.parse(capability.expiresAt) <= this.now().getTime()) {
-      throw new IntegrationError("Integration capability expired.", "capability_expired");
-    }
-    return capability;
-  }
-  async invokeWithCapability(token, request) {
-    const capability = this.verifyCapability(token);
-    if (!capability.allowedActions.includes(request.action)) {
-      throw new IntegrationError(`Capability does not allow action ${request.action}.`, "action_denied");
-    }
-    const connection = await this.requireConnection(capability.connectionId);
-    this.assertConnectionActive(connection);
-    const provider = this.requireProvider(connection.providerId);
-    const connector = await this.requireConnector(provider, connection.connectorId);
-    const action = connector.actions.find((candidate) => candidate.id === request.action);
-    if (!action) throw new IntegrationError(`Action ${request.action} is not defined by connector ${connector.id}.`, "action_not_found");
-    assertScopes(connection, action.requiredScopes);
-    assertScopes({ ...connection, grantedScopes: capability.scopes }, action.requiredScopes);
-    const fullRequest = { ...request, connectionId: connection.id };
-    const proceed = async () => {
-      if (!this.policy) return provider.invokeAction(connection, fullRequest);
-      const decision = await this.policy.decide({
-        connection,
-        request: fullRequest,
-        action,
-        subject: capability.subject
-      });
-      if (decision.decision === "deny") {
-        throw new IntegrationError(decision.reason, "policy_denied");
-      }
-      if (decision.decision === "require_approval") {
-        return {
-          ok: false,
-          action: request.action,
-          output: { approvalRequired: true, approval: decision.approval },
-          metadata: { policyDecision: decision.decision, reason: decision.reason, ...decision.metadata }
-        };
-      }
-      return provider.invokeAction(connection, fullRequest);
-    };
-    if (this.guard) {
-      return this.guard.invokeAction({ connection, request: fullRequest, action }, proceed);
-    }
-    return proceed();
-  }
-  async subscribeTrigger(connectionId, trigger2, targetUrl) {
-    const connection = await this.requireConnection(connectionId);
-    this.assertConnectionActive(connection);
-    const provider = this.requireProvider(connection.providerId);
-    const connector = await this.requireConnector(provider, connection.connectorId);
-    const spec = connector.triggers?.find((candidate) => candidate.id === trigger2);
-    if (!spec) throw new IntegrationError(`Trigger ${trigger2} is not defined by connector ${connector.id}.`, "trigger_not_found");
-    assertScopes(connection, spec.requiredScopes);
-    if (!provider.subscribeTrigger) {
-      throw new IntegrationError(`Provider ${provider.id} does not support triggers.`, "auth_not_supported");
-    }
-    return provider.subscribeTrigger(connection, trigger2, targetUrl);
-  }
-  requireProvider(providerId) {
-    const provider = this.providers.get(providerId);
-    if (!provider) throw new IntegrationError(`Provider ${providerId} not found.`, "provider_not_found");
-    return provider;
-  }
-  async requireConnector(provider, connectorId) {
-    const connector = (await provider.listConnectors()).find((candidate) => candidate.id === connectorId);
-    if (!connector) throw new IntegrationError(`Connector ${connectorId} not found.`, "connector_not_found");
-    return connector;
-  }
-  async requireConnection(connectionId) {
-    const connection = await this.store.get(connectionId);
-    if (!connection) throw new IntegrationError(`Connection ${connectionId} not found.`, "connection_not_found");
-    return connection;
-  }
-  assertConnectionActive(connection) {
-    if (connection.status !== "active") {
-      throw new IntegrationError(`Connection ${connection.id} is ${connection.status}.`, "connection_not_active");
-    }
-    if (connection.expiresAt && Date.parse(connection.expiresAt) <= this.now().getTime()) {
-      throw new IntegrationError(`Connection ${connection.id} is expired.`, "connection_not_active");
-    }
-  }
-};
-function sanitizeConnection(connection) {
-  return {
-    id: connection.id,
-    owner: connection.owner,
-    providerId: connection.providerId,
-    connectorId: connection.connectorId,
-    status: connection.status,
-    grantedScopes: connection.grantedScopes,
-    account: connection.account,
-    hasSecretRef: Boolean(connection.secretRef),
-    createdAt: connection.createdAt,
-    updatedAt: connection.updatedAt,
-    expiresAt: connection.expiresAt,
-    lastUsedAt: connection.lastUsedAt
-  };
-}
-function createMockIntegrationProvider(options = {}) {
-  const providerId = options.id ?? "mock";
-  const connectors = options.connectors ?? [{
-    id: "gmail",
-    providerId,
-    title: "Gmail",
-    category: "email",
-    auth: "oauth2",
-    scopes: ["email.read", "email.write"],
-    actions: [
-      { id: "messages.search", title: "Search messages", risk: "read", requiredScopes: ["email.read"], dataClass: "private" },
-      { id: "drafts.create", title: "Create draft", risk: "write", requiredScopes: ["email.write"], dataClass: "private", approvalRequired: true }
-    ],
-    triggers: [
-      { id: "message.received", title: "Message received", requiredScopes: ["email.read"], dataClass: "private" }
-    ]
-  }];
-  return {
-    id: providerId,
-    kind: "custom",
-    listConnectors: () => connectors,
-    startAuth: (request) => ({
-      providerId,
-      connectorId: request.connectorId,
-      authUrl: `https://auth.example.test/${request.connectorId}?state=${encodeURIComponent(request.state ?? "state")}`,
-      state: request.state ?? "state"
-    }),
-    completeAuth: (request) => ({
-      id: `conn_${request.connectorId}_${request.owner.id}`,
-      owner: request.owner,
-      providerId,
-      connectorId: request.connectorId,
-      status: "active",
-      grantedScopes: connectors.find((connector) => connector.id === request.connectorId)?.scopes ?? [],
-      secretRef: { provider: providerId, id: `secret_${request.owner.id}` },
-      createdAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
-    }),
-    invokeAction: async (connection, request) => options.onInvoke?.(connection, request) ?? {
-      ok: true,
-      action: request.action,
-      output: { echo: request.input ?? null }
-    },
-    subscribeTrigger: (connection, trigger2, targetUrl) => ({
-      id: `sub_${connection.id}_${trigger2}`,
-      connectionId: connection.id,
-      trigger: trigger2,
-      targetUrl,
-      status: "active",
-      createdAt: (/* @__PURE__ */ new Date(0)).toISOString()
-    })
-  };
-}
-function createHttpIntegrationProvider(options) {
-  const fetcher = options.fetchImpl ?? fetch;
-  const baseUrl = options.baseUrl.replace(/\/$/, "");
-  return {
-    id: options.id,
-    kind: options.kind ?? "custom",
-    listConnectors: () => options.connectors,
-    async startAuth(request) {
-      const response = await postJson(fetcher, `${baseUrl}/auth/start`, request, options.bearer);
-      return response;
-    },
-    async completeAuth(request) {
-      const response = await postJson(fetcher, `${baseUrl}/auth/complete`, request, options.bearer);
-      return response;
-    },
-    async invokeAction(connection, request) {
-      return postJson(fetcher, `${baseUrl}/actions/invoke`, {
-        connection,
-        request
-      }, options.bearer);
-    },
-    async subscribeTrigger(connection, trigger2, targetUrl) {
-      return postJson(fetcher, `${baseUrl}/triggers/subscribe`, {
-        connection,
-        trigger: trigger2,
-        targetUrl
-      }, options.bearer);
-    },
-    async unsubscribeTrigger(subscriptionId) {
-      await postJson(fetcher, `${baseUrl}/triggers/unsubscribe`, { subscriptionId }, options.bearer);
-    },
-    async normalizeTriggerEvent(raw) {
-      return postJson(fetcher, `${baseUrl}/triggers/normalize`, { raw }, options.bearer);
-    }
-  };
-}
-function signCapability(capability, secret) {
-  const payload = base64UrlEncode2(JSON.stringify(capability));
-  const signature = hmac(payload, secret);
-  return `${payload}.${signature}`;
-}
-function verifyCapabilityToken(token, secret) {
-  const [payload, signature] = token.split(".");
-  if (!payload || !signature) throw new IntegrationError("Malformed integration capability.", "capability_invalid");
-  const expected = hmac(payload, secret);
-  if (!constantTimeEqual(signature, expected)) throw new IntegrationError("Invalid integration capability signature.", "capability_invalid");
-  let parsed;
-  try {
-    parsed = JSON.parse(base64UrlDecode(payload));
-  } catch {
-    throw new IntegrationError("Invalid integration capability payload.", "capability_invalid");
-  }
-  if (!parsed.id || !parsed.connectionId || !Array.isArray(parsed.scopes) || !Array.isArray(parsed.allowedActions)) {
-    throw new IntegrationError("Invalid integration capability payload.", "capability_invalid");
-  }
-  return parsed;
-}
-async function postJson(fetcher, url, body, bearer) {
-  const response = await fetcher(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      ...bearer ? { Authorization: `Bearer ${bearer}` } : {}
-    },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) throw new IntegrationError(`Integration provider returned HTTP ${response.status}.`, "provider_not_found");
-  return response.json();
-}
-function assertScopes(connection, requiredScopes2) {
-  const missing2 = requiredScopes2.filter((scope) => !connection.grantedScopes.includes(scope));
-  if (missing2.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing2.join(", ")}`, "scope_denied");
-}
-function connectorOAuthPkceMode(connector) {
-  const value = connector.metadata?.oauthPkce;
-  if (value === void 0) return "required";
-  if (value === "required" || value === "supported" || value === "unsupported") return value;
-  throw new IntegrationError(
-    `Connector ${connector.id} declares an invalid OAuth PKCE posture.`,
-    "config_missing"
-  );
-}
-function createPkcePair() {
-  const verifier = randomBytes(48).toString("base64url");
-  const challenge = createHash3("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-function hmac(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-function constantTimeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function base64UrlEncode2(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-function base64UrlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-function unique6(values) {
-  return [...new Set(values)];
-}
-
-// src/catalog-executor.ts
-function createCatalogExecutorProvider(options) {
-  const byConnector = new Map(options.connectors.map((connector) => [connector.id, connector]));
-  return {
-    id: options.id,
-    kind: options.kind,
-    listConnectors: () => options.connectors,
-    startAuth: options.startAuth,
-    completeAuth: options.completeAuth,
-    async invokeAction(connection, request) {
-      const connector = byConnector.get(connection.connectorId);
-      if (!connector) {
-        throw new IntegrationError(`Connector ${connection.connectorId} not found.`, "connector_not_found");
-      }
-      const action = connector.actions.find((candidate) => candidate.id === request.action);
-      if (!action) {
-        throw new IntegrationError(`Action ${request.action} is not defined by connector ${connector.id}.`, "action_not_found");
-      }
-      return options.executeAction({ connection, request, connector, action });
-    },
-    async subscribeTrigger(connection, triggerId, targetUrl) {
-      if (!options.subscribeTrigger) {
-        throw new IntegrationError(`Provider ${options.id} does not support trigger subscriptions.`, "trigger_not_found");
-      }
-      const connector = byConnector.get(connection.connectorId);
-      if (!connector) {
-        throw new IntegrationError(`Connector ${connection.connectorId} not found.`, "connector_not_found");
-      }
-      const trigger2 = connector.triggers?.find((candidate) => candidate.id === triggerId);
-      if (!trigger2) {
-        throw new IntegrationError(`Trigger ${triggerId} is not defined by connector ${connector.id}.`, "trigger_not_found");
-      }
-      return options.subscribeTrigger(connection, trigger2, targetUrl);
-    },
-    unsubscribeTrigger: options.unsubscribeTrigger,
-    normalizeTriggerEvent: options.normalizeTriggerEvent
-  };
-}
-
-// src/tangle-catalog.ts
-var TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID = "tangle-catalog";
-var TANGLE_INTEGRATIONS_CATALOG_SOURCE = "tangle-integrations-catalog";
-function listTangleNativeAdapterIds() {
-  const ids = new Set(
-    CONNECTOR_ADAPTER_FACTORIES.map(
-      (definition) => definition.kind
-    )
-  );
-  for (const adapter of listBundledConnectorAdapters()) {
-    ids.add(adapter.manifest.kind);
-  }
-  return [...ids].sort();
-}
-function listTangleIntegrationCatalogEntries() {
-  return listActivepiecesCatalogEntries().map((entry) => sanitizeEntry(entry));
-}
-function listTangleIntegrationContracts() {
-  const nativeAdapterIds = new Set(listTangleNativeAdapterIds().map(canonicalIntegrationKind));
-  return listActivepiecesCatalogEntries().map((entry) => {
-    const nativeAdapter = nativeAdapterIds.has(canonicalIntegrationKind(entry.id));
-    return {
-      id: entry.id,
-      title: entry.title,
-      description: entry.description,
-      category: entry.category,
-      auth: entry.auth,
-      authFields: entry.authFields ?? [],
-      actions: entry.actions.map((action) => ({
-        id: action.id,
-        title: action.title,
-        risk: action.risk,
-        upstreamName: action.upstreamName ?? action.id
-      })),
-      triggers: entry.triggers.map((trigger2) => ({
-        id: trigger2.id,
-        title: trigger2.title,
-        upstreamName: trigger2.upstreamName ?? trigger2.id
-      })),
-      implementation: {
-        kind: nativeAdapter ? "native_adapter" : "package_runtime",
-        runtimePackage: entry.npmPackage,
-        version: entry.version
-      },
-      status: nativeAdapter ? "native_backed" : entry.npmPackage ? "runtime_backed" : "contract_ready",
-      quality: {
-        tangleContract: true,
-        authFieldsMapped: entry.auth === "none" || Boolean(entry.authFields?.length),
-        actionNamesMapped: entry.actions.every((action) => Boolean(action.upstreamName)),
-        triggerNamesMapped: entry.triggers.every((trigger2) => Boolean(trigger2.upstreamName)),
-        runtimePackageMapped: Boolean(entry.npmPackage),
-        nativeAdapter
-      }
-    };
-  });
-}
-function listTangleIntegrationCatalogRuntimePackages() {
-  const nativeAdapterIds = new Set(listTangleNativeAdapterIds());
-  return listActivepiecesCatalogEntries().filter((entry) => Boolean(entry.npmPackage) && !nativeAdapterIds.has(entry.id)).map((entry) => ({
-    connectorId: entry.id,
-    packageName: entry.npmPackage,
-    version: entry.version
-  }));
-}
-function buildTangleCatalogRuntimePackageManifest(options = {}) {
-  const dependencies = {};
-  if (options.includeAgentIntegrationsPackage ?? true) {
-    dependencies["@tangle-network/agent-integrations"] = options.agentIntegrationsVersion ?? "latest";
-  }
-  for (const pkg of listTangleIntegrationCatalogRuntimePackages()) {
-    dependencies[pkg.packageName] = pkg.version ?? "latest";
-  }
-  Object.assign(dependencies, options.additionalDependencies);
-  return {
-    name: options.name ?? "@tangle-network/agent-integrations-runtime-bundle",
-    private: true,
-    type: "module",
-    dependencies: Object.fromEntries(Object.entries(dependencies).sort(([a], [b]) => a.localeCompare(b))),
-    tangle: {
-      integrationContracts: listTangleIntegrationContracts().length,
-      packageRuntimeBackends: listTangleIntegrationContracts().filter((contract) => contract.implementation.kind === "package_runtime").length,
-      generatedFrom: TANGLE_INTEGRATIONS_CATALOG_SOURCE
-    }
-  };
-}
-function renderTangleCatalogRuntimePnpmAddCommand(options = {}) {
-  const manifest = buildTangleCatalogRuntimePackageManifest({
-    includeAgentIntegrationsPackage: options.includeAgentIntegrationsPackage,
-    agentIntegrationsVersion: options.agentIntegrationsVersion
-  });
-  return [
-    "pnpm",
-    "add",
-    ...Object.entries(manifest.dependencies).map(([name, version]) => `${name}@${version}`)
-  ].join(" ");
-}
-function buildTangleIntegrationCatalogConnectors(options = {}) {
-  const providerId = options.providerId ?? TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID;
-  return buildActivepiecesConnectors({
-    ...options,
-    providerId
-  }).map((connector) => sanitizeConnector(connector, providerId));
-}
-function createTangleCatalogExecutorProvider(options) {
-  const providerId = options.id ?? TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID;
-  const connectors = options.connectors ?? buildTangleIntegrationCatalogConnectors({
-    providerId,
-    includeCatalogActions: true,
-    executable: true
-  });
-  const byEntry = new Map(listActivepiecesCatalogEntries().map((entry) => [entry.id, entry]));
-  return createCatalogExecutorProvider({
-    id: providerId,
-    kind: "tangle_catalog",
-    connectors,
-    startAuth: options.startAuth,
-    completeAuth: options.completeAuth,
-    executeAction: async ({ connection, request, connector, action }) => {
-      const importedEntry = byEntry.get(connector.id);
-      if (!importedEntry) {
-        throw new IntegrationError(`Tangle catalog entry ${connector.id} not found.`, "connector_not_found");
-      }
-      const catalogAction = importedEntry.actions.find((candidate) => candidate.id === action.id);
-      return options.executeAction({
-        connection,
-        request,
-        connector,
-        catalogEntry: sanitizeEntry(importedEntry),
-        piece: {
-          id: importedEntry.id,
-          packageName: importedEntry.npmPackage,
-          version: importedEntry.version,
-          actionId: action.id,
-          upstreamActionName: catalogAction?.upstreamName
-        }
-      });
-    },
-    subscribeTrigger: options.subscribeTrigger ? async (connection, trigger2, targetUrl) => {
-      const connector = connectors.find((candidate) => candidate.id === connection.connectorId);
-      const importedEntry = byEntry.get(connection.connectorId);
-      if (!connector || !importedEntry) {
-        throw new IntegrationError(`Tangle catalog entry ${connection.connectorId} not found.`, "connector_not_found");
-      }
-      const catalogTrigger = importedEntry.triggers.find((candidate) => candidate.id === trigger2.id);
-      return options.subscribeTrigger({
-        connection,
-        connector,
-        catalogEntry: sanitizeEntry(importedEntry),
-        trigger: trigger2,
-        targetUrl,
-        piece: {
-          id: importedEntry.id,
-          packageName: importedEntry.npmPackage,
-          version: importedEntry.version,
-          triggerId: trigger2.id,
-          upstreamTriggerName: catalogTrigger?.upstreamName
-        }
-      });
-    } : void 0,
-    unsubscribeTrigger: options.unsubscribeTrigger,
-    normalizeTriggerEvent: options.normalizeTriggerEvent
-  });
-}
-var extractExternalCatalogPublicCount = extractActivepiecesPublicPieceCount;
-async function auditTangleIntegrationCatalogFreshness(options = {}) {
-  const result = await auditIntegrationCatalogFreshness(options);
-  return {
-    ok: result.ok,
-    generatedAt: result.generatedAt,
-    local: {
-      catalogEntries: result.local.activepiecesEntries,
-      catalogConnectors: result.local.activepiecesConnectors,
-      catalogActions: result.local.activepiecesActions,
-      catalogTriggers: result.local.activepiecesTriggers,
-      executableCatalogConnectors: result.local.executableActivepiecesConnectors,
-      executableCatalogActions: result.local.executableActivepiecesActions,
-      executableCatalogTriggers: result.local.executableActivepiecesTriggers,
-      executableToolDefinitions: result.local.executableToolDefinitions,
-      unsupportedExecutableConnectorIds: result.local.unsupportedExecutableConnectorIds,
-      registryEntries: result.local.registryEntries,
-      registrySummary: result.local.registrySummary,
-      conflictSamples: result.local.conflictSamples
-    },
-    upstream: result.upstream ? {
-      externalEntries: result.upstream.activepiecesPieces,
-      externalDelta: result.upstream.activepiecesDelta,
-      checkedUrl: result.upstream.checkedUrl,
-      warning: result.upstream.warning
-    } : void 0,
-    warnings: result.warnings.map((warning) => warning.replaceAll("Activepieces", "Tangle Integrations Catalog"))
-  };
-}
-function sanitizeEntry(entry) {
-  return {
-    id: entry.id,
-    title: entry.title,
-    description: entry.description,
-    category: entry.category,
-    auth: entry.auth,
-    authFields: entry.authFields,
-    domains: entry.domains.filter((domain) => !domain.toLowerCase().includes("activepieces")),
-    actions: entry.actions.map((action) => ({
-      id: action.id,
-      title: action.title,
-      risk: action.risk,
-      upstreamName: action.upstreamName
-    })),
-    triggers: entry.triggers.map((trigger2) => ({
-      id: trigger2.id,
-      title: trigger2.title,
-      upstreamName: trigger2.upstreamName
-    }))
-  };
-}
-function sanitizeConnector(connector, providerId) {
-  const metadata = connector.metadata ?? {};
-  return {
-    ...connector,
-    providerId,
-    metadata: {
-      source: TANGLE_INTEGRATIONS_CATALOG_SOURCE,
-      providerId,
-      executable: metadata.executable,
-      runtime: "native-adapter-backlog",
-      catalogOnly: metadata.catalogOnly,
-      supportTier: metadata.supportTier,
-      catalogActionCount: metadata.catalogActionCount,
-      catalogTriggerCount: metadata.catalogTriggerCount,
-      license: metadata.license,
-      version: metadata.version,
-      domains: Array.isArray(metadata.domains) ? metadata.domains.filter((domain) => typeof domain === "string" && !domain.toLowerCase().includes("activepieces")) : void 0,
-      ...metadata.overridden ? { overridden: true } : {}
-    }
-  };
-}
-
-// src/registry.ts
-var DEFAULT_ALIASES = INTEGRATION_KIND_ALIASES;
-var DEFAULT_SOURCE_PRECEDENCE = {
-  "first-party": 500,
-  spec: 400,
-  gateway: 300,
-  "tangle-catalog": 100,
-  activepieces: 100,
-  coverage: 50
-};
-var SUPPORT_RANK = {
-  catalogOnly: 0,
-  setupReady: 1,
-  gatewayExecutable: 2,
-  firstPartyExecutable: 3,
-  sandboxExecutable: 4
-};
-function buildDefaultIntegrationRegistry(options = {}) {
-  const includeSpecs = options.includeSpecs ?? true;
-  const includeTangleCatalog = options.includeTangleCatalog ?? options.includeActivepieces ?? true;
-  const sources = [];
-  if (includeSpecs) {
-    sources.push({
-      id: "spec",
-      connectors: listIntegrationSpecs().map((spec) => integrationSpecToConnector(spec, "spec"))
-    });
-  }
-  if (includeTangleCatalog) {
-    const tangleConnectors = options.tangleCatalogRuntimeExecutable ? buildTangleIntegrationCatalogConnectors({
-      providerId: "tangle-catalog",
-      includeCatalogActions: true,
-      executable: true
-    }) : buildActivepiecesConnectors({ providerId: "tangle-catalog" }).map((connector) => ({
-      ...connector,
-      providerId: "tangle-catalog",
-      metadata: {
-        source: "tangle-integrations-catalog",
-        providerId: "tangle-catalog",
-        executable: connector.metadata?.executable,
-        runtime: "native-adapter-backlog",
-        catalogOnly: connector.metadata?.catalogOnly,
-        supportTier: connector.metadata?.supportTier,
-        catalogActionCount: connector.metadata?.catalogActionCount,
-        catalogTriggerCount: connector.metadata?.catalogTriggerCount,
-        license: connector.metadata?.license,
-        version: connector.metadata?.version,
-        domains: Array.isArray(connector.metadata?.domains) ? connector.metadata.domains.filter((domain) => typeof domain === "string" && !domain.toLowerCase().includes("activepieces")) : void 0,
-        ...connector.metadata?.overridden ? { overridden: true } : {}
-      }
-    }));
-    sources.push({
-      id: "tangle-catalog",
-      connectors: tangleConnectors
-    });
-  }
-  return composeIntegrationRegistry(sources);
-}
-function classifyIntegrationCatalogExecutability(registry = buildDefaultIntegrationRegistry()) {
-  const packageByConnector = new Map(
-    listActivepiecesCatalogEntries().filter((entry) => entry.npmPackage).map((entry) => [entry.id, entry.npmPackage])
-  );
-  return registry.entries.map((entry) => {
-    const runtimePackage = packageByConnector.get(entry.connector.id);
-    const tierExecutable = entry.supportTier === "firstPartyExecutable" || entry.supportTier === "sandboxExecutable" || entry.supportTier === "gatewayExecutable";
-    return {
-      canonicalId: entry.canonicalId,
-      executable: tierExecutable && entry.connector.actions.length > 0,
-      supportTier: entry.supportTier,
-      authKind: entry.connector.auth,
-      runtimePackage,
-      actionCount: entry.connector.actions.length,
-      triggerCount: entry.connector.triggers?.length ?? 0
-    };
-  });
-}
-function composeIntegrationRegistry(sources, options = {}) {
-  const aliases = { ...DEFAULT_ALIASES, ...options.aliases ?? {} };
-  const precedence = { ...DEFAULT_SOURCE_PRECEDENCE, ...options.sourcePrecedence ?? {} };
-  const grouped = /* @__PURE__ */ new Map();
-  for (const source of sources) {
-    for (const connector of source.connectors) {
-      const canonicalId = canonicalConnectorId(connector.id, aliases);
-      const candidates = grouped.get(canonicalId) ?? [];
-      candidates.push({
-        source,
-        connector,
-        supportTier: inferIntegrationSupportTier(connector)
-      });
-      grouped.set(canonicalId, candidates);
-    }
-  }
-  const entries = [...grouped.entries()].map(([canonicalId, candidates]) => registryEntry(canonicalId, candidates, precedence, aliases)).sort((a, b) => a.canonicalId.localeCompare(b.canonicalId));
-  const byId = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    byId.set(entry.canonicalId, entry);
-    for (const alias of entry.aliases) byId.set(alias, entry);
-  }
-  return {
-    entries,
-    connectors: entries.map((entry) => entry.connector),
-    byId
-  };
-}
-function summarizeIntegrationRegistry(registry) {
-  const bySupportTier = {
-    catalogOnly: 0,
-    setupReady: 0,
-    gatewayExecutable: 0,
-    firstPartyExecutable: 0,
-    sandboxExecutable: 0
-  };
-  for (const entry of registry.entries) bySupportTier[entry.supportTier] += 1;
-  return {
-    totalEntries: registry.entries.length,
-    totalSources: registry.entries.reduce((sum, entry) => sum + entry.sources.length, 0),
-    toolBindableEntries: registry.entries.filter((entry) => entry.connector.actions.length > 0).length,
-    conflictEntries: registry.entries.filter((entry) => entry.conflicts.length > 0).length,
-    bySupportTier
-  };
-}
-function canonicalConnectorId(id, aliases = DEFAULT_ALIASES) {
-  const normalized = slug2(id);
-  let current = normalized;
-  const seen = /* @__PURE__ */ new Set();
-  while (aliases[current] && !seen.has(current)) {
-    seen.add(current);
-    current = aliases[current];
-  }
-  return current;
-}
-function inferIntegrationSupportTier(connector) {
-  const metadata = connector.metadata ?? {};
-  const explicit = metadata.supportTier;
-  if (isSupportTier(explicit)) return explicit;
-  if (metadata.sandboxExecutable === true) return "sandboxExecutable";
-  if (metadata.source === "first-party-adapter" || connector.providerId === "first-party") return "firstPartyExecutable";
-  if (metadata.source === "gateway-catalog" && metadata.executable === true) return "gatewayExecutable";
-  if (metadata.source === "integration-spec") return "setupReady";
-  if (metadata.source === "coverage-catalog" || metadata.source === "activepieces-community" || metadata.source === "tangle-integrations-catalog" || metadata.catalogOnly === true) return "catalogOnly";
-  if (connector.actions.length > 0) return "gatewayExecutable";
-  return "catalogOnly";
-}
-function registryEntry(canonicalId, candidates, precedence, aliases) {
-  const ordered = [...candidates].sort((a, b) => compareCandidates(a, b, precedence));
-  const primary = ordered[0];
-  const actions = mergeActions(ordered);
-  const triggers = mergeTriggers(ordered);
-  const scopes = unique7(toolBindableCandidates(ordered).flatMap((candidate) => candidate.connector.scopes ?? []));
-  const supportTier = ordered.reduce(
-    (best, candidate) => SUPPORT_RANK[candidate.supportTier] > SUPPORT_RANK[best] ? candidate.supportTier : best,
-    primary.supportTier
-  );
-  const aliasesForEntry = unique7([
-    ...ordered.map((candidate) => candidate.connector.id),
-    ...Object.entries(aliases).filter(([, target]) => canonicalConnectorId(target, aliases) === canonicalId).map(([alias]) => alias)
-  ].map(slug2).filter((id) => id && id !== canonicalId)).sort();
-  const sources = ordered.map((candidate) => ({
-    sourceId: candidate.source.id,
-    providerId: candidate.connector.providerId,
-    connectorId: candidate.connector.id,
-    supportTier: candidate.supportTier,
-    actionCount: candidate.connector.actions.length,
-    triggerCount: candidate.connector.triggers?.length ?? 0
-  }));
-  const conflicts = conflictDiagnostics(ordered);
-  return {
-    canonicalId,
-    aliases: aliasesForEntry,
-    supportTier,
-    sources,
-    conflicts,
-    connector: {
-      ...primary.connector,
-      id: canonicalId,
-      scopes,
-      actions,
-      triggers,
-      metadata: {
-        ...primary.connector.metadata ?? {},
-        registry: {
-          canonicalId,
-          aliases: aliasesForEntry,
-          supportTier,
-          sources,
-          conflicts,
-          toolBindable: actions.length > 0,
-          catalogOnlyActionCount: ordered.filter((candidate) => candidate.supportTier === "catalogOnly").reduce((sum, candidate) => sum + catalogActionCount(candidate.connector), 0)
-        }
-      }
-    }
-  };
-}
-function compareCandidates(a, b, precedence) {
-  return SUPPORT_RANK[b.supportTier] - SUPPORT_RANK[a.supportTier] || (b.source.precedence ?? precedence[b.source.id] ?? 0) - (a.source.precedence ?? precedence[a.source.id] ?? 0) || b.connector.actions.length - a.connector.actions.length || a.connector.id.localeCompare(b.connector.id);
-}
-function mergeActions(candidates) {
-  const out = /* @__PURE__ */ new Map();
-  for (const candidate of toolBindableCandidates(candidates)) {
-    for (const action of candidate.connector.actions) {
-      if (!out.has(action.id)) out.set(action.id, action);
-    }
-  }
-  return [...out.values()];
-}
-function mergeTriggers(candidates) {
-  const out = /* @__PURE__ */ new Map();
-  for (const candidate of toolBindableCandidates(candidates)) {
-    for (const trigger2 of candidate.connector.triggers ?? []) {
-      if (!out.has(trigger2.id)) out.set(trigger2.id, trigger2);
-    }
-  }
-  return out.size > 0 ? [...out.values()] : void 0;
-}
-function toolBindableCandidates(candidates) {
-  const bindable = candidates.filter((candidate) => candidate.supportTier !== "catalogOnly");
-  if (bindable.length === 0) return [];
-  const maxRank = Math.max(...bindable.map((candidate) => SUPPORT_RANK[candidate.supportTier]));
-  return bindable.filter((candidate) => SUPPORT_RANK[candidate.supportTier] === maxRank);
-}
-function catalogActionCount(connector) {
-  const value = connector.metadata?.catalogActionCount;
-  return typeof value === "number" ? value : connector.actions.length;
-}
-function conflictDiagnostics(candidates) {
-  return [
-    conflictFor("auth", candidates.map((candidate) => ({
-      value: candidate.connector.auth,
-      sourceId: candidate.source.id,
-      connectorId: candidate.connector.id
-    }))),
-    conflictFor("category", candidates.map((candidate) => ({
-      value: candidate.connector.category,
-      sourceId: candidate.source.id,
-      connectorId: candidate.connector.id
-    })))
-  ].filter((conflict) => Boolean(conflict));
-}
-function conflictFor(field, values) {
-  const uniqueValues = new Set(values.map((entry) => entry.value));
-  if (uniqueValues.size <= 1) return void 0;
-  return { field, values };
-}
-function isSupportTier(value) {
-  return value === "catalogOnly" || value === "setupReady" || value === "gatewayExecutable" || value === "firstPartyExecutable" || value === "sandboxExecutable";
-}
-function slug2(value) {
-  return value.trim().toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function unique7(values) {
-  return [...new Set(values)];
-}
-
-// src/catalog.ts
-var riskRank2 = {
-  read: 0,
-  write: 1,
-  destructive: 2
-};
-function integrationToolName(providerId, connectorId, actionId) {
-  return `int_${encodeToolPart(providerId)}_${encodeToolPart(connectorId)}_${encodeToolPart(actionId)}`;
-}
-function parseIntegrationToolName(name) {
-  const parts = name.split("_");
-  if (parts.length !== 4 || parts[0] !== "int") {
-    throw new Error(`Invalid integration tool name: ${name}`);
-  }
-  return {
-    providerId: decodeToolPart(parts[1]),
-    connectorId: decodeToolPart(parts[2]),
-    actionId: decodeToolPart(parts[3])
-  };
-}
-function buildIntegrationToolCatalog(connectors) {
-  const tools = [];
-  for (const connector of connectors) {
-    for (const action of connector.actions) {
-      tools.push(flattenIntegrationToolDefinition(connector, action));
-    }
-  }
-  return tools;
-}
-function flattenIntegrationToolDefinition(connector, action) {
-  const tags = unique8([
-    connector.id,
-    connector.providerId,
-    connector.title,
-    connector.category,
-    action.id,
-    action.title,
-    action.risk,
-    action.dataClass,
-    ...connector.scopes ?? [],
-    ...action.requiredScopes ?? []
-  ].flatMap(tokenize));
-  return {
-    name: integrationToolName(connector.providerId, connector.id, action.id),
-    title: `${connector.title}: ${action.title}`,
-    description: action.description ?? `${action.risk} action ${action.id} on ${connector.title}`,
-    providerId: connector.providerId,
-    connectorId: connector.id,
-    connectorTitle: connector.title,
-    category: connector.category,
-    action,
-    risk: action.risk,
-    dataClass: action.dataClass,
-    requiredScopes: action.requiredScopes,
-    inputSchema: action.inputSchema,
-    outputSchema: action.outputSchema,
-    tags,
-    supportTier: toolSupportTier(connector),
-    runnable: toolRunnable(connector)
-  };
-}
-function describeIntegrationTool(registry, toolName) {
-  let parsed;
-  try {
-    parsed = parseIntegrationToolName(toolName);
-  } catch {
-    return void 0;
-  }
-  const entry = registry.byId.get(parsed.connectorId);
-  if (!entry) return void 0;
-  const action = entry.connector.actions.find((candidate) => candidate.id === parsed.actionId);
-  if (!action) return void 0;
-  return flattenIntegrationToolDefinition(entry.connector, action);
-}
-function buildIntegrationCatalogView(input) {
-  const runtimeConnectors = input.executableRegistry?.connectors ?? input.discoveryRegistry.connectors.filter((connector) => toolRunnable(connector));
-  const runtimeTools = buildIntegrationToolCatalog(runtimeConnectors);
-  const discoveryTools = buildIntegrationToolCatalog(input.discoveryRegistry.connectors);
-  return {
-    connectors: input.discoveryRegistry.connectors,
-    conflicts: input.discoveryRegistry.entries.flatMap((entry) => entry.conflicts),
-    summary: summarizeIntegrationRegistry(input.discoveryRegistry),
-    tools: runtimeTools,
-    runtimeTools,
-    discoveryTools
-  };
-}
-function searchIntegrationTools(catalog, query, filters = {}) {
-  const terms = tokenize(query);
-  const filtered = catalog.filter((tool) => {
-    if (filters.providerId && tool.providerId !== filters.providerId) return false;
-    if (filters.connectorId && tool.connectorId !== filters.connectorId) return false;
-    if (filters.category && tool.category !== filters.category) return false;
-    if (filters.dataClass && tool.dataClass !== filters.dataClass) return false;
-    if (filters.maxRisk && riskRank2[tool.risk] > riskRank2[filters.maxRisk]) return false;
-    return true;
-  });
-  const scored = filtered.map((tool) => scoreTool(tool, terms));
-  return scored.filter((result) => terms.length === 0 || result.score > 0).sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name)).slice(0, filters.limit ?? 20);
-}
-function toMcpTools(tools) {
-  return tools.map((tool) => ({
-    name: tool.name,
-    description: `${tool.title}. ${tool.description}`,
-    inputSchema: tool.inputSchema ?? {
-      type: "object",
-      additionalProperties: true,
-      properties: {}
-    }
-  }));
-}
-function scoreTool(tool, terms) {
-  if (terms.length === 0) return { tool, score: 1, matched: [] };
-  const haystack = new Set(tool.tags);
-  const identity = new Set(
-    [tool.connectorId, tool.connectorTitle, tool.providerId].flatMap(tokenize)
-  );
-  const matched = [];
-  let score = 0;
-  for (const term of terms) {
-    if (identity.has(term)) {
-      matched.push(term);
-      score += 6;
-      continue;
-    }
-    if (haystack.has(term)) {
-      matched.push(term);
-      score += 4;
-      continue;
-    }
-    if (tool.tags.some((tag) => tag.includes(term))) {
-      matched.push(term);
-      score += 1;
-    }
-  }
-  if (tool.risk === "read") score += 0.25;
-  return { tool, score, matched: unique8(matched) };
-}
-function tokenize(value) {
-  return value.toLowerCase().split(/[^a-z0-9]+/g).map((part) => part.trim()).filter(Boolean);
-}
-function encodeToolPart(value) {
-  return Buffer.from(value, "utf8").toString("base64url").replace(/_/g, ".");
-}
-function decodeToolPart(value) {
-  return Buffer.from(value.replace(/\./g, "_"), "base64url").toString("utf8");
-}
-function unique8(values) {
-  return [...new Set(values)];
-}
-function toolSupportTier(connector) {
-  const registry = connector.metadata?.registry;
-  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
-    const supportTier2 = registry.supportTier;
-    return isIntegrationSupportTier(supportTier2) ? supportTier2 : void 0;
-  }
-  const supportTier = connector.metadata?.supportTier;
-  return isIntegrationSupportTier(supportTier) ? supportTier : void 0;
-}
-function toolRunnable(connector) {
-  const registry = connector.metadata?.registry;
-  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
-    const toolBindable = registry.toolBindable;
-    if (typeof toolBindable === "boolean") return toolBindable;
-  }
-  const tier = toolSupportTier(connector);
-  return tier === "gatewayExecutable" || tier === "firstPartyExecutable" || tier === "sandboxExecutable";
-}
-function isIntegrationSupportTier(value) {
-  return value === "catalogOnly" || value === "setupReady" || value === "gatewayExecutable" || value === "firstPartyExecutable" || value === "sandboxExecutable";
-}
-
-export {
-  ACTIVEPIECES_OVERRIDES,
-  getActivepiecesOverride,
-  listActivepiecesCatalogEntries,
-  buildActivepiecesConnectors,
-  createCatalogExecutorProvider,
-  createActivepiecesExecutorProvider,
-  integrationToolName,
-  parseIntegrationToolName,
-  buildIntegrationToolCatalog,
-  flattenIntegrationToolDefinition,
-  describeIntegrationTool,
-  buildIntegrationCatalogView,
-  searchIntegrationTools,
-  toMcpTools,
-  ACTIVEPIECES_PUBLIC_CATALOG_URL,
-  extractActivepiecesPublicPieceCount,
-  auditIntegrationCatalogFreshness,
-  TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID,
-  TANGLE_INTEGRATIONS_CATALOG_SOURCE,
-  listTangleNativeAdapterIds,
-  listTangleIntegrationCatalogEntries,
-  listTangleIntegrationContracts,
-  listTangleIntegrationCatalogRuntimePackages,
-  buildTangleCatalogRuntimePackageManifest,
-  renderTangleCatalogRuntimePnpmAddCommand,
-  buildTangleIntegrationCatalogConnectors,
-  createTangleCatalogExecutorProvider,
-  extractExternalCatalogPublicCount,
-  auditTangleIntegrationCatalogFreshness,
-  buildDefaultIntegrationRegistry,
-  classifyIntegrationCatalogExecutability,
-  composeIntegrationRegistry,
-  summarizeIntegrationRegistry,
-  canonicalConnectorId,
-  inferIntegrationSupportTier,
-  IntegrationError,
-  createConnectorAdapterProvider,
-  adapterManifestsToConnectors,
-  createConnectorAdapterCatalogSource,
-  manifestToConnector,
-  InMemoryIntegrationSecretStore,
-  InMemoryIntegrationOAuthStateStore,
-  createConnectionCredentialResolver,
-  resolveConnectionCredentials,
-  createCredentialBackedAdapterProvider,
-  revokeConnection,
-  InMemoryIntegrationAuditStore,
-  createIntegrationAuditEvent,
-  createAuditingActionGuard,
-  sanitizeAuditConnection,
-  InMemoryIntegrationApprovalStore,
-  ApprovalBackedPolicyEngine,
-  createApprovalBackedPolicyEngine,
-  resolveIntegrationApproval,
-  CANONICAL_INTEGRATION_ACTIONS,
-  buildCanonicalLaunchConnectors,
-  canonicalActionConnectorId,
-  DEFAULT_INTEGRATION_BRIDGE_ENV,
-  buildIntegrationBridgePayload,
-  encodeIntegrationBridgePayload,
-  decodeIntegrationBridgePayload,
-  buildIntegrationBridgeEnvironment,
-  parseIntegrationBridgeEnvironment,
-  redactIntegrationBridgePayload,
-  TangleAppsClient,
-  createTangleAppsClient,
-  TangleIntegrationsClient,
-  createTangleIntegrationsClient,
-  renderConsentSummary,
-  renderApprovalCopy,
-  discoverWorkspaceCapabilities,
-  filterDiscoveryByWorkspaceScopes,
-  InMemoryIntegrationEventStore,
-  receiveIntegrationWebhook,
-  storedEventToTriggerEvent,
-  InMemoryIntegrationIdempotencyStore,
-  DefaultIntegrationActionGuard,
-  createDefaultIntegrationActionGuard,
-  InMemoryIntegrationHealthcheckStore,
-  runIntegrationHealthcheck,
-  runIntegrationHealthchecks,
-  healthcheckRequest,
-  validateIntegrationManifest,
-  assertValidIntegrationManifest,
-  inferIntegrationManifestFromTools,
-  explainMissingRequirements,
-  calendarExercisePlannerManifest,
-  PROVIDER_PASSTHROUGH_ACTION,
-  validateProviderPassthroughRequest,
-  StaticIntegrationPolicyEngine,
-  createDefaultIntegrationPolicyEngine,
-  buildApprovalRequest,
-  redactApprovalRequest,
-  createPlatformIntegrationPolicyPreset,
-  buildIntegrationInvocationEnvelope,
-  invocationRequestFromEnvelope,
-  validateIntegrationInvocationEnvelope,
-  redactInvocationEnvelope,
-  redactCapability,
-  normalizeIntegrationResult,
-  dispatchIntegrationInvocation,
-  IntegrationSandboxHost,
-  importOpenApiConnector,
-  importGraphqlConnector,
-  importMcpConnector,
-  createGatewayCatalogProvider,
-  normalizeGatewayCatalog,
-  InMemoryIntegrationGrantStore,
-  IntegrationRuntime,
-  createIntegrationRuntime,
-  InMemoryIntegrationWorkflowStore,
-  IntegrationWorkflowRuntime,
-  createIntegrationWorkflowRuntime,
-  InMemoryConnectionStore,
-  IntegrationHub,
-  sanitizeConnection,
-  createMockIntegrationProvider,
-  createHttpIntegrationProvider,
-  signCapability,
-  verifyCapabilityToken
-};
-//# sourceMappingURL=chunk-ZC3ZE7TN.js.map