@tangle-network/agent-integrations 0.59.0 → 0.59.1

package/dist/hub-D13zPQGr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-D13zPQGr.js","names":["base64UrlEncode"],"sources":["../src/core-error.ts","../src/adapter-provider.ts","../src/credentials.ts","../src/hub.ts"],"sourcesContent":["/**\n * IntegrationError — the runtime error class thrown by the hub, providers,\n * adapters, and runtime helpers. Lives in its own module so any source\n * file can import it without pulling the package barrel (`./index.ts`)\n * and forming a cycle.\n *\n * The richer {@link IntegrationRuntimeError} (in `./errors.ts`) is a\n * separate, structured error type used by consumers wiring custom\n * error → HTTP-status mappings. `IntegrationError` is the legacy/canonical\n * throw shape kept for back-compat with everything that already catches it.\n */\n\nexport type IntegrationErrorRuntimeCode =\n  | 'provider_not_found'\n  | 'connector_not_found'\n  | 'connection_not_found'\n  | 'connection_not_active'\n  | 'auth_not_supported'\n  | 'capability_invalid'\n  | 'capability_expired'\n  | 'scope_denied'\n  | 'action_denied'\n  | 'action_not_found'\n  | 'trigger_not_found'\n  | 'approval_required'\n  | 'policy_denied'\n  | 'config_missing'\n  | 'provider_failure'\n\nexport class IntegrationError extends Error {\n  constructor(\n    message: string,\n    readonly code: IntegrationErrorRuntimeCode,\n  ) {\n    super(message)\n    this.name = 'IntegrationError'\n  }\n}\n","import type {\n  CapabilityMutationResult,\n  CapabilityReadResult,\n  ConnectorAdapter,\n  ConnectorCredentials,\n  ConnectorInvocation,\n  OAuth2TokenClientAuthMethod,\n  OAuth2UrlTemplateMetadataSpec,\n  ResolvedDataSource,\n  TokenMetadataSource,\n} from './connectors/types.js'\nimport type {\n  CompleteAuthRequest,\n  IntegrationActionRequest,\n  IntegrationActionResult,\n  IntegrationCatalogSource,\n  IntegrationConnection,\n  IntegrationConnector,\n  IntegrationProvider,\n  IntegrationProviderKind,\n  StartAuthRequest,\n  StartAuthResult,\n} from './core-types.js'\nimport { IntegrationError } from './core-error.js'\nimport {\n  createOAuthBasicAuthorizationHeader,\n  createOAuthTokenRequestHeaders,\n  oauthClientCredentialRedactionValues,\n  redactOAuthSensitiveText,\n} from './connectors/oauth.js'\n\n/** OAuth client credentials the host resolves at start/exchange time.\n *  The lib never reads env or any vault — kept edge-runtime-safe. */\nexport interface OAuthClientCredentials {\n  clientId: string\n  /** Omit for public clients whose manifest uses tokenClientAuthMethod=none. */\n  clientSecret?: string\n}\n\nexport interface ConnectorAdapterProviderOptions {\n  id?: string\n  kind?: IntegrationProviderKind\n  adapters: ConnectorAdapter[]\n  resolveDataSource: (connection: IntegrationConnection) => Promise<ResolvedDataSource> | ResolvedDataSource\n  /** Invoked when an adapter rotates credentials during executeRead /\n   *  executeMutation (e.g. an OAuth access token refreshed on expiry). The\n   *  host re-encrypts + persists the rotated envelope so the next expiry\n   *  does not force a reconnect. Carries the connection so the host can\n   *  resolve the secretRef. */\n  onCredentialsRotated?: (event: {\n    connection: IntegrationConnection\n    credentials: ConnectorCredentials\n  }) => Promise<void> | void\n  /** Resolve OAuth client_id and, for confidential clients, client_secret at\n   *  start- and exchange-time. Host owns env, vault, and per-tenant\n   *  overrides. Return null to refuse the flow (lib will throw\n   *  `config_missing`). The lib never logs the secret nor includes it\n   *  in thrown error messages. */\n  resolveOAuthClient?: (input: { connectorId: string }) =>\n    | Promise<OAuthClientCredentials | null>\n    | OAuthClientCredentials\n    | null\n  /** Fetch implementation forwarded to the OAuth token exchange. Default\n   *  is `globalThis.fetch`. Tests inject a mock. */\n  fetchImpl?: typeof fetch\n  now?: () => Date\n}\n\nexport function createConnectorAdapterProvider(options: ConnectorAdapterProviderOptions): IntegrationProvider {\n  const providerId = options.id ?? 'first-party'\n  const now = options.now ?? (() => new Date())\n  const fetchImpl = options.fetchImpl ?? (globalThis.fetch?.bind(globalThis) as typeof fetch | undefined)\n  const adapters = new Map<string, ConnectorAdapter>()\n  for (const adapter of options.adapters) {\n    adapters.set(adapter.manifest.kind, adapter)\n  }\n  return {\n    id: providerId,\n    kind: options.kind ?? 'first_party',\n    listConnectors: () => [...adapters.values()].map((adapter) => manifestToConnector(providerId, adapter)),\n    async startAuth(request: StartAuthRequest): Promise<StartAuthResult> {\n      const adapter = adapters.get(request.connectorId)\n      if (!adapter) {\n        throw new IntegrationError(\n          `Connector adapter ${request.connectorId} not found.`,\n          'connector_not_found',\n        )\n      }\n      const auth = oauthManifestAuth(adapter.manifest.auth)\n      if (!auth) {\n        throw new IntegrationError(\n          `Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`,\n          'auth_not_supported',\n        )\n      }\n      if ((auth.grantType ?? 'authorization_code') !== 'authorization_code') {\n        throw new IntegrationError(\n          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,\n          'auth_not_supported',\n        )\n      }\n      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId)\n      const tokenClientAuthMethod = resolveTokenClientAuthMethod(\n        auth.tokenClientAuthMethod,\n        request.connectorId,\n      )\n      if (!options.resolveOAuthClient) {\n        throw new IntegrationError(\n          `OAuth client resolver missing on adapter provider; cannot start auth for ${request.connectorId}.`,\n          'config_missing',\n        )\n      }\n      const client = await options.resolveOAuthClient({ connectorId: request.connectorId })\n      if (\n        !client ||\n        !client.clientId ||\n        (tokenClientAuthMethod !== 'none' && !client.clientSecret)\n      ) {\n        throw new IntegrationError(\n          `OAuth client credentials unavailable for ${request.connectorId}.`,\n          'config_missing',\n        )\n      }\n      if (!auth.authorizationUrl) {\n        throw new IntegrationError(\n          `Connector ${request.connectorId} uses the ${auth.grantType ?? 'authorization_code'} grant and has no authorization URL to redirect to.`,\n          'auth_not_supported',\n        )\n      }\n      const scopes =\n        request.requestedScopes && request.requestedScopes.length > 0\n          ? request.requestedScopes\n          : auth.scopes\n      const url = new URL(resolveOAuthUrlTemplate(\n        auth.authorizationUrl,\n        request.metadata,\n        request.connectorId,\n        auth.urlTemplateMetadata,\n      ))\n      url.searchParams.set('response_type', 'code')\n      url.searchParams.set(\n        resolveOAuthParameterName(\n          auth.authorizationClientIdParam,\n          'client_id',\n          request.connectorId,\n        ),\n        client.clientId,\n      )\n      url.searchParams.set('redirect_uri', request.redirectUri)\n      if (auth.sendScopeParam !== false && scopes.length > 0) {\n        url.searchParams.set('scope', scopes.join(auth.scopeSeparator ?? ' '))\n      }\n      const state = request.state ?? randomState()\n      url.searchParams.set('state', state)\n      if (auth.extraAuthParams) {\n        for (const [key, value] of Object.entries(auth.extraAuthParams)) {\n          url.searchParams.set(key, value)\n        }\n      }\n      if (pkce === 'unsupported') {\n        url.searchParams.delete('code_challenge')\n        url.searchParams.delete('code_challenge_method')\n      } else {\n        url.searchParams.set(\n          'code_challenge',\n          requirePkceChallenge(request.codeChallenge, request.connectorId),\n        )\n        url.searchParams.set('code_challenge_method', 'S256')\n      }\n      return {\n        providerId,\n        connectorId: request.connectorId,\n        authUrl: url.toString(),\n        state,\n        metadata: request.metadata,\n      }\n    },\n    async completeAuth(request: CompleteAuthRequest): Promise<IntegrationConnection> {\n      const adapter = adapters.get(request.connectorId)\n      if (!adapter) {\n        throw new IntegrationError(\n          `Connector adapter ${request.connectorId} not found.`,\n          'connector_not_found',\n        )\n      }\n      const auth = oauthManifestAuth(adapter.manifest.auth)\n      if (!auth) {\n        throw new IntegrationError(\n          `Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`,\n          'auth_not_supported',\n        )\n      }\n      if ((auth.grantType ?? 'authorization_code') !== 'authorization_code') {\n        throw new IntegrationError(\n          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,\n          'auth_not_supported',\n        )\n      }\n      const tokenClientAuthMethod = resolveTokenClientAuthMethod(\n        auth.tokenClientAuthMethod,\n        request.connectorId,\n      )\n      const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId)\n      if (!request.code) {\n        throw new IntegrationError(\n          `Authorization code missing on completeAuth for ${request.connectorId}.`,\n          'config_missing',\n        )\n      }\n      if (!options.resolveOAuthClient) {\n        throw new IntegrationError(\n          `OAuth client resolver missing on adapter provider; cannot complete auth for ${request.connectorId}.`,\n          'config_missing',\n        )\n      }\n      const client = await options.resolveOAuthClient({ connectorId: request.connectorId })\n      if (\n        !client ||\n        !client.clientId ||\n        (tokenClientAuthMethod !== 'none' && !client.clientSecret)\n      ) {\n        throw new IntegrationError(\n          `OAuth client credentials unavailable for ${request.connectorId}.`,\n          'config_missing',\n        )\n      }\n      if (!fetchImpl) {\n        throw new IntegrationError(\n          'No fetch implementation available; inject fetchImpl into createConnectorAdapterProvider.',\n          'config_missing',\n        )\n      }\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code: request.code,\n        redirect_uri: request.redirectUri,\n      })\n      const codeVerifier = pkce === 'unsupported'\n        ? undefined\n        : requirePkceVerifier(request.codeVerifier, request.connectorId)\n      if (codeVerifier) body.set('code_verifier', codeVerifier)\n      const headers = createOAuthTokenRequestHeaders(auth.tokenRequestHeaders)\n      if (tokenClientAuthMethod === 'none') {\n        body.set(\n          resolveOAuthParameterName(\n            auth.tokenClientIdParam,\n            'client_id',\n            request.connectorId,\n          ),\n          client.clientId,\n        )\n      } else if (tokenClientAuthMethod === 'client_secret_post') {\n        body.set(\n          resolveOAuthParameterName(\n            auth.tokenClientIdParam,\n            'client_id',\n            request.connectorId,\n          ),\n          client.clientId,\n        )\n        body.set(\n          resolveOAuthParameterName(\n            auth.tokenClientSecretParam,\n            'client_secret',\n            request.connectorId,\n          ),\n          client.clientSecret!,\n        )\n      } else {\n        const authorization = createOAuthBasicAuthorizationHeader(\n          client.clientId,\n          client.clientSecret!,\n          base64Encode,\n        )\n        headers.authorization = authorization\n      }\n      const redactionValues = [\n        request.code,\n        ...(codeVerifier ? [codeVerifier] : []),\n        ...oauthClientCredentialRedactionValues(\n          client.clientId,\n          client.clientSecret,\n          headers.authorization,\n        ),\n      ]\n      const tokenUrl = resolveOAuthUrlTemplate(\n        auth.tokenUrl,\n        request.metadata,\n        request.connectorId,\n        auth.urlTemplateMetadata,\n      )\n      let res: Response\n      try {\n        res = await fetchImpl(tokenUrl, {\n          method: 'POST',\n          headers,\n          body,\n        })\n      } catch (cause) {\n        const detail = redactOAuthSensitiveText(\n          (cause as Error)?.message ?? 'unknown',\n          redactionValues,\n        )\n        throw new IntegrationError(\n          `OAuth token exchange transport error for ${request.connectorId}: ${detail}`,\n          'provider_failure',\n        )\n      }\n      if (!res.ok) {\n        const text = await res.text().catch(() => '')\n        const statusText = redactOAuthSensitiveText(res.statusText, redactionValues)\n        const redactedText = redactOAuthSensitiveText(text, redactionValues)\n        const detail = `${res.status} ${statusText} — ${redactedText.slice(0, 200)}`\n        throw new IntegrationError(\n          `OAuth token exchange failed for ${request.connectorId}: ${detail}`,\n          'provider_failure',\n        )\n      }\n      let json: {\n        access_token?: string\n        refresh_token?: string\n        expires_in?: number\n        scope?: string\n        token_type?: string\n      } & Record<string, unknown>\n      try {\n        json = await res.json()\n      } catch {\n        throw new IntegrationError(\n          `OAuth token exchange returned non-JSON body for ${request.connectorId}.`,\n          'provider_failure',\n        )\n      }\n      if (!json.access_token) {\n        throw new IntegrationError(\n          `OAuth token exchange returned no access_token for ${request.connectorId}.`,\n          'provider_failure',\n        )\n      }\n      const grantedScopes = typeof json.scope === 'string' && json.scope.length > 0\n        ? json.scope.split(/[\\s,]+/).filter(Boolean)\n        : []\n      const issued = now()\n      const issuedIso = issued.toISOString()\n      const expiresAt = typeof json.expires_in === 'number' && json.expires_in > 0\n        ? new Date(issued.getTime() + json.expires_in * 1000).toISOString()\n        : undefined\n      // Persist provider-specific token-response fields the connector declared\n      // via `auth.tokenMetadata` into the connection metadata (e.g. Gong's\n      // per-customer `api_base_url_for_customer`). The captured values win over\n      // any same-key request.metadata — the token exchange is authoritative.\n      const capturedMetadata = captureTokenMetadata(auth.tokenMetadata, json, request.connectorId)\n      return {\n        id: randomConnectionId(),\n        owner: request.owner,\n        providerId,\n        connectorId: request.connectorId,\n        status: 'active',\n        grantedScopes,\n        createdAt: issuedIso,\n        updatedAt: issuedIso,\n        expiresAt,\n        metadata: { ...request.metadata, ...capturedMetadata },\n      }\n    },\n    async invokeAction(connection, request) {\n      const adapter = adapters.get(connection.connectorId)\n      if (!adapter) {\n        throw new IntegrationError(`Connector adapter ${connection.connectorId} not found.`, 'connector_not_found')\n      }\n      const capability = adapter.manifest.capabilities.find((candidate) => candidate.name === request.action)\n      if (!capability) {\n        throw new IntegrationError(`Capability ${request.action} is not defined by ${connection.connectorId}.`, 'action_not_found')\n      }\n      const source = await options.resolveDataSource(connection)\n      let rotationPersistence = Promise.resolve()\n      const persistRotation = (credentials: ConnectorCredentials): Promise<void> => {\n        if (!options.onCredentialsRotated) return Promise.resolve()\n        rotationPersistence = rotationPersistence.then(() =>\n          options.onCredentialsRotated!({ connection, credentials }),\n        )\n        // Some third-party adapters do not await this callback. Attach a\n        // rejection observer immediately, then let the original promise keep\n        // its rejection for the adapter or the provider's finally block.\n        void rotationPersistence.catch(() => {})\n        return rotationPersistence\n      }\n      const invocation: ConnectorInvocation = {\n        source,\n        capabilityName: request.action,\n        args: toRecord(request.input),\n        idempotencyKey: request.idempotencyKey ?? `idem_${connection.id}_${request.action}_${now().getTime()}`,\n        expectedEtag: typeof request.metadata?.expectedEtag === 'string' ? request.metadata.expectedEtag : undefined,\n        callSessionId: typeof request.metadata?.callSessionId === 'string' ? request.metadata.callSessionId : undefined,\n        onCredentialsRotated: options.onCredentialsRotated\n          ? persistRotation\n          : undefined,\n      }\n      try {\n        if (capability.class === 'read') {\n          if (!adapter.executeRead) {\n            throw new IntegrationError(`Connector ${connection.connectorId} does not implement reads.`, 'action_not_found')\n          }\n          const result = await adapter.executeRead(invocation)\n          return readResultToAction(request, result)\n        }\n        if (capability.class === 'mutation') {\n          if (!adapter.executeMutation) {\n            throw new IntegrationError(`Connector ${connection.connectorId} does not implement mutations.`, 'action_not_found')\n          }\n          const result = await adapter.executeMutation(invocation)\n          return mutationResultToAction(request, result)\n        }\n        throw new IntegrationError(`Capability ${request.action} is not invokable as an action.`, 'action_not_found')\n      } finally {\n        // A provider can rotate a refresh token before the requested action\n        // fails. Persist that full envelope regardless of the action outcome.\n        await rotationPersistence\n      }\n    },\n  }\n}\n\nexport function adapterManifestsToConnectors(\n  adapters: ConnectorAdapter[],\n  providerId = 'first-party',\n): IntegrationConnector[] {\n  return adapters.map((adapter) => manifestToConnector(providerId, adapter))\n}\n\nexport function createConnectorAdapterCatalogSource(options: {\n  id?: string\n  providerId?: string\n  adapters: ConnectorAdapter[]\n  precedence?: number\n}): IntegrationCatalogSource {\n  const sourceId = options.id ?? 'first-party'\n  return {\n    id: sourceId,\n    precedence: options.precedence,\n    connectors: adapterManifestsToConnectors(options.adapters, options.providerId ?? sourceId),\n  }\n}\n\nexport function manifestToConnector(providerId: string, adapter: ConnectorAdapter): IntegrationConnector {\n  const manifest = adapter.manifest\n  const primaryAuth = primaryManifestAuth(manifest.auth)\n  const oauthAuth = oauthManifestAuth(manifest.auth)\n  return {\n    id: manifest.kind,\n    providerId,\n    title: manifest.displayName,\n    category: mapCategory(manifest.category),\n    auth: mapAuth(primaryAuth.kind),\n    scopes: primaryAuth.kind === 'oauth2' ? primaryAuth.scopes : [],\n    actions: manifest.capabilities\n      .filter((capability) => capability.class === 'read' || capability.class === 'mutation')\n      .map((capability) => ({\n        id: capability.name,\n        title: titleFromName(capability.name),\n        risk: capability.class === 'read' ? 'read' : capability.externalEffect ? 'destructive' : 'write',\n        requiredScopes: capability.requiredScopes ?? [],\n        dataClass: inferDataClass(manifest.category),\n        ...(capability.consistencyModel ? { consistencyModel: capability.consistencyModel } : {}),\n        description: capability.description,\n        approvalRequired: capability.class === 'mutation',\n        inputSchema: capability.parameters,\n      })),\n    metadata: {\n      source: 'first-party-adapter',\n      supportTier: 'firstPartyExecutable',\n      executable: true,\n      oauthPkce: oauthAuth\n        ? resolveOAuthPkceMode(oauthAuth.pkce, manifest.kind)\n        : undefined,\n      authOptions: manifest.auth.kind === 'one_of' ? manifest.auth.options.map((auth) => auth.kind) : [manifest.auth.kind],\n      preferredAuth: manifest.auth.kind === 'one_of' ? manifest.auth.preferred : manifest.auth.kind,\n    },\n  }\n}\n\nfunction readResultToAction(request: IntegrationActionRequest, result: CapabilityReadResult): IntegrationActionResult {\n  return {\n    ok: true,\n    action: request.action,\n    output: result.data,\n    metadata: {\n      etag: result.etag,\n      fetchedAt: result.fetchedAt,\n    },\n  }\n}\n\nfunction mutationResultToAction(request: IntegrationActionRequest, result: CapabilityMutationResult): IntegrationActionResult {\n  if (result.status === 'committed') {\n    return {\n      ok: true,\n      action: request.action,\n      output: result.data,\n      metadata: {\n        etagAfter: result.etagAfter,\n        committedAt: result.committedAt,\n        idempotentReplay: result.idempotentReplay,\n      },\n    }\n  }\n  if (result.status === 'conflict') {\n    return {\n      ok: false,\n      action: request.action,\n      output: {\n        conflict: true,\n        message: result.message,\n        alternatives: result.alternatives,\n        currentState: result.currentState,\n      },\n    }\n  }\n  return {\n    ok: false,\n    action: request.action,\n    output: {\n      rateLimited: true,\n      retryAfterMs: result.retryAfterMs,\n      message: result.message,\n    },\n  }\n}\n\nfunction mapAuth(kind: ConnectorAdapter['manifest']['auth']['kind']): IntegrationConnector['auth'] {\n  if (kind === 'one_of') return 'custom'\n  if (kind === 'oauth2') return 'oauth2'\n  if (kind === 'api-key') return 'api_key'\n  if (kind === 'none') return 'none'\n  return 'custom'\n}\n\nfunction primaryManifestAuth(auth: ConnectorAdapter['manifest']['auth']): Exclude<ConnectorAdapter['manifest']['auth'], { kind: 'one_of' }> {\n  if (auth.kind !== 'one_of') return auth\n  return auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0]\n}\n\nfunction oauthManifestAuth(auth: ConnectorAdapter['manifest']['auth']): Extract<Exclude<ConnectorAdapter['manifest']['auth'], { kind: 'one_of' }>, { kind: 'oauth2' }> | undefined {\n  if (auth.kind === 'oauth2') return auth\n  if (auth.kind !== 'one_of') return undefined\n  return auth.options.find((option): option is Extract<typeof option, { kind: 'oauth2' }> => option.kind === 'oauth2')\n}\n\n/** Resolve the manifest value at the last possible point before an OAuth\n * request. The runtime check matters because adapters can enter through JS or\n * an `any` cast without first passing the static manifest validator. */\nfunction resolveTokenClientAuthMethod(\n  value: unknown,\n  connectorId: string,\n): OAuth2TokenClientAuthMethod {\n  if (value === undefined || value === 'client_secret_post') {\n    return 'client_secret_post'\n  }\n  if (value === 'none' || value === 'client_secret_basic') return value\n  throw new IntegrationError(\n    `Connector ${connectorId} has an unsupported OAuth token client authentication method.`,\n    'config_missing',\n  )\n}\n\nfunction resolveOAuthPkceMode(\n  value: unknown,\n  connectorId: string,\n): 'required' | 'supported' | 'unsupported' {\n  if (value === undefined || value === 'required') return 'required'\n  if (value === 'supported' || value === 'unsupported') return value\n  throw new IntegrationError(\n    `Connector ${connectorId} has an invalid OAuth PKCE posture.`,\n    'config_missing',\n  )\n}\n\nfunction requirePkceChallenge(value: string | undefined, connectorId: string): string {\n  if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) {\n    throw new IntegrationError(\n      `OAuth PKCE S256 challenge missing or invalid for ${connectorId}.`,\n      'config_missing',\n    )\n  }\n  return value\n}\n\nfunction requirePkceVerifier(value: string | undefined, connectorId: string): string {\n  if (!value || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) {\n    throw new IntegrationError(\n      `OAuth PKCE verifier missing or invalid for ${connectorId}.`,\n      'config_missing',\n    )\n  }\n  return value\n}\n\nfunction resolveOAuthParameterName(\n  value: string | undefined,\n  fallback: string,\n  connectorId: string,\n): string {\n  const name = value ?? fallback\n  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {\n    throw new IntegrationError(\n      `Connector ${connectorId} declares an invalid OAuth parameter name.`,\n      'config_missing',\n    )\n  }\n  return name\n}\n\n/** Encodes UTF-8 credentials without importing Node's Buffer, so the adapter\n * provider remains usable in browser and edge runtimes. */\nfunction base64Encode(value: string): string {\n  const btoa = globalThis.btoa\n  if (typeof btoa !== 'function') {\n    throw new IntegrationError(\n      'OAuth client_secret_basic requires a base64 encoder in this runtime.',\n      'config_missing',\n    )\n  }\n  const bytes = new TextEncoder().encode(value)\n  let binary = ''\n  for (const byte of bytes) binary += String.fromCharCode(byte)\n  return btoa(binary)\n}\n\n/** Resolve provider-owned tenant labels embedded in OAuth URLs.\n *\n * Shopify and Gorgias put the merchant name in the hostname. Only one DNS\n * label is accepted for each placeholder, so connection metadata cannot turn\n * a provider URL into an arbitrary credential destination.\n */\nfunction resolveOAuthUrlTemplate(\n  template: string,\n  metadata: Record<string, unknown> | undefined,\n  connectorId: string,\n  metadataSpecs?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>,\n): string {\n  const placeholders = [...template.matchAll(/\\{([A-Za-z][A-Za-z0-9_]*)\\}/g)]\n  let resolved = template\n  for (const match of placeholders) {\n    const key = match[1]\n    const raw = metadata?.[key]\n    const metadataSpec = metadataSpecs?.[key]\n    if (metadataSpec?.kind === 'base-url') {\n      if (typeof raw !== 'string') {\n        throw new IntegrationError(\n          `OAuth URL for ${connectorId} requires metadata.${key} as a provider base URL.`,\n          'config_missing',\n        )\n      }\n      resolved = resolved.replaceAll(\n        match[0],\n        resolveOAuthMetadataBaseUrl(raw, metadataSpec, connectorId, key),\n      )\n      continue\n    }\n    if (metadataSpec?.kind === 'path-segment') {\n      if (!isOAuthPathSegmentPlaceholder(template, match.index ?? -1, match[0])) {\n        throw new IntegrationError(\n          `OAuth URL for ${connectorId} declares metadata.${key} outside a complete path segment.`,\n          'config_missing',\n        )\n      }\n      if (typeof raw !== 'string' || !isOAuthPathSegment(raw.trim())) {\n        throw new IntegrationError(\n          `OAuth URL for ${connectorId} requires metadata.${key} as a valid path segment.`,\n          'config_missing',\n        )\n      }\n      resolved = resolved.replaceAll(match[0], encodeURIComponent(raw.trim()))\n      continue\n    }\n    if (typeof raw !== 'string' || !isDnsLabel(raw.trim())) {\n      throw new IntegrationError(\n        `OAuth URL for ${connectorId} requires metadata.${key} as a valid tenant label.`,\n        'config_missing',\n      )\n    }\n    resolved = resolved.replaceAll(match[0], raw.trim().toLowerCase())\n  }\n\n  let url: URL\n  try {\n    url = new URL(resolved)\n  } catch {\n    throw new IntegrationError(\n      `OAuth URL for ${connectorId} is invalid.`,\n      'config_missing',\n    )\n  }\n  if (url.protocol !== 'https:' || url.username || url.password) {\n    throw new IntegrationError(\n      `OAuth URL for ${connectorId} must be HTTPS without embedded credentials.`,\n      'config_missing',\n    )\n  }\n  return url.toString()\n}\n\nfunction isOAuthPathSegment(value: string): boolean {\n  return (\n    value !== '.' &&\n    value !== '..' &&\n    /^[A-Za-z0-9._~-]{1,128}$/.test(value)\n  )\n}\n\nfunction isOAuthPathSegmentPlaceholder(\n  template: string,\n  index: number,\n  placeholder: string,\n): boolean {\n  if (index < 0) return false\n  const schemeIndex = template.indexOf('://')\n  const rootEnd = schemeIndex >= 0\n    ? schemeIndex + 3\n    : template.startsWith('{')\n      ? template.indexOf('}') + 1\n      : 0\n  const pathStart = template.indexOf('/', rootEnd)\n  const end = index + placeholder.length\n  const queryStart = template.search(/[?#]/)\n  return (\n    pathStart >= 0 &&\n    index >= pathStart &&\n    (queryStart < 0 || index < queryStart) &&\n    template[index - 1] === '/' &&\n    (end === template.length || template[end] === '/' || template[end] === '?' || template[end] === '#')\n  )\n}\n\nfunction resolveOAuthMetadataBaseUrl(\n  value: string,\n  spec: Extract<OAuth2UrlTemplateMetadataSpec, { kind: 'base-url' }>,\n  connectorId: string,\n  metadataKey: string,\n): string {\n  let url: URL\n  try {\n    url = new URL(value.trim())\n  } catch {\n    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey)\n  }\n  if (\n    url.protocol !== 'https:' ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey)\n  }\n  const exactAllowed = spec.allowedBaseUrls?.some((candidate) => sameOrigin(candidate, url)) ?? false\n  const suffixAllowed = spec.allowedBaseUrlSuffixes?.some((suffix) =>\n    !url.port &&\n    suffix.startsWith('.') &&\n    url.hostname.toLowerCase().endsWith(suffix.toLowerCase())\n  ) ?? false\n  const hasExplicitAllowlist = Boolean(\n    spec.allowedBaseUrls?.length || spec.allowedBaseUrlSuffixes?.length,\n  )\n  if (hasExplicitAllowlist && !exactAllowed && !suffixAllowed) {\n    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey)\n  }\n  if (spec.requirePublicHttps && !isPublicDnsHostname(url.hostname)) {\n    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey)\n  }\n  return url.origin\n}\n\nfunction invalidOAuthMetadataBaseUrl(connectorId: string, metadataKey: string): IntegrationError {\n  return new IntegrationError(\n    `OAuth URL for ${connectorId} requires metadata.${metadataKey} as an allowed HTTPS provider root.`,\n    'config_missing',\n  )\n}\n\nfunction sameOrigin(candidate: string, actual: URL): boolean {\n  try {\n    const allowed = new URL(candidate)\n    return (\n      allowed.protocol === 'https:' &&\n      !allowed.username &&\n      !allowed.password &&\n      allowed.pathname === '/' &&\n      !allowed.search &&\n      !allowed.hash &&\n      allowed.origin === actual.origin\n    )\n  } catch {\n    return false\n  }\n}\n\nfunction isPublicDnsHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase().replace(/^\\[|\\]$/g, '')\n  if (\n    normalized === 'localhost' ||\n    normalized.endsWith('.localhost') ||\n    normalized.endsWith('.local') ||\n    normalized.endsWith('.internal') ||\n    normalized.endsWith('.home.arpa')\n  ) {\n    return false\n  }\n  // OAuth redirects to self-hosted instances require a DNS name. Reject\n  // literal IP addresses because fetch cannot pin DNS against rebinding.\n  if (/^[0-9.]+$/.test(normalized) || normalized.includes(':')) return false\n  return normalized.includes('.') && normalized.split('.').every(isDnsLabel)\n}\n\nfunction isDnsLabel(value: string): boolean {\n  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(value)\n}\n\n/** Project the declared `auth.tokenMetadata` mappings out of an OAuth\n *  token-response body into connection metadata. Each entry maps a\n *  connection-metadata key → the token-response field to read (string\n *  shorthand) or `{ field, required }`. Required fields that are absent/empty\n *  throw `provider_failure` so the break surfaces at connect; non-required\n *  fields are captured if present and otherwise skipped. */\nfunction captureTokenMetadata(\n  tokenMetadata: Record<string, TokenMetadataSource> | undefined,\n  json: Record<string, unknown>,\n  connectorId: string,\n): Record<string, string> {\n  if (!tokenMetadata) return {}\n  const captured: Record<string, string> = {}\n  for (const [metaKey, source] of Object.entries(tokenMetadata)) {\n    const field = typeof source === 'string' ? source : source.field\n    const required = typeof source === 'string' ? false : source.required === true\n    const raw = json[field]\n    // Trim string values so capture-side emptiness matches the consumer's\n    // emptiness check (e.g. resolveBaseUrl's `.trim()` guard). A whitespace-only\n    // value must fail loud here at connect for a required field, not defer the\n    // break to first call where the host already looks active.\n    const value = typeof raw === 'string' ? raw.trim() : raw\n    if (value === undefined || value === null || value === '') {\n      if (required) {\n        throw new IntegrationError(\n          `OAuth token exchange for ${connectorId} did not return required field \"${field}\" for metadata.${metaKey}.`,\n          'provider_failure',\n        )\n      }\n      continue\n    }\n    captured[metaKey] = String(value)\n  }\n  return captured\n}\n\nfunction mapCategory(category: ConnectorAdapter['manifest']['category']): IntegrationConnector['category'] {\n  if (category === 'comms') return 'chat'\n  if (category === 'spreadsheet') return 'database'\n  if (category === 'doc') return 'docs'\n  if (category === 'commerce') return 'workflow'\n  // The manifest taxonomy is richer than the hub-facade taxonomy. Sales/market\n  // intelligence and HR/payroll connectors collapse to the nearest hub bucket:\n  // contact/company intelligence reads like CRM; the rest have no closer fit.\n  if (category === 'sales-intelligence') return 'crm'\n  if (category === 'market-intelligence' || category === 'hr') return 'other'\n  return category === 'other' ? 'other' : category\n}\n\nfunction inferDataClass(category: ConnectorAdapter['manifest']['category']): 'public' | 'internal' | 'private' | 'sensitive' {\n  if (category === 'commerce') return 'sensitive'\n  if (category === 'webhook') return 'internal'\n  return 'private'\n}\n\nfunction titleFromName(name: string): string {\n  return name\n    .split(/[._-]/g)\n    .filter(Boolean)\n    .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1))\n    .join(' ')\n}\n\nfunction toRecord(input: unknown): Record<string, unknown> {\n  if (input && typeof input === 'object' && !Array.isArray(input)) return input as Record<string, unknown>\n  return {}\n}\n\nfunction randomState(): string {\n  // 192 bits of entropy — comfortable CSRF margin and stays URL-safe.\n  const bytes = new Uint8Array(24)\n  globalThis.crypto.getRandomValues(bytes)\n  return base64UrlEncode(bytes)\n}\n\nfunction randomConnectionId(): string {\n  if (typeof globalThis.crypto?.randomUUID === 'function') {\n    return `conn_${globalThis.crypto.randomUUID().replace(/-/g, '')}`\n  }\n  const bytes = new Uint8Array(16)\n  globalThis.crypto.getRandomValues(bytes)\n  return `conn_${base64UrlEncode(bytes)}`\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  // btoa is defined in browsers, workers, and Node ≥ 16.\n  const b64 = typeof btoa === 'function' ? btoa(bin) : Buffer.from(bin, 'binary').toString('base64')\n  return b64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n","import { createConnectorAdapterProvider, type ConnectorAdapterProviderOptions } from './adapter-provider.js'\nimport type {\n  ConnectorAdapter,\n  ConnectorCredentials,\n  ResolvedDataSource,\n} from './connectors/types.js'\nimport type {\n  IntegrationConnection,\n  IntegrationConnectionStore,\n  IntegrationCredentialsRotatedEvent,\n  IntegrationOAuthState,\n  IntegrationOAuthStateOutcome,\n  IntegrationOAuthStateStore,\n  IntegrationProvider,\n  IntegrationSecretStore,\n  SecretRef,\n} from './core-types.js'\n\nexport type {\n  IntegrationOAuthState,\n  IntegrationOAuthStateOutcome,\n  IntegrationOAuthStateStore,\n  IntegrationSecretStore,\n}\n\nexport interface ConnectionCredentialResolverOptions {\n  secrets: IntegrationSecretStore\n  connections?: IntegrationConnectionStore\n  adapters?: ConnectorAdapter[]\n  now?: () => Date\n  markConnectionError?: (connection: IntegrationConnection, error: Error) => Promise<void> | void\n}\n\ninterface CredentialRefreshFlight {\n  promise: Promise<ConnectorCredentials>\n  cancelled: boolean\n  settled: boolean\n  waiters: number\n}\n\ninterface CredentialPersistenceLease {\n  cancelled: boolean\n}\n\nclass CredentialRefreshRevokedError extends Error {\n  constructor() {\n    super('Connection was revoked during credential refresh.')\n    this.name = 'CredentialRefreshRevokedError'\n  }\n}\n\nconst credentialRefreshes = new WeakMap<\n  IntegrationSecretStore,\n  Map<string, CredentialRefreshFlight>\n>()\nconst credentialPersistences = new WeakMap<\n  IntegrationSecretStore,\n  Map<string, Set<CredentialPersistenceLease>>\n>()\nconst credentialRevocations = new WeakMap<IntegrationSecretStore, Map<string, number>>()\n\nexport class InMemoryIntegrationSecretStore implements IntegrationSecretStore {\n  private readonly secrets = new Map<string, ConnectorCredentials>()\n\n  get(ref: SecretRef): ConnectorCredentials | undefined {\n    return this.secrets.get(secretKey(ref))\n  }\n\n  put(ref: SecretRef, credentials: ConnectorCredentials): void {\n    this.secrets.set(secretKey(ref), credentials)\n  }\n\n  delete(ref: SecretRef): void {\n    this.secrets.delete(secretKey(ref))\n  }\n}\n\n/** Test/dev double for {@link IntegrationOAuthStateStore}. Production hubs\n *  inject a durable implementation; this one keeps records in a Map and\n *  enforces the single-use + expiry contract. */\nexport class InMemoryIntegrationOAuthStateStore implements IntegrationOAuthStateStore {\n  private readonly states = new Map<string, IntegrationOAuthState>()\n\n  put(state: IntegrationOAuthState): void {\n    this.states.set(state.state, state)\n  }\n\n  consume(state: string): IntegrationOAuthStateOutcome {\n    const record = this.states.get(state)\n    this.states.delete(state)\n    if (!record) return { ok: false, reason: 'unknown' }\n    if (record.expiresAt <= Date.now()) return { ok: false, reason: 'expired' }\n    return { ok: true, state: record }\n  }\n\n  sweep(now: number): void {\n    for (const [key, record] of this.states) {\n      if (record.expiresAt <= now) this.states.delete(key)\n    }\n  }\n}\n\nexport function createConnectionCredentialResolver(options: ConnectionCredentialResolverOptions) {\n  const now = options.now ?? (() => new Date())\n  return async function resolveDataSource(connection: IntegrationConnection): Promise<ResolvedDataSource> {\n    const credentials = await resolveConnectionCredentials(connection, {\n      secrets: options.secrets,\n      connections: options.connections,\n      adapters: options.adapters,\n      now,\n      markConnectionError: options.markConnectionError,\n    })\n    return {\n      id: connection.id,\n      projectId: String(connection.metadata?.projectId ?? connection.owner.id),\n      publishedAgentId: typeof connection.metadata?.publishedAgentId === 'string' ? connection.metadata.publishedAgentId : null,\n      kind: connection.connectorId,\n      label: connection.account?.displayName ?? connection.account?.email ?? connection.connectorId,\n      consistencyModel: typeof connection.metadata?.consistencyModel === 'string' ? connection.metadata.consistencyModel as never : 'authoritative',\n      scopes: connection.grantedScopes,\n      metadata: connection.metadata ?? {},\n      credentials,\n      status: connection.status === 'active' ? 'active' : connection.status === 'revoked' ? 'revoked' : 'error',\n    }\n  }\n}\n\nexport async function resolveConnectionCredentials(input: IntegrationConnection, options: ConnectionCredentialResolverOptions): Promise<ConnectorCredentials> {\n  if (input.status !== 'active') throw new Error(`Connection ${input.id} is ${input.status}.`)\n  if (!input.secretRef) return { kind: 'none' }\n  const now = options.now ?? (() => new Date())\n  const current = await options.secrets.get(input.secretRef)\n  if (!current) throw new Error(`Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`)\n  if (!isExpiredOauth(current, now)) return current\n\n  const adapter = options.adapters?.find((candidate) => candidate.manifest.kind === input.connectorId)\n  if (!adapter?.refreshToken) return current\n  let refresh: CredentialRefreshFlight | undefined\n  try {\n    await assertCredentialRefreshActive(input, options, now)\n    refresh = acquireCredentialRefresh({\n      connectorId: input.connectorId,\n      secretRef: input.secretRef,\n      secrets: options.secrets,\n      now,\n      refreshToken: adapter.refreshToken.bind(adapter),\n    })\n    const refreshed = await refresh.promise\n    await assertCredentialRefreshActive(input, options, now, refresh)\n    if (options.connections) {\n      await options.connections.put({\n        ...input,\n        status: 'active',\n        updatedAt: now().toISOString(),\n        expiresAt: refreshed.kind === 'oauth2' && refreshed.expiresAt ? new Date(refreshed.expiresAt).toISOString() : input.expiresAt,\n      })\n      await assertCredentialRefreshActive(input, options, now, refresh)\n    }\n    return refreshed\n  } catch (error) {\n    const err = error instanceof Error ? error : new Error('Credential refresh failed.')\n    if (err instanceof CredentialRefreshRevokedError) throw err\n    await options.markConnectionError?.(input, err)\n    if (options.connections) {\n      await options.connections.put({\n        ...input,\n        status: 'expired',\n        updatedAt: now().toISOString(),\n      })\n    }\n    throw err\n  } finally {\n    if (refresh) {\n      releaseCredentialRefresh(\n        options.secrets,\n        input.connectorId,\n        input.secretRef,\n        refresh,\n      )\n    }\n  }\n}\n\nfunction acquireCredentialRefresh(input: {\n  connectorId: string\n  secretRef: SecretRef\n  secrets: IntegrationSecretStore\n  now: () => Date\n  refreshToken: (credentials: ConnectorCredentials) => Promise<ConnectorCredentials>\n}): CredentialRefreshFlight {\n  let refreshes = credentialRefreshes.get(input.secrets)\n  if (!refreshes) {\n    refreshes = new Map()\n    credentialRefreshes.set(input.secrets, refreshes)\n  }\n  const key = credentialRefreshKey(input.connectorId, input.secretRef)\n  if (credentialRevocations.get(input.secrets)?.has(key)) {\n    throw new CredentialRefreshRevokedError()\n  }\n  const existing = refreshes.get(key)\n  if (existing) {\n    existing.waiters += 1\n    return existing\n  }\n\n  let flight: CredentialRefreshFlight\n  const promise = Promise.resolve().then(async () => {\n    // A prior refresh can settle between the caller's first read and this\n    // flight. Re-read before redeeming a provider's rotating refresh token.\n    const latest = await input.secrets.get(input.secretRef)\n    if (!latest) {\n      throw new Error(\n        `Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`,\n      )\n    }\n    if (!isExpiredOauth(latest, input.now)) return latest\n    const refreshed = await input.refreshToken(latest)\n    if (flight.cancelled) throw new CredentialRefreshRevokedError()\n    await input.secrets.put(input.secretRef, refreshed)\n    if (flight.cancelled) {\n      await input.secrets.delete?.(input.secretRef)\n      throw new CredentialRefreshRevokedError()\n    }\n    return refreshed\n  })\n  flight = {\n    promise,\n    cancelled: false,\n    settled: false,\n    waiters: 1,\n  }\n  refreshes.set(key, flight)\n\n  const settle = () => {\n    flight.settled = true\n    clearCredentialRefresh(input.secrets, key, flight)\n  }\n  // Observe rejection immediately. Every caller still receives the original\n  // rejected promise and applies its connection-specific error transition.\n  void promise.then(settle, settle)\n  return flight\n}\n\nfunction releaseCredentialRefresh(\n  secrets: IntegrationSecretStore,\n  connectorId: string,\n  secretRef: SecretRef,\n  flight: CredentialRefreshFlight,\n): void {\n  flight.waiters -= 1\n  clearCredentialRefresh(\n    secrets,\n    credentialRefreshKey(connectorId, secretRef),\n    flight,\n  )\n}\n\nfunction clearCredentialRefresh(\n  secrets: IntegrationSecretStore,\n  key: string,\n  flight: CredentialRefreshFlight,\n): void {\n  if (!flight.settled || flight.waiters !== 0) return\n  const refreshes = credentialRefreshes.get(secrets)\n  if (refreshes?.get(key) !== flight) return\n  refreshes.delete(key)\n  if (refreshes.size === 0) credentialRefreshes.delete(secrets)\n}\n\nasync function assertCredentialRefreshActive(\n  input: IntegrationConnection,\n  options: ConnectionCredentialResolverOptions,\n  now: () => Date,\n  operation?: CredentialPersistenceLease,\n): Promise<void> {\n  const key = input.secretRef\n    ? credentialRefreshKey(input.connectorId, input.secretRef)\n    : undefined\n  let revoked = operation?.cancelled === true\n    || (key !== undefined\n      && credentialRevocations.get(options.secrets)?.has(key) === true)\n  let stored: IntegrationConnection | undefined\n  if (options.connections) {\n    stored = await options.connections.get(input.id)\n    revoked ||= stored?.status === 'revoked'\n  }\n  if (!revoked && input.secretRef) {\n    revoked = await options.secrets.get(input.secretRef) === undefined\n  }\n  if (!revoked) return\n\n  if (operation) operation.cancelled = true\n  if (input.secretRef) await options.secrets.delete?.(input.secretRef)\n  if (options.connections && stored?.status !== 'revoked') {\n    await options.connections.put({\n      ...(stored ?? input),\n      status: 'revoked',\n      updatedAt: now().toISOString(),\n    })\n  }\n  throw new CredentialRefreshRevokedError()\n}\n\nexport type CredentialBackedAdapterProviderOptions =\n  Omit<ConnectorAdapterProviderOptions, 'resolveDataSource' | 'onCredentialsRotated'>\n  & ConnectionCredentialResolverOptions\n  & {\n    /** Fired after the provider re-persists rotated credentials to the\n     *  secret + connection stores. Receives the hub-shaped event including\n     *  the resolved secretRef so the host can drive external re-encryption\n     *  or telemetry. */\n    onCredentialsRotated?: (event: IntegrationCredentialsRotatedEvent) => Promise<void> | void\n  }\n\nexport function createCredentialBackedAdapterProvider(options: CredentialBackedAdapterProviderOptions): IntegrationProvider {\n  const now = options.now ?? (() => new Date())\n  return createConnectorAdapterProvider({\n    ...options,\n    resolveDataSource: createConnectionCredentialResolver(options),\n    onCredentialsRotated: async ({ connection, credentials }) => {\n      const persistence = connection.secretRef\n        ? acquireCredentialPersistence(\n            options.secrets,\n            connection.connectorId,\n            connection.secretRef,\n          )\n        : undefined\n      try {\n        await assertCredentialRefreshActive(connection, options, now, persistence)\n        if (connection.secretRef) {\n          await options.secrets.put(connection.secretRef, credentials)\n        }\n        await assertCredentialRefreshActive(connection, options, now, persistence)\n        if (options.connections) {\n          await options.connections.put({\n            ...connection,\n            status: 'active',\n            updatedAt: now().toISOString(),\n            expiresAt: credentials.kind === 'oauth2' && credentials.expiresAt\n              ? new Date(credentials.expiresAt).toISOString()\n              : connection.expiresAt,\n          })\n          await assertCredentialRefreshActive(connection, options, now, persistence)\n        }\n        await options.onCredentialsRotated?.({ connection, secretRef: connection.secretRef, credentials })\n        await assertCredentialRefreshActive(connection, options, now, persistence)\n      } finally {\n        if (persistence && connection.secretRef) {\n          releaseCredentialPersistence(\n            options.secrets,\n            connection.connectorId,\n            connection.secretRef,\n            persistence,\n          )\n        }\n      }\n    },\n  })\n}\n\nfunction acquireCredentialPersistence(\n  secrets: IntegrationSecretStore,\n  connectorId: string,\n  secretRef: SecretRef,\n): CredentialPersistenceLease {\n  let persistences = credentialPersistences.get(secrets)\n  if (!persistences) {\n    persistences = new Map()\n    credentialPersistences.set(secrets, persistences)\n  }\n  const key = credentialRefreshKey(connectorId, secretRef)\n  let leases = persistences.get(key)\n  if (!leases) {\n    leases = new Set()\n    persistences.set(key, leases)\n  }\n  const lease = {\n    cancelled: credentialRevocations.get(secrets)?.has(key) === true,\n  }\n  leases.add(lease)\n  return lease\n}\n\nfunction releaseCredentialPersistence(\n  secrets: IntegrationSecretStore,\n  connectorId: string,\n  secretRef: SecretRef,\n  lease: CredentialPersistenceLease,\n): void {\n  const persistences = credentialPersistences.get(secrets)\n  if (!persistences) return\n  const key = credentialRefreshKey(connectorId, secretRef)\n  const leases = persistences.get(key)\n  leases?.delete(lease)\n  if (leases?.size === 0) persistences.delete(key)\n  if (persistences.size === 0) credentialPersistences.delete(secrets)\n}\n\nexport async function revokeConnection(input: {\n  connection: IntegrationConnection\n  connections?: IntegrationConnectionStore\n  secrets?: IntegrationSecretStore\n  now?: () => Date\n}): Promise<IntegrationConnection> {\n  const finishRevocation = input.connection.secretRef && input.secrets\n    ? beginCredentialRevocation(\n        input.secrets,\n        input.connection.connectorId,\n        input.connection.secretRef,\n      )\n    : undefined\n  try {\n    if (input.connection.secretRef) await input.secrets?.delete?.(input.connection.secretRef)\n    const revoked: IntegrationConnection = {\n      ...input.connection,\n      status: 'revoked',\n      updatedAt: (input.now?.() ?? new Date()).toISOString(),\n    }\n    await input.connections?.put(revoked)\n    return revoked\n  } finally {\n    finishRevocation?.()\n  }\n}\n\nfunction beginCredentialRevocation(\n  secrets: IntegrationSecretStore,\n  connectorId: string,\n  secretRef: SecretRef,\n): () => void {\n  const key = credentialRefreshKey(connectorId, secretRef)\n  let revocations = credentialRevocations.get(secrets)\n  if (!revocations) {\n    revocations = new Map()\n    credentialRevocations.set(secrets, revocations)\n  }\n  revocations.set(key, (revocations.get(key) ?? 0) + 1)\n  const flight = credentialRefreshes.get(secrets)?.get(key)\n  if (flight) flight.cancelled = true\n  for (const persistence of credentialPersistences.get(secrets)?.get(key) ?? []) {\n    persistence.cancelled = true\n  }\n\n  return () => {\n    const remaining = (revocations?.get(key) ?? 1) - 1\n    if (remaining > 0) revocations?.set(key, remaining)\n    else revocations?.delete(key)\n    if (revocations?.size === 0) credentialRevocations.delete(secrets)\n  }\n}\n\nfunction isExpiredOauth(credentials: ConnectorCredentials, now: () => Date): boolean {\n  return credentials.kind === 'oauth2'\n    && typeof credentials.expiresAt === 'number'\n    && credentials.expiresAt <= now().getTime()\n    && Boolean(credentials.refreshToken)\n}\n\nfunction secretKey(ref: SecretRef): string {\n  return `${ref.provider}:${ref.id}`\n}\n\nfunction credentialRefreshKey(connectorId: string, ref: SecretRef): string {\n  return JSON.stringify([connectorId, ref.provider, ref.id])\n}\n","import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto'\nimport {\n  composeIntegrationRegistry,\n  type ComposeIntegrationRegistryOptions,\n  type IntegrationRegistry,\n} from './registry-core.js'\nimport {\n  InMemoryIntegrationOAuthStateStore,\n  InMemoryIntegrationSecretStore,\n  type IntegrationOAuthState,\n} from './credentials.js'\nimport { IntegrationError } from './core-error.js'\nimport type {\n  CompleteAuthRequest,\n  IntegrationActionGuard,\n  IntegrationActionRequest,\n  IntegrationActionResult,\n  IntegrationActor,\n  IntegrationCapability,\n  IntegrationConnection,\n  IntegrationConnectionStore,\n  IntegrationConnector,\n  IntegrationHubOptions,\n  IntegrationPolicyEngine,\n  IntegrationProvider,\n  IntegrationTriggerEvent,\n  IntegrationTriggerSubscription,\n  InvokeWithCapabilityRequest,\n  IssueCapabilityRequest,\n  IssuedIntegrationCapability,\n  StartAuthRequest,\n  StartAuthResult,\n} from './core-types.js'\n\nexport class IntegrationHub {\n  private readonly providers = new Map<string, IntegrationProvider>()\n  private readonly store: IntegrationConnectionStore\n  private readonly capabilitySecret: string\n  private readonly guard: IntegrationActionGuard | undefined\n  private readonly policy: IntegrationPolicyEngine | undefined\n  /** Host-injected (or in-memory default) secret store. The hub re-persists\n   *  rotated credentials here when a connection carries a secretRef. */\n  readonly secretStore: IntegrationHubOptions['secretStore']\n  private readonly oauthStateStore: NonNullable<IntegrationHubOptions['oauthStateStore']>\n  private readonly oauthStateTtlMs: number\n  private readonly credentialsRotated: IntegrationHubOptions['credentialsRotated']\n  private readonly now: () => Date\n\n  constructor(options: IntegrationHubOptions) {\n    if (!options.capabilitySecret) {\n      throw new IntegrationError('capabilitySecret is required.', 'capability_invalid')\n    }\n    for (const provider of options.providers) this.providers.set(provider.id, provider)\n    this.store = options.store\n    this.capabilitySecret = options.capabilitySecret\n    this.guard = options.guard\n    this.policy = options.policy\n    this.secretStore = options.secretStore ?? new InMemoryIntegrationSecretStore()\n    this.oauthStateStore = options.oauthStateStore ?? new InMemoryIntegrationOAuthStateStore()\n    this.oauthStateTtlMs = options.oauthStateTtlMs ?? 10 * 60 * 1000\n    this.credentialsRotated = options.credentialsRotated\n    this.now = options.now ?? (() => new Date())\n  }\n\n  async listConnectors(): Promise<IntegrationConnector[]> {\n    const catalogs = await Promise.all([...this.providers.values()].map((provider) => provider.listConnectors()))\n    return catalogs.flat()\n  }\n\n  async listRegistry(options: ComposeIntegrationRegistryOptions = {}): Promise<IntegrationRegistry> {\n    const sources = await Promise.all([...this.providers.values()].map(async (provider) => ({\n      id: provider.id,\n      connectors: await provider.listConnectors(),\n    })))\n    return composeIntegrationRegistry(sources, options)\n  }\n\n  async startAuth(providerId: string, request: StartAuthRequest): Promise<StartAuthResult> {\n    const provider = this.requireProvider(providerId)\n    if (!provider.startAuth) throw new IntegrationError(`Provider ${providerId} does not support auth start.`, 'auth_not_supported')\n    const connector = await this.requireConnector(provider, request.connectorId)\n    const pkce = connectorOAuthPkceMode(connector)\n    const pkcePair = pkce === 'unsupported' ? undefined : createPkcePair()\n    const result = await provider.startAuth({\n      ...request,\n      codeChallenge: pkcePair?.challenge,\n    })\n    const record: IntegrationOAuthState = {\n      state: result.state,\n      providerId,\n      connectorId: request.connectorId,\n      owner: request.owner,\n      requestedScopes: request.requestedScopes,\n      redirectUri: request.redirectUri,\n      codeVerifier: pkcePair?.verifier,\n      expiresAt: this.now().getTime() + this.oauthStateTtlMs,\n      metadata: request.metadata,\n    }\n    await this.oauthStateStore.put(record)\n    return result\n  }\n\n  async completeAuth(providerId: string, request: CompleteAuthRequest): Promise<IntegrationConnection> {\n    const provider = this.requireProvider(providerId)\n    if (!provider.completeAuth) throw new IntegrationError(`Provider ${providerId} does not support auth completion.`, 'auth_not_supported')\n    const outcome = await this.oauthStateStore.consume(request.state)\n    if (!outcome.ok) {\n      throw new IntegrationError(`Integration OAuth state ${outcome.reason}: possible CSRF, replay, or stale flow.`, 'capability_invalid')\n    }\n    if (outcome.state.providerId !== providerId || outcome.state.connectorId !== request.connectorId) {\n      throw new IntegrationError('Integration OAuth state does not match completion request.', 'capability_invalid')\n    }\n    if (outcome.state.redirectUri !== request.redirectUri) {\n      throw new IntegrationError('Integration OAuth redirect URI does not match the start request.', 'capability_invalid')\n    }\n    const pinnedMetadata = request.metadata || outcome.state.metadata\n      ? { ...request.metadata, ...outcome.state.metadata }\n      : undefined\n    const connection = await provider.completeAuth({\n      ...request,\n      connectorId: outcome.state.connectorId,\n      owner: outcome.state.owner,\n      state: outcome.state.state,\n      redirectUri: outcome.state.redirectUri,\n      codeVerifier: outcome.state.codeVerifier,\n      metadata: pinnedMetadata,\n    })\n    await this.store.put(connection)\n    return connection\n  }\n\n  async upsertConnection(connection: IntegrationConnection): Promise<IntegrationConnection> {\n    await this.store.put(connection)\n    return connection\n  }\n\n  async listConnections(owner: IntegrationActor): Promise<IntegrationConnection[]> {\n    return this.store.listByOwner(owner)\n  }\n\n  async getConnection(connectionId: string): Promise<IntegrationConnection | undefined> {\n    return this.store.get(connectionId)\n  }\n\n  async issueCapability(request: IssueCapabilityRequest): Promise<IssuedIntegrationCapability> {\n    const connection = await this.requireConnection(request.connectionId)\n    this.assertConnectionActive(connection)\n    assertScopes(connection, request.scopes)\n    const now = this.now()\n    const capability: IntegrationCapability = {\n      id: `cap_${randomUUID()}`,\n      subject: request.subject,\n      connectionId: request.connectionId,\n      scopes: unique(request.scopes),\n      allowedActions: unique(request.allowedActions),\n      issuedAt: now.toISOString(),\n      expiresAt: new Date(now.getTime() + request.ttlMs).toISOString(),\n      metadata: request.metadata,\n    }\n    return { capability, token: signCapability(capability, this.capabilitySecret) }\n  }\n\n  verifyCapability(token: string): IntegrationCapability {\n    const capability = verifyCapabilityToken(token, this.capabilitySecret)\n    if (Date.parse(capability.expiresAt) <= this.now().getTime()) {\n      throw new IntegrationError('Integration capability expired.', 'capability_expired')\n    }\n    return capability\n  }\n\n  async invokeWithCapability(token: string, request: InvokeWithCapabilityRequest): Promise<IntegrationActionResult> {\n    const capability = this.verifyCapability(token)\n    if (!capability.allowedActions.includes(request.action)) {\n      throw new IntegrationError(`Capability does not allow action ${request.action}.`, 'action_denied')\n    }\n    const connection = await this.requireConnection(capability.connectionId)\n    this.assertConnectionActive(connection)\n    const provider = this.requireProvider(connection.providerId)\n    const connector = await this.requireConnector(provider, connection.connectorId)\n    const action = connector.actions.find((candidate) => candidate.id === request.action)\n    if (!action) throw new IntegrationError(`Action ${request.action} is not defined by connector ${connector.id}.`, 'action_not_found')\n    assertScopes(connection, action.requiredScopes)\n    assertScopes({ ...connection, grantedScopes: capability.scopes }, action.requiredScopes)\n    const fullRequest: IntegrationActionRequest = { ...request, connectionId: connection.id }\n    const proceed = async () => {\n      if (!this.policy) return provider.invokeAction(connection, fullRequest)\n      const decision = await this.policy.decide({\n        connection,\n        request: fullRequest,\n        action,\n        subject: capability.subject,\n      })\n      if (decision.decision === 'deny') {\n        throw new IntegrationError(decision.reason, 'policy_denied')\n      }\n      if (decision.decision === 'require_approval') {\n        return {\n          ok: false,\n          action: request.action,\n          output: { approvalRequired: true, approval: decision.approval },\n          metadata: { policyDecision: decision.decision, reason: decision.reason, ...decision.metadata },\n        }\n      }\n      return provider.invokeAction(connection, fullRequest)\n    }\n    if (this.guard) {\n      return this.guard.invokeAction({ connection, request: fullRequest, action }, proceed)\n    }\n    return proceed()\n  }\n\n  async subscribeTrigger(connectionId: string, trigger: string, targetUrl?: string): Promise<IntegrationTriggerSubscription> {\n    const connection = await this.requireConnection(connectionId)\n    this.assertConnectionActive(connection)\n    const provider = this.requireProvider(connection.providerId)\n    const connector = await this.requireConnector(provider, connection.connectorId)\n    const spec = connector.triggers?.find((candidate) => candidate.id === trigger)\n    if (!spec) throw new IntegrationError(`Trigger ${trigger} is not defined by connector ${connector.id}.`, 'trigger_not_found')\n    assertScopes(connection, spec.requiredScopes)\n    if (!provider.subscribeTrigger) {\n      throw new IntegrationError(`Provider ${provider.id} does not support triggers.`, 'auth_not_supported')\n    }\n    return provider.subscribeTrigger(connection, trigger, targetUrl)\n  }\n\n  private requireProvider(providerId: string): IntegrationProvider {\n    const provider = this.providers.get(providerId)\n    if (!provider) throw new IntegrationError(`Provider ${providerId} not found.`, 'provider_not_found')\n    return provider\n  }\n\n  private async requireConnector(provider: IntegrationProvider, connectorId: string): Promise<IntegrationConnector> {\n    const connector = (await provider.listConnectors()).find((candidate) => candidate.id === connectorId)\n    if (!connector) throw new IntegrationError(`Connector ${connectorId} not found.`, 'connector_not_found')\n    return connector\n  }\n\n  private async requireConnection(connectionId: string): Promise<IntegrationConnection> {\n    const connection = await this.store.get(connectionId)\n    if (!connection) throw new IntegrationError(`Connection ${connectionId} not found.`, 'connection_not_found')\n    return connection\n  }\n\n  private assertConnectionActive(connection: IntegrationConnection): void {\n    if (connection.status !== 'active') {\n      throw new IntegrationError(`Connection ${connection.id} is ${connection.status}.`, 'connection_not_active')\n    }\n    if (connection.expiresAt && Date.parse(connection.expiresAt) <= this.now().getTime()) {\n      throw new IntegrationError(`Connection ${connection.id} is expired.`, 'connection_not_active')\n    }\n  }\n}\n\n\nexport function signCapability(capability: IntegrationCapability, secret: string): string {\n  const payload = base64UrlEncode(JSON.stringify(capability))\n  const signature = hmac(payload, secret)\n  return `${payload}.${signature}`\n}\n\nexport function verifyCapabilityToken(token: string, secret: string): IntegrationCapability {\n  const [payload, signature] = token.split('.')\n  if (!payload || !signature) throw new IntegrationError('Malformed integration capability.', 'capability_invalid')\n  const expected = hmac(payload, secret)\n  if (!constantTimeEqual(signature, expected)) throw new IntegrationError('Invalid integration capability signature.', 'capability_invalid')\n  let parsed: IntegrationCapability\n  try {\n    parsed = JSON.parse(base64UrlDecode(payload)) as IntegrationCapability\n  } catch {\n    throw new IntegrationError('Invalid integration capability payload.', 'capability_invalid')\n  }\n  if (!parsed.id || !parsed.connectionId || !Array.isArray(parsed.scopes) || !Array.isArray(parsed.allowedActions)) {\n    throw new IntegrationError('Invalid integration capability payload.', 'capability_invalid')\n  }\n  return parsed\n}\n\n\nfunction assertScopes(connection: Pick<IntegrationConnection, 'grantedScopes'>, requiredScopes: string[]): void {\n  const missing = requiredScopes.filter((scope) => !connection.grantedScopes.includes(scope))\n  if (missing.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing.join(', ')}`, 'scope_denied')\n}\n\n\ntype IntegrationOAuthPkceMode = 'required' | 'supported' | 'unsupported'\n\nfunction connectorOAuthPkceMode(connector: IntegrationConnector): IntegrationOAuthPkceMode {\n  const value = connector.metadata?.oauthPkce\n  if (value === undefined) return 'required'\n  if (value === 'required' || value === 'supported' || value === 'unsupported') return value\n  throw new IntegrationError(\n    `Connector ${connector.id} declares an invalid OAuth PKCE posture.`,\n    'config_missing',\n  )\n}\n\nfunction createPkcePair(): { verifier: string; challenge: string } {\n  const verifier = randomBytes(48).toString('base64url')\n  const challenge = createHash('sha256').update(verifier).digest('base64url')\n  return { verifier, challenge }\n}\n\nfunction hmac(payload: string, secret: string): string {\n  return createHmac('sha256', secret).update(payload).digest('base64url')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const left = Buffer.from(a)\n  const right = Buffer.from(b)\n  return left.length === right.length && timingSafeEqual(left, right)\n}\n\nfunction base64UrlEncode(value: string): string {\n  return Buffer.from(value, 'utf8').toString('base64url')\n}\n\nfunction base64UrlDecode(value: string): string {\n  return Buffer.from(value, 'base64url').toString('utf8')\n}\n\nfunction unique<T>(values: T[]): T[] {\n  return [...new Set(values)]\n}\n\n"],"mappings":";;;;AA6BA,IAAa,mBAAb,cAAsC,MAAM;CAG/B;CAFX,YACE,SACA,MACA;EACA,MAAM,OAAO;EAFJ,KAAA,OAAA;EAGT,KAAK,OAAO;CACd;AACF;;;AC+BA,SAAgB,+BAA+B,SAA+D;CAC5G,MAAM,aAAa,QAAQ,MAAM;CACjC,MAAM,MAAM,QAAQ,8BAAc,IAAI,KAAK;CAC3C,MAAM,YAAY,QAAQ,aAAc,WAAW,OAAO,KAAK,UAAU;CACzE,MAAM,2BAAW,IAAI,IAA8B;CACnD,KAAK,MAAM,WAAW,QAAQ,UAC5B,SAAS,IAAI,QAAQ,SAAS,MAAM,OAAO;CAE7C,OAAO;EACL,IAAI;EACJ,MAAM,QAAQ,QAAQ;EACtB,sBAAsB,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,oBAAoB,YAAY,OAAO,CAAC;EACtG,MAAM,UAAU,SAAqD;GACnE,MAAM,UAAU,SAAS,IAAI,QAAQ,WAAW;GAChD,IAAI,CAAC,SACH,MAAM,IAAI,iBACR,qBAAqB,QAAQ,YAAY,cACzC,qBACF;GAEF,MAAM,OAAO,kBAAkB,QAAQ,SAAS,IAAI;GACpD,IAAI,CAAC,MACH,MAAM,IAAI,iBACR,aAAa,QAAQ,YAAY,qDAAqD,QAAQ,SAAS,KAAK,KAAK,KACjH,oBACF;GAEF,KAAK,KAAK,aAAa,0BAA0B,sBAC/C,MAAM,IAAI,iBACR,aAAa,QAAQ,YAAY,mEACjC,oBACF;GAEF,MAAM,OAAO,qBAAqB,KAAK,MAAM,QAAQ,WAAW;GAChE,MAAM,wBAAwB,6BAC5B,KAAK,uBACL,QAAQ,WACV;GACA,IAAI,CAAC,QAAQ,oBACX,MAAM,IAAI,iBACR,4EAA4E,QAAQ,YAAY,IAChG,gBACF;GAEF,MAAM,SAAS,MAAM,QAAQ,mBAAmB,EAAE,aAAa,QAAQ,YAAY,CAAC;GACpF,IACE,CAAC,UACD,CAAC,OAAO,YACP,0BAA0B,UAAU,CAAC,OAAO,cAE7C,MAAM,IAAI,iBACR,4CAA4C,QAAQ,YAAY,IAChE,gBACF;GAEF,IAAI,CAAC,KAAK,kBACR,MAAM,IAAI,iBACR,aAAa,QAAQ,YAAY,YAAY,KAAK,aAAa,qBAAqB,sDACpF,oBACF;GAEF,MAAM,SACJ,QAAQ,mBAAmB,QAAQ,gBAAgB,SAAS,IACxD,QAAQ,kBACR,KAAK;GACX,MAAM,MAAM,IAAI,IAAI,wBAClB,KAAK,kBACL,QAAQ,UACR,QAAQ,aACR,KAAK,mBACP,CAAC;GACD,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAC5C,IAAI,aAAa,IACf,0BACE,KAAK,4BACL,aACA,QAAQ,WACV,GACA,OAAO,QACT;GACA,IAAI,aAAa,IAAI,gBAAgB,QAAQ,WAAW;GACxD,IAAI,KAAK,mBAAmB,SAAS,OAAO,SAAS,GACnD,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,KAAK,kBAAkB,GAAG,CAAC;GAEvE,MAAM,QAAQ,QAAQ,SAAS,YAAY;GAC3C,IAAI,aAAa,IAAI,SAAS,KAAK;GACnC,IAAI,KAAK,iBACP,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,eAAe,GAC5D,IAAI,aAAa,IAAI,KAAK,KAAK;GAGnC,IAAI,SAAS,eAAe;IAC1B,IAAI,aAAa,OAAO,gBAAgB;IACxC,IAAI,aAAa,OAAO,uBAAuB;GACjD,OAAO;IACL,IAAI,aAAa,IACf,kBACA,qBAAqB,QAAQ,eAAe,QAAQ,WAAW,CACjE;IACA,IAAI,aAAa,IAAI,yBAAyB,MAAM;GACtD;GACA,OAAO;IACL;IACA,aAAa,QAAQ;IACrB,SAAS,IAAI,SAAS;IACtB;IACA,UAAU,QAAQ;GACpB;EACF;EACA,MAAM,aAAa,SAA8D;GAC/E,MAAM,UAAU,SAAS,IAAI,QAAQ,WAAW;GAChD,IAAI,CAAC,SACH,MAAM,IAAI,iBACR,qBAAqB,QAAQ,YAAY,cACzC,qBACF;GAEF,MAAM,OAAO,kBAAkB,QAAQ,SAAS,IAAI;GACpD,IAAI,CAAC,MACH,MAAM,IAAI,iBACR,aAAa,QAAQ,YAAY,qDAAqD,QAAQ,SAAS,KAAK,KAAK,KACjH,oBACF;GAEF,KAAK,KAAK,aAAa,0BAA0B,sBAC/C,MAAM,IAAI,iBACR,aAAa,QAAQ,YAAY,mEACjC,oBACF;GAEF,MAAM,wBAAwB,6BAC5B,KAAK,uBACL,QAAQ,WACV;GACA,MAAM,OAAO,qBAAqB,KAAK,MAAM,QAAQ,WAAW;GAChE,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,iBACR,kDAAkD,QAAQ,YAAY,IACtE,gBACF;GAEF,IAAI,CAAC,QAAQ,oBACX,MAAM,IAAI,iBACR,+EAA+E,QAAQ,YAAY,IACnG,gBACF;GAEF,MAAM,SAAS,MAAM,QAAQ,mBAAmB,EAAE,aAAa,QAAQ,YAAY,CAAC;GACpF,IACE,CAAC,UACD,CAAC,OAAO,YACP,0BAA0B,UAAU,CAAC,OAAO,cAE7C,MAAM,IAAI,iBACR,4CAA4C,QAAQ,YAAY,IAChE,gBACF;GAEF,IAAI,CAAC,WACH,MAAM,IAAI,iBACR,4FACA,gBACF;GAEF,MAAM,OAAO,IAAI,gBAAgB;IAC/B,YAAY;IACZ,MAAM,QAAQ;IACd,cAAc,QAAQ;GACxB,CAAC;GACD,MAAM,eAAe,SAAS,gBAC1B,KAAA,IACA,oBAAoB,QAAQ,cAAc,QAAQ,WAAW;GACjE,IAAI,cAAc,KAAK,IAAI,iBAAiB,YAAY;GACxD,MAAM,UAAU,+BAA+B,KAAK,mBAAmB;GACvE,IAAI,0BAA0B,QAC5B,KAAK,IACH,0BACE,KAAK,oBACL,aACA,QAAQ,WACV,GACA,OAAO,QACT;QACK,IAAI,0BAA0B,sBAAsB;IACzD,KAAK,IACH,0BACE,KAAK,oBACL,aACA,QAAQ,WACV,GACA,OAAO,QACT;IACA,KAAK,IACH,0BACE,KAAK,wBACL,iBACA,QAAQ,WACV,GACA,OAAO,YACT;GACF,OAME,QAAQ,gBALc,oCACpB,OAAO,UACP,OAAO,cACP,YAEkC;GAEtC,MAAM,kBAAkB;IACtB,QAAQ;IACR,GAAI,eAAe,CAAC,YAAY,IAAI,CAAC;IACrC,GAAG,qCACD,OAAO,UACP,OAAO,cACP,QAAQ,aACV;GACF;GACA,MAAM,WAAW,wBACf,KAAK,UACL,QAAQ,UACR,QAAQ,aACR,KAAK,mBACP;GACA,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,UAAU,UAAU;KAC9B,QAAQ;KACR;KACA;IACF,CAAC;GACH,SAAS,OAAO;IACd,MAAM,SAAS,yBACZ,OAAiB,WAAW,WAC7B,eACF;IACA,MAAM,IAAI,iBACR,4CAA4C,QAAQ,YAAY,IAAI,UACpE,kBACF;GACF;GACA,IAAI,CAAC,IAAI,IAAI;IACX,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,EAAE;IAC5C,MAAM,aAAa,yBAAyB,IAAI,YAAY,eAAe;IAC3E,MAAM,eAAe,yBAAyB,MAAM,eAAe;IACnE,MAAM,SAAS,GAAG,IAAI,OAAO,GAAG,WAAW,KAAK,aAAa,MAAM,GAAG,GAAG;IACzE,MAAM,IAAI,iBACR,mCAAmC,QAAQ,YAAY,IAAI,UAC3D,kBACF;GACF;GACA,IAAI;GAOJ,IAAI;IACF,OAAO,MAAM,IAAI,KAAK;GACxB,QAAQ;IACN,MAAM,IAAI,iBACR,mDAAmD,QAAQ,YAAY,IACvE,kBACF;GACF;GACA,IAAI,CAAC,KAAK,cACR,MAAM,IAAI,iBACR,qDAAqD,QAAQ,YAAY,IACzE,kBACF;GAEF,MAAM,gBAAgB,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IACxE,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,IACzC,CAAC;GACL,MAAM,SAAS,IAAI;GACnB,MAAM,YAAY,OAAO,YAAY;GACrC,MAAM,YAAY,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,IACvE,IAAI,KAAK,OAAO,QAAQ,IAAI,KAAK,aAAa,GAAI,CAAC,CAAC,YAAY,IAChE,KAAA;GAKJ,MAAM,mBAAmB,qBAAqB,KAAK,eAAe,MAAM,QAAQ,WAAW;GAC3F,OAAO;IACL,IAAI,mBAAmB;IACvB,OAAO,QAAQ;IACf;IACA,aAAa,QAAQ;IACrB,QAAQ;IACR;IACA,WAAW;IACX,WAAW;IACX;IACA,UAAU;KAAE,GAAG,QAAQ;KAAU,GAAG;IAAiB;GACvD;EACF;EACA,MAAM,aAAa,YAAY,SAAS;GACtC,MAAM,UAAU,SAAS,IAAI,WAAW,WAAW;GACnD,IAAI,CAAC,SACH,MAAM,IAAI,iBAAiB,qBAAqB,WAAW,YAAY,cAAc,qBAAqB;GAE5G,MAAM,aAAa,QAAQ,SAAS,aAAa,MAAM,cAAc,UAAU,SAAS,QAAQ,MAAM;GACtG,IAAI,CAAC,YACH,MAAM,IAAI,iBAAiB,cAAc,QAAQ,OAAO,qBAAqB,WAAW,YAAY,IAAI,kBAAkB;GAE5H,MAAM,SAAS,MAAM,QAAQ,kBAAkB,UAAU;GACzD,IAAI,sBAAsB,QAAQ,QAAQ;GAC1C,MAAM,mBAAmB,gBAAqD;IAC5E,IAAI,CAAC,QAAQ,sBAAsB,OAAO,QAAQ,QAAQ;IAC1D,sBAAsB,oBAAoB,WACxC,QAAQ,qBAAsB;KAAE;KAAY;IAAY,CAAC,CAC3D;IAIA,oBAAyB,YAAY,CAAC,CAAC;IACvC,OAAO;GACT;GACA,MAAM,aAAkC;IACtC;IACA,gBAAgB,QAAQ;IACxB,MAAM,SAAS,QAAQ,KAAK;IAC5B,gBAAgB,QAAQ,kBAAkB,QAAQ,WAAW,GAAG,GAAG,QAAQ,OAAO,GAAG,IAAI,CAAC,CAAC,QAAQ;IACnG,cAAc,OAAO,QAAQ,UAAU,iBAAiB,WAAW,QAAQ,SAAS,eAAe,KAAA;IACnG,eAAe,OAAO,QAAQ,UAAU,kBAAkB,WAAW,QAAQ,SAAS,gBAAgB,KAAA;IACtG,sBAAsB,QAAQ,uBAC1B,kBACA,KAAA;GACN;GACA,IAAI;IACF,IAAI,WAAW,UAAU,QAAQ;KAC/B,IAAI,CAAC,QAAQ,aACX,MAAM,IAAI,iBAAiB,aAAa,WAAW,YAAY,6BAA6B,kBAAkB;KAGhH,OAAO,mBAAmB,SAAS,MADd,QAAQ,YAAY,UAAU,CACV;IAC3C;IACA,IAAI,WAAW,UAAU,YAAY;KACnC,IAAI,CAAC,QAAQ,iBACX,MAAM,IAAI,iBAAiB,aAAa,WAAW,YAAY,iCAAiC,kBAAkB;KAGpH,OAAO,uBAAuB,SAAS,MADlB,QAAQ,gBAAgB,UAAU,CACV;IAC/C;IACA,MAAM,IAAI,iBAAiB,cAAc,QAAQ,OAAO,kCAAkC,kBAAkB;GAC9G,UAAU;IAGR,MAAM;GACR;EACF;CACF;AACF;AAEA,SAAgB,6BACd,UACA,aAAa,eACW;CACxB,OAAO,SAAS,KAAK,YAAY,oBAAoB,YAAY,OAAO,CAAC;AAC3E;AAEA,SAAgB,oCAAoC,SAKvB;CAC3B,MAAM,WAAW,QAAQ,MAAM;CAC/B,OAAO;EACL,IAAI;EACJ,YAAY,QAAQ;EACpB,YAAY,6BAA6B,QAAQ,UAAU,QAAQ,cAAc,QAAQ;CAC3F;AACF;AAEA,SAAgB,oBAAoB,YAAoB,SAAiD;CACvG,MAAM,WAAW,QAAQ;CACzB,MAAM,cAAc,oBAAoB,SAAS,IAAI;CACrD,MAAM,YAAY,kBAAkB,SAAS,IAAI;CACjD,OAAO;EACL,IAAI,SAAS;EACb;EACA,OAAO,SAAS;EAChB,UAAU,YAAY,SAAS,QAAQ;EACvC,MAAM,QAAQ,YAAY,IAAI;EAC9B,QAAQ,YAAY,SAAS,WAAW,YAAY,SAAS,CAAC;EAC9D,SAAS,SAAS,aACf,QAAQ,eAAe,WAAW,UAAU,UAAU,WAAW,UAAU,UAAU,CAAC,CACtF,KAAK,gBAAgB;GACpB,IAAI,WAAW;GACf,OAAO,cAAc,WAAW,IAAI;GACpC,MAAM,WAAW,UAAU,SAAS,SAAS,WAAW,iBAAiB,gBAAgB;GACzF,gBAAgB,WAAW,kBAAkB,CAAC;GAC9C,WAAW,eAAe,SAAS,QAAQ;GAC3C,GAAI,WAAW,mBAAmB,EAAE,kBAAkB,WAAW,iBAAiB,IAAI,CAAC;GACvF,aAAa,WAAW;GACxB,kBAAkB,WAAW,UAAU;GACvC,aAAa,WAAW;EAC1B,EAAE;EACJ,UAAU;GACR,QAAQ;GACR,aAAa;GACb,YAAY;GACZ,WAAW,YACP,qBAAqB,UAAU,MAAM,SAAS,IAAI,IAClD,KAAA;GACJ,aAAa,SAAS,KAAK,SAAS,WAAW,SAAS,KAAK,QAAQ,KAAK,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;GACnH,eAAe,SAAS,KAAK,SAAS,WAAW,SAAS,KAAK,YAAY,SAAS,KAAK;EAC3F;CACF;AACF;AAEA,SAAS,mBAAmB,SAAmC,QAAuD;CACpH,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,QAAQ,OAAO;EACf,UAAU;GACR,MAAM,OAAO;GACb,WAAW,OAAO;EACpB;CACF;AACF;AAEA,SAAS,uBAAuB,SAAmC,QAA2D;CAC5H,IAAI,OAAO,WAAW,aACpB,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,QAAQ,OAAO;EACf,UAAU;GACR,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,kBAAkB,OAAO;EAC3B;CACF;CAEF,IAAI,OAAO,WAAW,YACpB,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,QAAQ;GACN,UAAU;GACV,SAAS,OAAO;GAChB,cAAc,OAAO;GACrB,cAAc,OAAO;EACvB;CACF;CAEF,OAAO;EACL,IAAI;EACJ,QAAQ,QAAQ;EAChB,QAAQ;GACN,aAAa;GACb,cAAc,OAAO;GACrB,SAAS,OAAO;EAClB;CACF;AACF;AAEA,SAAS,QAAQ,MAAkF;CACjG,IAAI,SAAS,UAAU,OAAO;CAC9B,IAAI,SAAS,UAAU,OAAO;CAC9B,IAAI,SAAS,WAAW,OAAO;CAC/B,IAAI,SAAS,QAAQ,OAAO;CAC5B,OAAO;AACT;AAEA,SAAS,oBAAoB,MAA+G;CAC1I,IAAI,KAAK,SAAS,UAAU,OAAO;CACnC,OAAO,KAAK,QAAQ,MAAM,WAAW,OAAO,SAAS,KAAK,SAAS,KAAK,KAAK,QAAQ;AACvF;AAEA,SAAS,kBAAkB,MAAwJ;CACjL,IAAI,KAAK,SAAS,UAAU,OAAO;CACnC,IAAI,KAAK,SAAS,UAAU,OAAO,KAAA;CACnC,OAAO,KAAK,QAAQ,MAAM,WAAiE,OAAO,SAAS,QAAQ;AACrH;;;;AAKA,SAAS,6BACP,OACA,aAC6B;CAC7B,IAAI,UAAU,KAAA,KAAa,UAAU,sBACnC,OAAO;CAET,IAAI,UAAU,UAAU,UAAU,uBAAuB,OAAO;CAChE,MAAM,IAAI,iBACR,aAAa,YAAY,gEACzB,gBACF;AACF;AAEA,SAAS,qBACP,OACA,aAC0C;CAC1C,IAAI,UAAU,KAAA,KAAa,UAAU,YAAY,OAAO;CACxD,IAAI,UAAU,eAAe,UAAU,eAAe,OAAO;CAC7D,MAAM,IAAI,iBACR,aAAa,YAAY,sCACzB,gBACF;AACF;AAEA,SAAS,qBAAqB,OAA2B,aAA6B;CACpF,IAAI,CAAC,SAAS,CAAC,sBAAsB,KAAK,KAAK,GAC7C,MAAM,IAAI,iBACR,oDAAoD,YAAY,IAChE,gBACF;CAEF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAA2B,aAA6B;CACnF,IAAI,CAAC,SAAS,CAAC,4BAA4B,KAAK,KAAK,GACnD,MAAM,IAAI,iBACR,8CAA8C,YAAY,IAC1D,gBACF;CAEF,OAAO;AACT;AAEA,SAAS,0BACP,OACA,UACA,aACQ;CACR,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAC7C,MAAM,IAAI,iBACR,aAAa,YAAY,6CACzB,gBACF;CAEF,OAAO;AACT;;;AAIA,SAAS,aAAa,OAAuB;CAC3C,MAAM,OAAO,WAAW;CACxB,IAAI,OAAO,SAAS,YAClB,MAAM,IAAI,iBACR,wEACA,gBACF;CAEF,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM;AACpB;;;;;;;AAQA,SAAS,wBACP,UACA,UACA,aACA,eACQ;CACR,MAAM,eAAe,CAAC,GAAG,SAAS,SAAS,8BAA8B,CAAC;CAC1E,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,MAAM,MAAM;EAClB,MAAM,MAAM,WAAW;EACvB,MAAM,eAAe,gBAAgB;EACrC,IAAI,cAAc,SAAS,YAAY;GACrC,IAAI,OAAO,QAAQ,UACjB,MAAM,IAAI,iBACR,iBAAiB,YAAY,qBAAqB,IAAI,2BACtD,gBACF;GAEF,WAAW,SAAS,WAClB,MAAM,IACN,4BAA4B,KAAK,cAAc,aAAa,GAAG,CACjE;GACA;EACF;EACA,IAAI,cAAc,SAAS,gBAAgB;GACzC,IAAI,CAAC,8BAA8B,UAAU,MAAM,SAAS,IAAI,MAAM,EAAE,GACtE,MAAM,IAAI,iBACR,iBAAiB,YAAY,qBAAqB,IAAI,oCACtD,gBACF;GAEF,IAAI,OAAO,QAAQ,YAAY,CAAC,mBAAmB,IAAI,KAAK,CAAC,GAC3D,MAAM,IAAI,iBACR,iBAAiB,YAAY,qBAAqB,IAAI,4BACtD,gBACF;GAEF,WAAW,SAAS,WAAW,MAAM,IAAI,mBAAmB,IAAI,KAAK,CAAC,CAAC;GACvE;EACF;EACA,IAAI,OAAO,QAAQ,YAAY,CAAC,WAAW,IAAI,KAAK,CAAC,GACnD,MAAM,IAAI,iBACR,iBAAiB,YAAY,qBAAqB,IAAI,4BACtD,gBACF;EAEF,WAAW,SAAS,WAAW,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC;CACnE;CAEA,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,QAAQ;CACxB,QAAQ;EACN,MAAM,IAAI,iBACR,iBAAiB,YAAY,eAC7B,gBACF;CACF;CACA,IAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,UACnD,MAAM,IAAI,iBACR,iBAAiB,YAAY,+CAC7B,gBACF;CAEF,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,mBAAmB,OAAwB;CAClD,OACE,UAAU,OACV,UAAU,QACV,2BAA2B,KAAK,KAAK;AAEzC;AAEA,SAAS,8BACP,UACA,OACA,aACS;CACT,IAAI,QAAQ,GAAG,OAAO;CACtB,MAAM,cAAc,SAAS,QAAQ,KAAK;CAC1C,MAAM,UAAU,eAAe,IAC3B,cAAc,IACd,SAAS,WAAW,GAAG,IACrB,SAAS,QAAQ,GAAG,IAAI,IACxB;CACN,MAAM,YAAY,SAAS,QAAQ,KAAK,OAAO;CAC/C,MAAM,MAAM,QAAQ,YAAY;CAChC,MAAM,aAAa,SAAS,OAAO,MAAM;CACzC,OACE,aAAa,KACb,SAAS,cACR,aAAa,KAAK,QAAQ,eAC3B,SAAS,QAAQ,OAAO,QACvB,QAAQ,SAAS,UAAU,SAAS,SAAS,OAAO,SAAS,SAAS,OAAO,SAAS,SAAS;AAEpG;AAEA,SAAS,4BACP,OACA,MACA,aACA,aACQ;CACR,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC;CAC5B,QAAQ;EACN,MAAM,4BAA4B,aAAa,WAAW;CAC5D;CACA,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,MAEJ,MAAM,4BAA4B,aAAa,WAAW;CAE5D,MAAM,eAAe,KAAK,iBAAiB,MAAM,cAAc,WAAW,WAAW,GAAG,CAAC,KAAK;CAC9F,MAAM,gBAAgB,KAAK,wBAAwB,MAAM,WACvD,CAAC,IAAI,QACL,OAAO,WAAW,GAAG,KACrB,IAAI,SAAS,YAAY,CAAC,CAAC,SAAS,OAAO,YAAY,CAAC,CAC1D,KAAK;CAIL,IAH6B,QAC3B,KAAK,iBAAiB,UAAU,KAAK,wBAAwB,MAExC,KAAK,CAAC,gBAAgB,CAAC,eAC5C,MAAM,4BAA4B,aAAa,WAAW;CAE5D,IAAI,KAAK,sBAAsB,CAAC,oBAAoB,IAAI,QAAQ,GAC9D,MAAM,4BAA4B,aAAa,WAAW;CAE5D,OAAO,IAAI;AACb;AAEA,SAAS,4BAA4B,aAAqB,aAAuC;CAC/F,OAAO,IAAI,iBACT,iBAAiB,YAAY,qBAAqB,YAAY,sCAC9D,gBACF;AACF;AAEA,SAAS,WAAW,WAAmB,QAAsB;CAC3D,IAAI;EACF,MAAM,UAAU,IAAI,IAAI,SAAS;EACjC,OACE,QAAQ,aAAa,YACrB,CAAC,QAAQ,YACT,CAAC,QAAQ,YACT,QAAQ,aAAa,OACrB,CAAC,QAAQ,UACT,CAAC,QAAQ,QACT,QAAQ,WAAW,OAAO;CAE9B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,oBAAoB,UAA2B;CACtD,MAAM,aAAa,SAAS,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAChE,IACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,YAAY,GAEhC,OAAO;CAIT,IAAI,YAAY,KAAK,UAAU,KAAK,WAAW,SAAS,GAAG,GAAG,OAAO;CACrE,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,MAAM,UAAU;AAC3E;AAEA,SAAS,WAAW,OAAwB;CAC1C,OAAO,MAAM,SAAS,KAAK,MAAM,UAAU,MAAM,qCAAqC,KAAK,KAAK;AAClG;;;;;;;AAQA,SAAS,qBACP,eACA,MACA,aACwB;CACxB,IAAI,CAAC,eAAe,OAAO,CAAC;CAC5B,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,SAAS,WAAW,OAAO,QAAQ,aAAa,GAAG;EAC7D,MAAM,QAAQ,OAAO,WAAW,WAAW,SAAS,OAAO;EAC3D,MAAM,WAAW,OAAO,WAAW,WAAW,QAAQ,OAAO,aAAa;EAC1E,MAAM,MAAM,KAAK;EAKjB,MAAM,QAAQ,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;EACrD,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI;GACzD,IAAI,UACF,MAAM,IAAI,iBACR,4BAA4B,YAAY,kCAAkC,MAAM,iBAAiB,QAAQ,IACzG,kBACF;GAEF;EACF;EACA,SAAS,WAAW,OAAO,KAAK;CAClC;CACA,OAAO;AACT;AAEA,SAAS,YAAY,UAAsF;CACzG,IAAI,aAAa,SAAS,OAAO;CACjC,IAAI,aAAa,eAAe,OAAO;CACvC,IAAI,aAAa,OAAO,OAAO;CAC/B,IAAI,aAAa,YAAY,OAAO;CAIpC,IAAI,aAAa,sBAAsB,OAAO;CAC9C,IAAI,aAAa,yBAAyB,aAAa,MAAM,OAAO;CACpE,OAAO,aAAa,UAAU,UAAU;AAC1C;AAEA,SAAS,eAAe,UAAqG;CAC3H,IAAI,aAAa,YAAY,OAAO;CACpC,IAAI,aAAa,WAAW,OAAO;CACnC,OAAO;AACT;AAEA,SAAS,cAAc,MAAsB;CAC3C,OAAO,KACJ,MAAM,QAAQ,CAAC,CACf,OAAO,OAAO,CAAC,CACf,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAC7D,KAAK,GAAG;AACb;AAEA,SAAS,SAAS,OAAyC;CACzD,IAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO;CACxE,OAAO,CAAC;AACV;AAEA,SAAS,cAAsB;CAE7B,MAAM,wBAAQ,IAAI,WAAW,EAAE;CAC/B,WAAW,OAAO,gBAAgB,KAAK;CACvC,OAAOA,kBAAgB,KAAK;AAC9B;AAEA,SAAS,qBAA6B;CACpC,IAAI,OAAO,WAAW,QAAQ,eAAe,YAC3C,OAAO,QAAQ,WAAW,OAAO,WAAW,CAAC,CAAC,QAAQ,MAAM,EAAE;CAEhE,MAAM,wBAAQ,IAAI,WAAW,EAAE;CAC/B,WAAW,OAAO,gBAAgB,KAAK;CACvC,OAAO,QAAQA,kBAAgB,KAAK;AACtC;AAEA,SAASA,kBAAgB,OAA2B;CAClD,IAAI,MAAM;CACV,KAAK,MAAM,KAAK,OAAO,OAAO,OAAO,aAAa,CAAC;CAGnD,QADY,OAAO,SAAS,aAAa,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAA,CACtF,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACtE;;;ACj2BA,IAAM,gCAAN,cAA4C,MAAM;CAChD,cAAc;EACZ,MAAM,mDAAmD;EACzD,KAAK,OAAO;CACd;AACF;AAEA,MAAM,sCAAsB,IAAI,QAG9B;AACF,MAAM,yCAAyB,IAAI,QAGjC;AACF,MAAM,wCAAwB,IAAI,QAAqD;AAEvF,IAAa,iCAAb,MAA8E;CAC5E,0BAA2B,IAAI,IAAkC;CAEjE,IAAI,KAAkD;EACpD,OAAO,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC;CACxC;CAEA,IAAI,KAAgB,aAAyC;EAC3D,KAAK,QAAQ,IAAI,UAAU,GAAG,GAAG,WAAW;CAC9C;CAEA,OAAO,KAAsB;EAC3B,KAAK,QAAQ,OAAO,UAAU,GAAG,CAAC;CACpC;AACF;;;;AAKA,IAAa,qCAAb,MAAsF;CACpF,yBAA0B,IAAI,IAAmC;CAEjE,IAAI,OAAoC;EACtC,KAAK,OAAO,IAAI,MAAM,OAAO,KAAK;CACpC;CAEA,QAAQ,OAA6C;EACnD,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK;EACpC,KAAK,OAAO,OAAO,KAAK;EACxB,IAAI,CAAC,QAAQ,OAAO;GAAE,IAAI;GAAO,QAAQ;EAAU;EACnD,IAAI,OAAO,aAAa,KAAK,IAAI,GAAG,OAAO;GAAE,IAAI;GAAO,QAAQ;EAAU;EAC1E,OAAO;GAAE,IAAI;GAAM,OAAO;EAAO;CACnC;CAEA,MAAM,KAAmB;EACvB,KAAK,MAAM,CAAC,KAAK,WAAW,KAAK,QAC/B,IAAI,OAAO,aAAa,KAAK,KAAK,OAAO,OAAO,GAAG;CAEvD;AACF;AAEA,SAAgB,mCAAmC,SAA8C;CAC/F,MAAM,MAAM,QAAQ,8BAAc,IAAI,KAAK;CAC3C,OAAO,eAAe,kBAAkB,YAAgE;EACtG,MAAM,cAAc,MAAM,6BAA6B,YAAY;GACjE,SAAS,QAAQ;GACjB,aAAa,QAAQ;GACrB,UAAU,QAAQ;GAClB;GACA,qBAAqB,QAAQ;EAC/B,CAAC;EACD,OAAO;GACL,IAAI,WAAW;GACf,WAAW,OAAO,WAAW,UAAU,aAAa,WAAW,MAAM,EAAE;GACvE,kBAAkB,OAAO,WAAW,UAAU,qBAAqB,WAAW,WAAW,SAAS,mBAAmB;GACrH,MAAM,WAAW;GACjB,OAAO,WAAW,SAAS,eAAe,WAAW,SAAS,SAAS,WAAW;GAClF,kBAAkB,OAAO,WAAW,UAAU,qBAAqB,WAAW,WAAW,SAAS,mBAA4B;GAC9H,QAAQ,WAAW;GACnB,UAAU,WAAW,YAAY,CAAC;GAClC;GACA,QAAQ,WAAW,WAAW,WAAW,WAAW,WAAW,WAAW,YAAY,YAAY;EACpG;CACF;AACF;AAEA,eAAsB,6BAA6B,OAA8B,SAA6E;CAC5J,IAAI,MAAM,WAAW,UAAU,MAAM,IAAI,MAAM,cAAc,MAAM,GAAG,MAAM,MAAM,OAAO,EAAE;CAC3F,IAAI,CAAC,MAAM,WAAW,OAAO,EAAE,MAAM,OAAO;CAC5C,MAAM,MAAM,QAAQ,8BAAc,IAAI,KAAK;CAC3C,MAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,MAAM,SAAS;CACzD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,UAAU,MAAM,UAAU,SAAS,GAAG,MAAM,UAAU,GAAG,YAAY;CACnG,IAAI,CAAC,eAAe,SAAS,GAAG,GAAG,OAAO;CAE1C,MAAM,UAAU,QAAQ,UAAU,MAAM,cAAc,UAAU,SAAS,SAAS,MAAM,WAAW;CACnG,IAAI,CAAC,SAAS,cAAc,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,MAAM,8BAA8B,OAAO,SAAS,GAAG;EACvD,UAAU,yBAAyB;GACjC,aAAa,MAAM;GACnB,WAAW,MAAM;GACjB,SAAS,QAAQ;GACjB;GACA,cAAc,QAAQ,aAAa,KAAK,OAAO;EACjD,CAAC;EACD,MAAM,YAAY,MAAM,QAAQ;EAChC,MAAM,8BAA8B,OAAO,SAAS,KAAK,OAAO;EAChE,IAAI,QAAQ,aAAa;GACvB,MAAM,QAAQ,YAAY,IAAI;IAC5B,GAAG;IACH,QAAQ;IACR,WAAW,IAAI,CAAC,CAAC,YAAY;IAC7B,WAAW,UAAU,SAAS,YAAY,UAAU,YAAY,IAAI,KAAK,UAAU,SAAS,CAAC,CAAC,YAAY,IAAI,MAAM;GACtH,CAAC;GACD,MAAM,8BAA8B,OAAO,SAAS,KAAK,OAAO;EAClE;EACA,OAAO;CACT,SAAS,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,4BAA4B;EACnF,IAAI,eAAe,+BAA+B,MAAM;EACxD,MAAM,QAAQ,sBAAsB,OAAO,GAAG;EAC9C,IAAI,QAAQ,aACV,MAAM,QAAQ,YAAY,IAAI;GAC5B,GAAG;GACH,QAAQ;GACR,WAAW,IAAI,CAAC,CAAC,YAAY;EAC/B,CAAC;EAEH,MAAM;CACR,UAAU;EACR,IAAI,SACF,yBACE,QAAQ,SACR,MAAM,aACN,MAAM,WACN,OACF;CAEJ;AACF;AAEA,SAAS,yBAAyB,OAMN;CAC1B,IAAI,YAAY,oBAAoB,IAAI,MAAM,OAAO;CACrD,IAAI,CAAC,WAAW;EACd,4BAAY,IAAI,IAAI;EACpB,oBAAoB,IAAI,MAAM,SAAS,SAAS;CAClD;CACA,MAAM,MAAM,qBAAqB,MAAM,aAAa,MAAM,SAAS;CACnE,IAAI,sBAAsB,IAAI,MAAM,OAAO,CAAC,EAAE,IAAI,GAAG,GACnD,MAAM,IAAI,8BAA8B;CAE1C,MAAM,WAAW,UAAU,IAAI,GAAG;CAClC,IAAI,UAAU;EACZ,SAAS,WAAW;EACpB,OAAO;CACT;CAEA,IAAI;CACJ,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,KAAK,YAAY;EAGjD,MAAM,SAAS,MAAM,MAAM,QAAQ,IAAI,MAAM,SAAS;EACtD,IAAI,CAAC,QACH,MAAM,IAAI,MACR,UAAU,MAAM,UAAU,SAAS,GAAG,MAAM,UAAU,GAAG,YAC3D;EAEF,IAAI,CAAC,eAAe,QAAQ,MAAM,GAAG,GAAG,OAAO;EAC/C,MAAM,YAAY,MAAM,MAAM,aAAa,MAAM;EACjD,IAAI,OAAO,WAAW,MAAM,IAAI,8BAA8B;EAC9D,MAAM,MAAM,QAAQ,IAAI,MAAM,WAAW,SAAS;EAClD,IAAI,OAAO,WAAW;GACpB,MAAM,MAAM,QAAQ,SAAS,MAAM,SAAS;GAC5C,MAAM,IAAI,8BAA8B;EAC1C;EACA,OAAO;CACT,CAAC;CACD,SAAS;EACP;EACA,WAAW;EACX,SAAS;EACT,SAAS;CACX;CACA,UAAU,IAAI,KAAK,MAAM;CAEzB,MAAM,eAAe;EACnB,OAAO,UAAU;EACjB,uBAAuB,MAAM,SAAS,KAAK,MAAM;CACnD;CAGA,QAAa,KAAK,QAAQ,MAAM;CAChC,OAAO;AACT;AAEA,SAAS,yBACP,SACA,aACA,WACA,QACM;CACN,OAAO,WAAW;CAClB,uBACE,SACA,qBAAqB,aAAa,SAAS,GAC3C,MACF;AACF;AAEA,SAAS,uBACP,SACA,KACA,QACM;CACN,IAAI,CAAC,OAAO,WAAW,OAAO,YAAY,GAAG;CAC7C,MAAM,YAAY,oBAAoB,IAAI,OAAO;CACjD,IAAI,WAAW,IAAI,GAAG,MAAM,QAAQ;CACpC,UAAU,OAAO,GAAG;CACpB,IAAI,UAAU,SAAS,GAAG,oBAAoB,OAAO,OAAO;AAC9D;AAEA,eAAe,8BACb,OACA,SACA,KACA,WACe;CACf,MAAM,MAAM,MAAM,YACd,qBAAqB,MAAM,aAAa,MAAM,SAAS,IACvD,KAAA;CACJ,IAAI,UAAU,WAAW,cAAc,QACjC,QAAQ,KAAA,KACP,sBAAsB,IAAI,QAAQ,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM;CAChE,IAAI;CACJ,IAAI,QAAQ,aAAa;EACvB,SAAS,MAAM,QAAQ,YAAY,IAAI,MAAM,EAAE;EAC/C,YAAY,QAAQ,WAAW;CACjC;CACA,IAAI,CAAC,WAAW,MAAM,WACpB,UAAU,MAAM,QAAQ,QAAQ,IAAI,MAAM,SAAS,MAAM,KAAA;CAE3D,IAAI,CAAC,SAAS;CAEd,IAAI,WAAW,UAAU,YAAY;CACrC,IAAI,MAAM,WAAW,MAAM,QAAQ,QAAQ,SAAS,MAAM,SAAS;CACnE,IAAI,QAAQ,eAAe,QAAQ,WAAW,WAC5C,MAAM,QAAQ,YAAY,IAAI;EAC5B,GAAI,UAAU;EACd,QAAQ;EACR,WAAW,IAAI,CAAC,CAAC,YAAY;CAC/B,CAAC;CAEH,MAAM,IAAI,8BAA8B;AAC1C;AAaA,SAAgB,sCAAsC,SAAsE;CAC1H,MAAM,MAAM,QAAQ,8BAAc,IAAI,KAAK;CAC3C,OAAO,+BAA+B;EACpC,GAAG;EACH,mBAAmB,mCAAmC,OAAO;EAC7D,sBAAsB,OAAO,EAAE,YAAY,kBAAkB;GAC3D,MAAM,cAAc,WAAW,YAC3B,6BACE,QAAQ,SACR,WAAW,aACX,WAAW,SACb,IACA,KAAA;GACJ,IAAI;IACF,MAAM,8BAA8B,YAAY,SAAS,KAAK,WAAW;IACzE,IAAI,WAAW,WACb,MAAM,QAAQ,QAAQ,IAAI,WAAW,WAAW,WAAW;IAE7D,MAAM,8BAA8B,YAAY,SAAS,KAAK,WAAW;IACzE,IAAI,QAAQ,aAAa;KACvB,MAAM,QAAQ,YAAY,IAAI;MAC5B,GAAG;MACH,QAAQ;MACR,WAAW,IAAI,CAAC,CAAC,YAAY;MAC7B,WAAW,YAAY,SAAS,YAAY,YAAY,YACpD,IAAI,KAAK,YAAY,SAAS,CAAC,CAAC,YAAY,IAC5C,WAAW;KACjB,CAAC;KACD,MAAM,8BAA8B,YAAY,SAAS,KAAK,WAAW;IAC3E;IACA,MAAM,QAAQ,uBAAuB;KAAE;KAAY,WAAW,WAAW;KAAW;IAAY,CAAC;IACjG,MAAM,8BAA8B,YAAY,SAAS,KAAK,WAAW;GAC3E,UAAU;IACR,IAAI,eAAe,WAAW,WAC5B,6BACE,QAAQ,SACR,WAAW,aACX,WAAW,WACX,WACF;GAEJ;EACF;CACF,CAAC;AACH;AAEA,SAAS,6BACP,SACA,aACA,WAC4B;CAC5B,IAAI,eAAe,uBAAuB,IAAI,OAAO;CACrD,IAAI,CAAC,cAAc;EACjB,+BAAe,IAAI,IAAI;EACvB,uBAAuB,IAAI,SAAS,YAAY;CAClD;CACA,MAAM,MAAM,qBAAqB,aAAa,SAAS;CACvD,IAAI,SAAS,aAAa,IAAI,GAAG;CACjC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,aAAa,IAAI,KAAK,MAAM;CAC9B;CACA,MAAM,QAAQ,EACZ,WAAW,sBAAsB,IAAI,OAAO,CAAC,EAAE,IAAI,GAAG,MAAM,KAC9D;CACA,OAAO,IAAI,KAAK;CAChB,OAAO;AACT;AAEA,SAAS,6BACP,SACA,aACA,WACA,OACM;CACN,MAAM,eAAe,uBAAuB,IAAI,OAAO;CACvD,IAAI,CAAC,cAAc;CACnB,MAAM,MAAM,qBAAqB,aAAa,SAAS;CACvD,MAAM,SAAS,aAAa,IAAI,GAAG;CACnC,QAAQ,OAAO,KAAK;CACpB,IAAI,QAAQ,SAAS,GAAG,aAAa,OAAO,GAAG;CAC/C,IAAI,aAAa,SAAS,GAAG,uBAAuB,OAAO,OAAO;AACpE;AAEA,eAAsB,iBAAiB,OAKJ;CACjC,MAAM,mBAAmB,MAAM,WAAW,aAAa,MAAM,UACzD,0BACE,MAAM,SACN,MAAM,WAAW,aACjB,MAAM,WAAW,SACnB,IACA,KAAA;CACJ,IAAI;EACF,IAAI,MAAM,WAAW,WAAW,MAAM,MAAM,SAAS,SAAS,MAAM,WAAW,SAAS;EACxF,MAAM,UAAiC;GACrC,GAAG,MAAM;GACT,QAAQ;GACR,YAAY,MAAM,MAAM,qBAAK,IAAI,KAAK,EAAA,CAAG,YAAY;EACvD;EACA,MAAM,MAAM,aAAa,IAAI,OAAO;EACpC,OAAO;CACT,UAAU;EACR,mBAAmB;CACrB;AACF;AAEA,SAAS,0BACP,SACA,aACA,WACY;CACZ,MAAM,MAAM,qBAAqB,aAAa,SAAS;CACvD,IAAI,cAAc,sBAAsB,IAAI,OAAO;CACnD,IAAI,CAAC,aAAa;EAChB,8BAAc,IAAI,IAAI;EACtB,sBAAsB,IAAI,SAAS,WAAW;CAChD;CACA,YAAY,IAAI,MAAM,YAAY,IAAI,GAAG,KAAK,KAAK,CAAC;CACpD,MAAM,SAAS,oBAAoB,IAAI,OAAO,CAAC,EAAE,IAAI,GAAG;CACxD,IAAI,QAAQ,OAAO,YAAY;CAC/B,KAAK,MAAM,eAAe,uBAAuB,IAAI,OAAO,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,GAC1E,YAAY,YAAY;CAG1B,aAAa;EACX,MAAM,aAAa,aAAa,IAAI,GAAG,KAAK,KAAK;EACjD,IAAI,YAAY,GAAG,aAAa,IAAI,KAAK,SAAS;OAC7C,aAAa,OAAO,GAAG;EAC5B,IAAI,aAAa,SAAS,GAAG,sBAAsB,OAAO,OAAO;CACnE;AACF;AAEA,SAAS,eAAe,aAAmC,KAA0B;CACnF,OAAO,YAAY,SAAS,YACvB,OAAO,YAAY,cAAc,YACjC,YAAY,aAAa,IAAI,CAAC,CAAC,QAAQ,KACvC,QAAQ,YAAY,YAAY;AACvC;AAEA,SAAS,UAAU,KAAwB;CACzC,OAAO,GAAG,IAAI,SAAS,GAAG,IAAI;AAChC;AAEA,SAAS,qBAAqB,aAAqB,KAAwB;CACzE,OAAO,KAAK,UAAU;EAAC;EAAa,IAAI;EAAU,IAAI;CAAE,CAAC;AAC3D;;;AC9aA,IAAa,iBAAb,MAA4B;CAC1B,4BAA6B,IAAI,IAAiC;CAClE;CACA;CACA;CACA;;;CAGA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgC;EAC1C,IAAI,CAAC,QAAQ,kBACX,MAAM,IAAI,iBAAiB,iCAAiC,oBAAoB;EAElF,KAAK,MAAM,YAAY,QAAQ,WAAW,KAAK,UAAU,IAAI,SAAS,IAAI,QAAQ;EAClF,KAAK,QAAQ,QAAQ;EACrB,KAAK,mBAAmB,QAAQ;EAChC,KAAK,QAAQ,QAAQ;EACrB,KAAK,SAAS,QAAQ;EACtB,KAAK,cAAc,QAAQ,eAAe,IAAI,+BAA+B;EAC7E,KAAK,kBAAkB,QAAQ,mBAAmB,IAAI,mCAAmC;EACzF,KAAK,kBAAkB,QAAQ,mBAAmB;EAClD,KAAK,qBAAqB,QAAQ;EAClC,KAAK,MAAM,QAAQ,8BAAc,IAAI,KAAK;CAC5C;CAEA,MAAM,iBAAkD;EAEtD,QAAO,MADgB,QAAQ,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK,aAAa,SAAS,eAAe,CAAC,CAAC,EAAA,CAC5F,KAAK;CACvB;CAEA,MAAM,aAAa,UAA6C,CAAC,GAAiC;EAChG,MAAM,UAAU,MAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,cAAc;GACtF,IAAI,SAAS;GACb,YAAY,MAAM,SAAS,eAAe;EAC5C,EAAE,CAAC;EACH,OAAO,2BAA2B,SAAS,OAAO;CACpD;CAEA,MAAM,UAAU,YAAoB,SAAqD;EACvF,MAAM,WAAW,KAAK,gBAAgB,UAAU;EAChD,IAAI,CAAC,SAAS,WAAW,MAAM,IAAI,iBAAiB,YAAY,WAAW,gCAAgC,oBAAoB;EAG/H,MAAM,WADO,uBAAuB,MADZ,KAAK,iBAAiB,UAAU,QAAQ,WAAW,CAEvD,MAAM,gBAAgB,KAAA,IAAY,eAAe;EACrE,MAAM,SAAS,MAAM,SAAS,UAAU;GACtC,GAAG;GACH,eAAe,UAAU;EAC3B,CAAC;EACD,MAAM,SAAgC;GACpC,OAAO,OAAO;GACd;GACA,aAAa,QAAQ;GACrB,OAAO,QAAQ;GACf,iBAAiB,QAAQ;GACzB,aAAa,QAAQ;GACrB,cAAc,UAAU;GACxB,WAAW,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK;GACvC,UAAU,QAAQ;EACpB;EACA,MAAM,KAAK,gBAAgB,IAAI,MAAM;EACrC,OAAO;CACT;CAEA,MAAM,aAAa,YAAoB,SAA8D;EACnG,MAAM,WAAW,KAAK,gBAAgB,UAAU;EAChD,IAAI,CAAC,SAAS,cAAc,MAAM,IAAI,iBAAiB,YAAY,WAAW,qCAAqC,oBAAoB;EACvI,MAAM,UAAU,MAAM,KAAK,gBAAgB,QAAQ,QAAQ,KAAK;EAChE,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,iBAAiB,2BAA2B,QAAQ,OAAO,0CAA0C,oBAAoB;EAErI,IAAI,QAAQ,MAAM,eAAe,cAAc,QAAQ,MAAM,gBAAgB,QAAQ,aACnF,MAAM,IAAI,iBAAiB,8DAA8D,oBAAoB;EAE/G,IAAI,QAAQ,MAAM,gBAAgB,QAAQ,aACxC,MAAM,IAAI,iBAAiB,oEAAoE,oBAAoB;EAErH,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,MAAM,WACrD;GAAE,GAAG,QAAQ;GAAU,GAAG,QAAQ,MAAM;EAAS,IACjD,KAAA;EACJ,MAAM,aAAa,MAAM,SAAS,aAAa;GAC7C,GAAG;GACH,aAAa,QAAQ,MAAM;GAC3B,OAAO,QAAQ,MAAM;GACrB,OAAO,QAAQ,MAAM;GACrB,aAAa,QAAQ,MAAM;GAC3B,cAAc,QAAQ,MAAM;GAC5B,UAAU;EACZ,CAAC;EACD,MAAM,KAAK,MAAM,IAAI,UAAU;EAC/B,OAAO;CACT;CAEA,MAAM,iBAAiB,YAAmE;EACxF,MAAM,KAAK,MAAM,IAAI,UAAU;EAC/B,OAAO;CACT;CAEA,MAAM,gBAAgB,OAA2D;EAC/E,OAAO,KAAK,MAAM,YAAY,KAAK;CACrC;CAEA,MAAM,cAAc,cAAkE;EACpF,OAAO,KAAK,MAAM,IAAI,YAAY;CACpC;CAEA,MAAM,gBAAgB,SAAuE;EAC3F,MAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,YAAY;EACpE,KAAK,uBAAuB,UAAU;EACtC,aAAa,YAAY,QAAQ,MAAM;EACvC,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,aAAoC;GACxC,IAAI,OAAO,WAAW;GACtB,SAAS,QAAQ;GACjB,cAAc,QAAQ;GACtB,QAAQ,OAAO,QAAQ,MAAM;GAC7B,gBAAgB,OAAO,QAAQ,cAAc;GAC7C,UAAU,IAAI,YAAY;GAC1B,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,YAAY;GAC/D,UAAU,QAAQ;EACpB;EACA,OAAO;GAAE;GAAY,OAAO,eAAe,YAAY,KAAK,gBAAgB;EAAE;CAChF;CAEA,iBAAiB,OAAsC;EACrD,MAAM,aAAa,sBAAsB,OAAO,KAAK,gBAAgB;EACrE,IAAI,KAAK,MAAM,WAAW,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,GACzD,MAAM,IAAI,iBAAiB,mCAAmC,oBAAoB;EAEpF,OAAO;CACT;CAEA,MAAM,qBAAqB,OAAe,SAAwE;EAChH,MAAM,aAAa,KAAK,iBAAiB,KAAK;EAC9C,IAAI,CAAC,WAAW,eAAe,SAAS,QAAQ,MAAM,GACpD,MAAM,IAAI,iBAAiB,oCAAoC,QAAQ,OAAO,IAAI,eAAe;EAEnG,MAAM,aAAa,MAAM,KAAK,kBAAkB,WAAW,YAAY;EACvE,KAAK,uBAAuB,UAAU;EACtC,MAAM,WAAW,KAAK,gBAAgB,WAAW,UAAU;EAC3D,MAAM,YAAY,MAAM,KAAK,iBAAiB,UAAU,WAAW,WAAW;EAC9E,MAAM,SAAS,UAAU,QAAQ,MAAM,cAAc,UAAU,OAAO,QAAQ,MAAM;EACpF,IAAI,CAAC,QAAQ,MAAM,IAAI,iBAAiB,UAAU,QAAQ,OAAO,+BAA+B,UAAU,GAAG,IAAI,kBAAkB;EACnI,aAAa,YAAY,OAAO,cAAc;EAC9C,aAAa;GAAE,GAAG;GAAY,eAAe,WAAW;EAAO,GAAG,OAAO,cAAc;EACvF,MAAM,cAAwC;GAAE,GAAG;GAAS,cAAc,WAAW;EAAG;EACxF,MAAM,UAAU,YAAY;GAC1B,IAAI,CAAC,KAAK,QAAQ,OAAO,SAAS,aAAa,YAAY,WAAW;GACtE,MAAM,WAAW,MAAM,KAAK,OAAO,OAAO;IACxC;IACA,SAAS;IACT;IACA,SAAS,WAAW;GACtB,CAAC;GACD,IAAI,SAAS,aAAa,QACxB,MAAM,IAAI,iBAAiB,SAAS,QAAQ,eAAe;GAE7D,IAAI,SAAS,aAAa,oBACxB,OAAO;IACL,IAAI;IACJ,QAAQ,QAAQ;IAChB,QAAQ;KAAE,kBAAkB;KAAM,UAAU,SAAS;IAAS;IAC9D,UAAU;KAAE,gBAAgB,SAAS;KAAU,QAAQ,SAAS;KAAQ,GAAG,SAAS;IAAS;GAC/F;GAEF,OAAO,SAAS,aAAa,YAAY,WAAW;EACtD;EACA,IAAI,KAAK,OACP,OAAO,KAAK,MAAM,aAAa;GAAE;GAAY,SAAS;GAAa;EAAO,GAAG,OAAO;EAEtF,OAAO,QAAQ;CACjB;CAEA,MAAM,iBAAiB,cAAsB,SAAiB,WAA6D;EACzH,MAAM,aAAa,MAAM,KAAK,kBAAkB,YAAY;EAC5D,KAAK,uBAAuB,UAAU;EACtC,MAAM,WAAW,KAAK,gBAAgB,WAAW,UAAU;EAC3D,MAAM,YAAY,MAAM,KAAK,iBAAiB,UAAU,WAAW,WAAW;EAC9E,MAAM,OAAO,UAAU,UAAU,MAAM,cAAc,UAAU,OAAO,OAAO;EAC7E,IAAI,CAAC,MAAM,MAAM,IAAI,iBAAiB,WAAW,QAAQ,+BAA+B,UAAU,GAAG,IAAI,mBAAmB;EAC5H,aAAa,YAAY,KAAK,cAAc;EAC5C,IAAI,CAAC,SAAS,kBACZ,MAAM,IAAI,iBAAiB,YAAY,SAAS,GAAG,8BAA8B,oBAAoB;EAEvG,OAAO,SAAS,iBAAiB,YAAY,SAAS,SAAS;CACjE;CAEA,gBAAwB,YAAyC;EAC/D,MAAM,WAAW,KAAK,UAAU,IAAI,UAAU;EAC9C,IAAI,CAAC,UAAU,MAAM,IAAI,iBAAiB,YAAY,WAAW,cAAc,oBAAoB;EACnG,OAAO;CACT;CAEA,MAAc,iBAAiB,UAA+B,aAAoD;EAChH,MAAM,aAAa,MAAM,SAAS,eAAe,EAAA,CAAG,MAAM,cAAc,UAAU,OAAO,WAAW;EACpG,IAAI,CAAC,WAAW,MAAM,IAAI,iBAAiB,aAAa,YAAY,cAAc,qBAAqB;EACvG,OAAO;CACT;CAEA,MAAc,kBAAkB,cAAsD;EACpF,MAAM,aAAa,MAAM,KAAK,MAAM,IAAI,YAAY;EACpD,IAAI,CAAC,YAAY,MAAM,IAAI,iBAAiB,cAAc,aAAa,cAAc,sBAAsB;EAC3G,OAAO;CACT;CAEA,uBAA+B,YAAyC;EACtE,IAAI,WAAW,WAAW,UACxB,MAAM,IAAI,iBAAiB,cAAc,WAAW,GAAG,MAAM,WAAW,OAAO,IAAI,uBAAuB;EAE5G,IAAI,WAAW,aAAa,KAAK,MAAM,WAAW,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,GACjF,MAAM,IAAI,iBAAiB,cAAc,WAAW,GAAG,eAAe,uBAAuB;CAEjG;AACF;AAGA,SAAgB,eAAe,YAAmC,QAAwB;CACxF,MAAM,UAAU,gBAAgB,KAAK,UAAU,UAAU,CAAC;CAE1D,OAAO,GAAG,QAAQ,GADA,KAAK,SAAS,MACH;AAC/B;AAEA,SAAgB,sBAAsB,OAAe,QAAuC;CAC1F,MAAM,CAAC,SAAS,aAAa,MAAM,MAAM,GAAG;CAC5C,IAAI,CAAC,WAAW,CAAC,WAAW,MAAM,IAAI,iBAAiB,qCAAqC,oBAAoB;CAEhH,IAAI,CAAC,kBAAkB,WADN,KAAK,SAAS,MACU,CAAC,GAAG,MAAM,IAAI,iBAAiB,6CAA6C,oBAAoB;CACzI,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,gBAAgB,OAAO,CAAC;CAC9C,QAAQ;EACN,MAAM,IAAI,iBAAiB,2CAA2C,oBAAoB;CAC5F;CACA,IAAI,CAAC,OAAO,MAAM,CAAC,OAAO,gBAAgB,CAAC,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,cAAc,GAC7G,MAAM,IAAI,iBAAiB,2CAA2C,oBAAoB;CAE5F,OAAO;AACT;AAGA,SAAS,aAAa,YAA0D,gBAAgC;CAC9G,MAAM,UAAU,eAAe,QAAQ,UAAU,CAAC,WAAW,cAAc,SAAS,KAAK,CAAC;CAC1F,IAAI,QAAQ,SAAS,GAAG,MAAM,IAAI,iBAAiB,+BAA+B,QAAQ,KAAK,IAAI,KAAK,cAAc;AACxH;AAKA,SAAS,uBAAuB,WAA2D;CACzF,MAAM,QAAQ,UAAU,UAAU;CAClC,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,UAAU,cAAc,UAAU,eAAe,UAAU,eAAe,OAAO;CACrF,MAAM,IAAI,iBACR,aAAa,UAAU,GAAG,2CAC1B,gBACF;AACF;AAEA,SAAS,iBAA0D;CACjE,MAAM,WAAW,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CAErD,OAAO;EAAE;EAAU,WADD,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,WACpC;CAAE;AAC/B;AAEA,SAAS,KAAK,SAAiB,QAAwB;CACrD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,WAAW;AACxE;AAEA,SAAS,kBAAkB,GAAW,GAAoB;CACxD,MAAM,OAAO,OAAO,KAAK,CAAC;CAC1B,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,OAAO,KAAK,WAAW,MAAM,UAAU,gBAAgB,MAAM,KAAK;AACpE;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,WAAW;AACxD;AAEA,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM;AACxD;AAEA,SAAS,OAAU,QAAkB;CACnC,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B"}

package/dist/hub.d.ts

@@ -0,0 +1,2 @@
+import { n as signCapability, r as verifyCapabilityToken, t as IntegrationHub } from "./hub-0Od2lgun.js";
+export { IntegrationHub, signCapability, verifyCapabilityToken };

package/dist/hub.js

@@ -0,0 +1,2 @@
+import { n as signCapability, r as verifyCapabilityToken, t as IntegrationHub } from "./hub-D13zPQGr.js";
+export { IntegrationHub, signCapability, verifyCapabilityToken };

package/dist/index-BQXENE9p.d.ts

@@ -0,0 +1,130 @@
+import { S as OAuth2UrlTemplateMetadataSpec, p as ConnectorManifest } from "./types-CauVC-Gr.js";
+import "./index-CDVPZuIY.js";
+//#region src/connectors/webhooks.d.ts
+/**
+ * Inbound webhook signature verifiers — provider-specific HMAC schemes.
+ *
+ * Each signature scheme is a pure function:
+ *   (rawBody: string, headers, secret, now?) → boolean
+ *
+ * Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are
+ * checked against a configurable tolerance to bound replay risk; the default
+ * mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).
+ *
+ * These verifiers are the building blocks for any inbound-webhook receiver
+ * (a route + a `verify` call + a per-event handler). They live in this
+ * package so every consumer of the integration substrate gets correct
+ * verification — not just one product reimplementing it.
+ */
+/** Default replay-protection window. Providers commonly use 5 minutes. */
+declare const DEFAULT_SIGNATURE_TOLERANCE_SECONDS: number;
+interface ParsedStripeSignatureHeader {
+  t: number;
+  sigs: string[];
+}
+declare function parseStripeSignatureHeader(header: string): ParsedStripeSignatureHeader | null;
+interface StripeVerifyOptions {
+  /** Replay-protection window in seconds. Default 300. */
+  toleranceSeconds?: number;
+  /** Override `now()` for tests. UTC seconds. */
+  now?: number;
+}
+/** Verify a Stripe webhook signature against the raw request body. */
+declare function verifyStripeSignature(rawBody: string, signatureHeader: string, secret: string, options?: StripeVerifyOptions): boolean;
+interface SlackVerifyOptions {
+  toleranceSeconds?: number;
+  now?: number;
+}
+declare function verifySlackSignature(rawBody: string, signatureHeader: string, timestampHeader: string, secret: string, options?: SlackVerifyOptions): boolean;
+interface GenericHmacVerifyOptions {
+  /** sha256 (default) | sha1 | sha512 — matches the algorithm the receiver
+   *  computed at sign time. */
+  algorithm?: 'sha256' | 'sha1' | 'sha512';
+  /** Optional prefix the receiver prepends to the signature in the header
+   *  (e.g., `'sha256='`). Stripped before constant-time comparison. */
+  signaturePrefix?: string;
+  /** Lowercase comparison (most providers emit hex-lowercase). Default true. */
+  lowercaseHex?: boolean;
+}
+declare function verifyHmacSignature(rawBody: string, signatureHeader: string, secret: string, options?: GenericHmacVerifyOptions): boolean;
+interface TwilioVerifyOptions {
+  /** Skip verification when the auth token isn't configured. Useful in
+   *  dev where the receiver wants to accept any payload. Default `false`
+   *  — production should always require a configured token. */
+  skipWhenAuthTokenMissing?: boolean;
+  /** When true, sign the raw body instead of the URL-encoded sorted-params
+   *  reduction. Twilio uses raw-body signing for `application/json`
+   *  webhook bodies. Default `false`. */
+  bodyAsRaw?: boolean;
+  /** When `bodyAsRaw` is true, the raw body to sign. Ignored otherwise. */
+  rawBody?: string;
+}
+/** Verify a Twilio webhook signature. */
+declare function verifyTwilioSignature(input: {
+  authToken: string | null | undefined;
+  signatureHeader: string | string[] | undefined;
+  fullUrl: string | null | undefined;
+  params: Record<string, string> | undefined;
+}, options?: TwilioVerifyOptions): boolean;
+interface EmailVerifyOptions {
+  /** Replay-protection window in seconds. Default 300. */
+  toleranceSeconds?: number;
+  /** Override `now()` for tests. UTC seconds. */
+  now?: number;
+}
+/** Verify a Tangle inbound-email signature against the raw request body. */
+declare function verifyEmailSignature(rawBody: string, signatureHeader: string, timestampHeader: string, secret: string, options?: EmailVerifyOptions): boolean;
+declare function firstHeader(headers: Record<string, string | string[] | undefined>, name: string): string | undefined;
+//#endregion
+//#region src/connectors/bundled-manifest-data.d.ts
+/** Every connector manifest this package bundles, sorted by kind. */
+declare function listBundledAdapterManifests(): ConnectorManifest[];
+/** The bundled manifest for `kind`, or undefined when nothing implements it. */
+declare function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined;
+/** Whether this package ships a real, executable adapter for `kind`. */
+declare function hasBundledAdapter(kind: string): boolean;
+/** Kinds this package implements. */
+declare function listBundledAdapterKinds(): string[];
+/**
+ * How a bundled connector really authenticates.
+ *
+ * `oauth2_client_credentials` is called out separately because it IS a
+ * connectable mode but has no user-facing authorize step — a caller that
+ * treats "oauth2 without an authorizationUrl" as broken would wrongly
+ * condemn these machine-to-machine providers.
+ */
+type BundledAuthMode = 'oauth2' | 'oauth2_client_credentials' | 'api_key' | 'hmac' | 'none';
+/** The auth mode a connect flow would actually drive for this manifest,
+ * resolving `one_of` through its declared `preferred` mode. */
+declare function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined;
+/** The setup hint an api-key connector shows when collecting its credential. */
+declare function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined;
+interface BundledOAuth2AuthContract {
+  grantType: 'authorization_code' | 'client_credentials';
+  authorizationUrl?: string;
+  tokenUrl: string;
+  scopes: string[];
+  clientIdEnv: string;
+  clientSecretEnv?: string;
+  scopeSeparator: ' ' | ',';
+  pkce?: 'required' | 'supported' | 'unsupported';
+  authorizationClientIdParam: string;
+  tokenClientIdParam: string;
+  tokenClientSecretParam: string;
+  tokenClientAuthMethod: 'none' | 'client_secret_post' | 'client_secret_basic';
+  sendScopeParam?: boolean;
+  extraAuthParams?: Record<string, string>;
+  tokenRequestHeaders?: Record<string, string>;
+  urlTemplateMetadata?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>;
+}
+/** The selected OAuth2 contract for a manifest, including non-redirect
+ * client-credentials providers and validated provider-root templates. */
+declare function bundledOAuth2AuthContract(manifest: ConnectorManifest): BundledOAuth2AuthContract | undefined;
+/** The authorization-code OAuth2 branch of a manifest, if it has one. */
+declare function bundledOAuth2Auth(manifest: ConnectorManifest): (BundledOAuth2AuthContract & {
+  grantType: 'authorization_code';
+  authorizationUrl: string;
+}) | undefined;
+//#endregion
+export { verifyStripeSignature as C, verifySlackSignature as S, TwilioVerifyOptions as _, bundledOAuth2Auth as a, verifyEmailSignature as b, hasBundledAdapter as c, DEFAULT_SIGNATURE_TOLERANCE_SECONDS as d, EmailVerifyOptions as f, StripeVerifyOptions as g, SlackVerifyOptions as h, bundledAuthMode as i, listBundledAdapterKinds as l, ParsedStripeSignatureHeader as m, BundledOAuth2AuthContract as n, bundledOAuth2AuthContract as o, GenericHmacVerifyOptions as p, bundledApiKeyHint as r, getBundledAdapterManifest as s, BundledAuthMode as t, listBundledAdapterManifests as u, firstHeader as v, verifyTwilioSignature as w, verifyHmacSignature as x, parseStripeSignatureHeader as y };
+//# sourceMappingURL=index-BQXENE9p.d.ts.map

package/dist/index-BQXENE9p.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-BQXENE9p.d.ts","names":[],"sources":["../src/connectors/webhooks.ts","../src/connectors/bundled-manifest-data.ts"],"mappings":";;;;;;;;;;;;;;;;;;;cAmBa;UAcI;EACf;EACA;;iBAGc,2BAA2B,iBAAiB;UAkB3C;;EAEf;;EAEA;;;iBAIc,sBACd,iBACA,yBACA,gBACA,UAAS;UA0BM;EACf;EACA;;iBAGc,qBACd,iBACA,yBACA,yBACA,gBACA,UAAS;UAuBM;;;EAGf;;;EAGA;;EAEA;;iBAGc,oBACd,iBACA,yBACA,gBACA,UAAS;UAqCM;;;;EAIf;;;;EAIA;;EAEA;;;iBAIc,sBACd;EACE;EACA;EACA;EACA,QAAQ;GAEV,UAAS;UAkCM;;EAEf;;EAEA;;;iBAIc,qBACd,iBACA,yBACA,yBACA,gBACA,UAAS;iBAoBK,YACd,SAAS,+CACT;;;;iBCrPc,+BAA+B;;iBAK/B,0BAA0B,eAAe;;iBAKzC,kBAAkB;;iBAKlB;;;;;;;;;KAYJ;;;iBASI,gBAAgB,UAAU,oBAAoB;;iBAqB9C,kBAAkB,UAAU;UAS3B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,kBAAkB;EAClB,sBAAsB;EACtB,sBAAsB,SAAS,eAAe;;;;iBAKhC,0BACd,UAAU,oBACT;;iBAiCa,kBAAkB,UAAU,qBACvC;EACC;EACA"}

package/dist/index.d.ts

@@ -8,12 +8,14 @@ import { _ as isTrustedPlatformEvidence, a as PLATFORM_FUNDING_REPLAY_RETENTION_
 import { a as PlatformExchangeRequest, c as StartConnectOutput, d as startConnectFlow, i as InMemoryConnectStateStore, l as finishConnectFlow, n as FinishConnectInput, o as PlatformExchangeResponse, r as FinishConnectOutput, s as StartConnectInput, t as ConnectFlowOptions, u as revokeConnectFlow } from "./index-CJBkqBWQ.js";
 import { $ as zerobounceConnector, $a as mailercheckConnector, $c as qdrantConnector, $d as duckdbConnector, $f as googleCalendar, $i as lemonSqueezyConnector, $l as freshdeskConnector, $n as pocketbaseConnector, $o as cloudinaryConnector, $r as griptapeConnector, $s as apitableConnector, $t as squareConnector, $u as cartloomConnector, A as fullenrichConnector, Aa as guideliteConnector, Ac as MicrosoftTeamsOptions, Ad as airtableConnector, Af as declarativeRestConnector, Ai as manychatConnector, Al as figmaConnector, An as reoonVerifierConnector, Ao as descriptConnector, Ar as createMySqlConnector, As as beamerConnector, At as TwitterOptions, Au as flowParserConnector, B as findymailConnector, Ba as googleCloudStorageConnector, Bc as PandaDocOptions, Bd as chessComConnector, Bf as classifyGoogleError, Bi as lokaliseConnector, Bl as acuitySchedulingConnector, Bn as quadernoConnector, Bo as convertkitConnector, Br as mailchainConnector, Bs as asknewsConnector, Bt as timeOpsConnector, Bu as deepgramConnector, C as theirstackConnector, Ca as influencersClubConnector, Cc as savvycalConnector, Cd as discordConnector, Cf as ClientCredentialsRegion, Ci as mauticConnector, Cl as linearConnector, Cn as saleorConnector, Co as documentproConnector, Cr as NotionOptions, Cs as blueskyConnector, Ct as validatedmailsConnector, Cu as closeConnector, D as phantombusterConnector, Da as hashiCorpVaultConnector, Dc as sharepoint, Dd as salesforceConnector, Df as RestCredentialPlacement, Di as mattermostConnector, Dl as canvaConnector, Dn as retellAiConnector, Do as documergeConnector, Dr as ninjapipeConnector, Ds as bitlyConnector, Dt as TikTokOptions, Du as generatebannersConnector, E as zenrowsConnector, Ea as harvestConnector, Ec as SharePointOptions, Ed as firebaseConnector, Ef as RestConnectorSpec, Ei as mailerooConnector, El as boxConnector, En as robollyConnector, Eo as doctlyConnector, Er as nocodbConnector, Es as biginByZohoConnector, Et as twilioConnector, Eu as giftbitConnector, F as leadfeederConnector, Fa as googlechatConnector, Fc as microsoftGraph, Fd as stripeWebhookReceiverConnector, Ff as HubSpotOptions, Fi as mailerLiteConnector, Fl as webflowConnector, Fn as redditConnector, Fo as copperConnector, Fr as mindStudioConnector, Fs as azureAdConnector, Ft as totalcmsConnector, Fu as echowinConnector, G as heyreachConnector, Ga as gistlyConnector, Gc as typeformConnector, Gd as createRedshiftConnector, Gf as GmailOptions, Gi as linkaConnector, Gl as customerIoConnector, Gn as productboardConnector, Go as cloudconvertConnector, Gr as insightoAiConnector, Gs as paychexConnector, Gt as ticktickConnector, Gu as codyConnector, H as bettercontactConnector, Ha as googleMeetConnector, Hc as HelloSignOptions, Hd as createSftpConnector, Hf as googleApiError, Hi as llmrailsConnector, Hl as CalComOptions, Hn as pushoverConnector, Ho as constantContactConnector, Hr as knockConnector, Hs as assemblyaiConnector, Ht as tenzoConnector, Hu as couchbaseConnector, I as commonRoomConnector, Ia as googleContactsConnector, Ic as GoogleFormsOptions, Id as azureServiceBusConnector, If as hubspot, Ii as lushaConnector, Il as codaConnector, In as reachinboxConnector, Io as cryptolensConnector, Ir as segmentConnector, Is as autocallsConnector, It as togglTrackConnector, Iu as dripConnector, J as makeConnector, Ja as freeAgentConnector, Jc as greenhouseConnector, Jd as createRedisConnector, Jf as GoogleSheetsOptions, Ji as lightfunnelsConnector, Jl as postmarkConnector, Jn as postizConnector, Jo as clicdataConnector, Jr as ibmCognoseConnector, Js as cognismConnector, Jt as tableauConnector, Ju as claudeConnector, K as amplemarketConnector, Ka as ghostcmsConnector, Kc as netlifyConnector, Kd as redshiftConnector, Kf as gmail, Ki as letsCalendarConnector, Kl as brazeConnector, Kn as predictLeadsConnector, Ko as cohereConnector, Kr as instaChartsConnector, Ks as zoominfoConnector, Kt as tallyConnector, Ku as clickfunnelsConnector, L as builtwithConnector, La as googleSearchConnector, Lc as googleForms, Ld as azureEventGridConnector, Lf as MicrosoftCalendarOptions, Li as loftyConnector, Ll as sanityConnector, Ln as recallAiConnector, Lo as datafuelConnector, Lr as metabaseConnector, Ls as azureCommunicationServicesConnector, Lt as todoistConnector, Lu as docsbotConnector, M as autoboundConnector, Ma as greenptConnector, Mc as OutlookMailOptions, Md as giteaConnector, Mf as docuseal, Mi as mastodonConnector, Ml as docusignConnector, Mn as recurlyConnector, Mo as denserAiConnector, Mr as MongoDbConnectorOptions, Ms as backblazeConnector, Mt as twitterConnector, Mu as featheryConnector, N as warmlyConnector, Na as googleTasksConnector, Nc as outlookMail, Nd as githubConnector, Nf as SlackOptions, Ni as lucidyaConnector, Nl as confluenceConnector, Nn as RedditOptions, No as deepseekConnector, Nr as createMongoDbConnector, Ns as azureOpenaiConnector, Nt as twinLabsConnector, Nu as everhourConnector, O as brightdataConnector, Oa as heygenConnector, Oc as OneDriveOptions, Od as asanaConnector, Of as RestOperationSpec, Oi as matrixConnector, Ol as miroConnector, On as retableConnector, Oo as dittofeedConnector, Or as niftyConnector, Os as blandAiConnector, Ot as tiktok, Ou as genderApiConnector, P as serperConnector, Pa as googleMyBusinessConnector, Pc as MicrosoftGraphOptions, Pd as slackEventsConnector, Pf as slack, Pi as luxuryPresenceConnector, Pl as wordpressConnector, Pn as reddit, Po as customgptConnector, Pr as mongodbConnector, Ps as barcodeLookupConnector, Pt as typefullyConnector, Pu as elevenlabsConnector, Q as zeplinConnector, Qa as freshsalesConnector, Qc as bamboohrConnector, Qd as rabbitMqConnector, Qf as GoogleCalendarOptions, Qi as leexiConnector, Ql as mailchimpConnector, Qn as pollybotAiConnector, Qo as clockodoConnector, Qr as heartbeatConnector, Qs as aminosConnector, Qt as supadataConnector, Qu as chainAwareConnector, R as wizaConnector, Ra as googleBigqueryConnector, Rc as GoogleDocsOptions, Rd as azureBlobStorageConnector, Rf as microsoftCalendar, Ri as logsnagConnector, Rl as contentfulConnector, Rn as rapidtextAiConnector, Ro as copyAiConnector, Rr as mollieConnector, Rs as avalaraConnector, Rt as tlDvConnector, Ru as digitalPilotConnector, S as usergemsConnector, Sa as hunterConnector, Sc as airOpsConnector, Sd as facebookPagesConnector, Sf as twilioSmsConnector, Si as microsoft365PeopleConnector, Sl as trelloConnector, Sn as sardisConnector, So as elasticEmailConnector, Sr as ntfyConnector, Ss as bolnaConnector, St as umamiConnector, Su as zohoCrmConnector, T as oceanIoConnector, Ta as heymarketSmsConnector, Tc as activecampaignConnector, Td as twentyConnector, Tf as clientCredentialsRestConnector, Ti as meetgeekAiConnector, Tl as dropboxConnector, Tn as runwareConnector, To as dumplingAiConnector, Tr as notionConnector, Ts as billplzConnector, Tt as upgradechatConnector, Tu as modelslabConnector, U as saleshandyConnector, Ua as googleAnalyticsConnector, Uc as hellosign, Ud as sftpConnector, Uf as googleErrorReason, Ui as lobstermailConnector, Ul as calCom, Un as pushbulletConnector, Uo as comfyicuConnector, Ur as kallabotAiConnector, Us as ashbyConnector, Ut as telnyxConnector, Uu as contiguityConnector, V as contactoutConnector, Va as youtubeDataConnector, Vc as pandadoc, Vd as SftpConnectorOptions, Vf as classifyGoogleReason, Vi as magicalApiConnector, Vl as calendlyConnector, Vn as qawafelConnector, Vo as crispConnector, Vr as loopsConnector, Vs as avianConnector, Vt as textcortexAiConnector, Vu as dappierConnector, W as lagrowthmachineConnector, Wa as googleSearchConsoleConnector, Wc as smooveConnector, Wd as RedshiftConnectorOptions, Wf as googleTestFailureReason, Wi as localaiConnector, Wl as calComConnector, Wn as proxycurlConnector, Wo as cometapiConnector, Wr as instasentConnector, Ws as adpConnector, Wt as teableConnector, Wu as contextualAiConnector, X as zapierConnector, Xa as fragmentConnector, Xc as workdayConnector, Xd as RabbitMqConnectorOptions, Xf as GoogleDriveOptions, Xi as leadConnectorConnector, Xl as sendgridConnector, Xn as createPostgresConnector, Xo as cloutlyConnector, Xr as humeAiConnector, Xs as similarwebConnector, Xt as stripeConnector, Xu as chatAidConnector, Y as n8nConnector, Ya as gameballConnector, Yc as leverConnector, Yd as redisConnector, Yf as googleSheets, Yi as linkupConnector, Yl as sendpulseConnector, Yn as PostgresConnectorOptions, Yo as clearoutConnector, Yr as hystructConnector, Ys as semrushConnector, Yt as systemeIoConnector, Yu as chatsistantConnector, Z as zuoraConnector, Za as frameConnector, Zc as ripplingConnector, Zd as createRabbitMqConnector, Zf as googleDrive, Zi as lettaConnector, Zl as klaviyoConnector, Zn as postgresConnector, Zo as clockifyConnector, Zr as hedyConnector, Zs as apolloConnector, Zt as swarmnodeConnector, Zu as chaindeskConnector, _ as nooksConnector, _a as imageRouterConnector, _c as aipriseConnector, _d as telegramConnector, _f as WhatsappBusinessOptions, _i as microsoftPowerBiConnector, _l as clioConnector, _n as sendinblueConnector, _o as emailitConnector, _r as openPhoneConnector, _s as campaignMonitorConnector, _t as vlmRunConnector, _u as zohoCampaignsConnector, a as linqWhatsappConnector, aa as klentyConnector, ac as amazonSnsConnector, ad as bannerbearConnector, af as kafkaConnector, ai as gotifyConnector, al as anthropicConnector, an as smartleadConnector, ao as flipandoConnector, ar as pdfmonkeyConnector, as as chartlyConnector, at as woocommerceConnector, au as zendeskConnector, b as polytomicConnector, ba as huggingFaceConnector, bc as afforaiConnector, bd as linkedinConnector, bf as createPhonyConnector, bi as microsoftDynamicsCrmConnector, bl as mycaseConnector, bn as scrapelessConnector, bo as easyPeasyAiConnector, br as omniCoConnector, bs as bookedinConnector, bt as vboutConnector, bu as zohoBooksConnector, c as demandbaseConnector, ca as kapsoConnector, cc as amazonCloudWatchConnector, cd as anyhookWebsocketConnector, cf as httpConnector, ci as exaConnector, cl as opsgenieConnector, cn as shippoConnector, co as fireberryConnector, cr as pinchPaymentsConnector, cs as chargekeepConnector, ct as wonderchatConnector, cu as EtsyOptions, d as gongConnector, da as joggAiConnector, dc as altTextAiConnector, dd as actualbudgetConnector, df as netsuiteConnector, di as mixmaxConnector, dl as digitalOceanConnector, dn as oneSpanSignConnector, do as fathomConnector, dr as paddleConnector, ds as capsuleCrmConnector, dt as webscrapingAiConnector, du as shopifyConnector, ea as kommoConnector, ec as appfollowConnector, ed as cambAiConnector, ef as parquetFilesConnector, ei as affinityConnector, el as pineconeConnector, en as socialkitConnector, eo as fountainConnector, ep as CONNECTOR_ADAPTER_FACTORIES, er as plausibleConnector, es as chatnodeConnector, et as youcanbookmeConnector, eu as gorgiasConnector, f as salesloftConnector, fa as jiraCloudConnector, fc as alaiConnector, fd as scimConnector, ff as billComConnector, fi as mindeeConnector, fl as discourseConnector, fn as ironcladConnector, fo as enrichlayerConnector, fr as oracleDatabaseConnector, fs as cannyConnector, ft as whatConvertsConnector, fu as bigcommerceConnector, g as modjoConnector, ga as jinaAiConnector, gc as aircallConnector, gd as TELEGRAM_FILE_DOWNLOAD_ROOT, gf as stripePackConnector, gi as microsoftOnenoteConnector, gl as sentryConnector, gn as senjaConnector, go as esignaturesConnector, gr as opportifyConnector, gs as braveSearchConnector, gt as voucheryIoConnector, gu as attioConnector, h as factorsAiConnector, ha as invoiceninjaConnector, hc as amazonBedrockConnector, hd as oktaConnector, hf as plaidConnector, hi as microsoftExcel365Connector, hl as datadogConnector, hn as serpstatConnector, ho as firefliesAiConnector, hr as openmicAiConnector, hs as captainDataConnector, ht as vtexConnector, hu as quickbooksConnector, i as resendConnector, ia as knackConnector, ic as amazonSqsConnector, id as base44Connector, if as createKafkaConnector, ii as gptzeroDetectAiConnector, il as googleGeminiConnector, in as smartsheetConnector, io as folkConnector, ir as peekshotConnector, is as chatwootConnector, it as workableConnector, iu as zendeskSellConnector, j as crustdataConnector, ja as greipConnector, jc as microsoftTeams, jd as gitlabConnector, jf as DocuSealOptions, ji as matomoConnector, jl as adobeSignConnector, jn as taxjarConnector, jo as devinConnector, jr as mysqlConnector, js as baremetricsConnector, jt as twitter, ju as fellowConnector, k as leadmagicConnector, ka as hastewireConnector, kc as oneDrive, kd as baserowConnector, kf as RestRequestSpec, ki as mailgunConnector, kl as figjamConnector, kn as replyIoConnector, ko as datocmsConnector, kr as MySqlConnectorOptions, ks as bettermodeConnector, kt as tiktokConnector, ku as gammaConnector, l as dialpadConnector, la as kizeoFormsConnector, lc as amazonEventBridgeConnector, ld as airparserConnector, lf as webhookConnector, li as missiveConnector, ll as pagerdutyConnector, ln as shortIoConnector, lo as facebookLeadsConnector, lr as pastefyConnector, ls as chargebeeConnector, lt as whatsscaleConnector, lu as etsyConnector, m as getresponseConnector, ma as jiraDataCenterConnector, mc as amazonSecretsManagerConnector, md as pingIdentityConnector, mf as rampConnector, mi as microsoftTodoConnector, ml as amplitudeConnector, mn as serviceNowConnector, mo as firecrawlConnector, mr as opnformConnector, ms as certopusConnector, mt as vtigerConnector, mu as xeroConnector, n as cloudbedsConnector, na as kudosityConnector, nc as apitemplateIoConnector, nd as bikaConnector, nf as csvFilesConnector, ni as granolaConnector, nl as huggingfaceConnector, nn as smsmodeConnector, no as formstackConnector, np as ConnectorAdapterFactoryEnvNames, nr as personalAiConnector, ns as circleConnector, nt as wufooConnector, nu as helpscoutConnector, o as linqConnector, oa as kissflowConnector, oc as amazonSesConnector, od as askHandleConnector, of as publicKafkaSocketFactory, oi as glideConnector, ol as openaiConnector, on as simplybookmeConnector, oo as flowiseConnector, or as parseurConnector, os as chatbaseConnector, ot as wootricConnector, ou as zagomailConnector, p as outreachConnector, pa as justInvoiceConnector, pc as airtopConnector, pd as oneloginConnector, pf as brexConnector, pi as millionverifierConnector, pl as cloudflareConnector, pn as signNowConnector, po as fathomAnalyticsConnector, pr as orimonConnector, ps as chainalysisApiConnector, pt as wafeqConnector, pu as gustoConnector, q as pipedreamConnector, qa as freshserviceConnector, qc as vercelConnector, qd as RedisConnectorOptions, qf as googleSlidesConnector, qi as lemlistConnector, ql as marketoConnector, qn as posthogConnector, qo as cognitoFormsConnector, qr as imapConnector, qs as clayConnector, qt as talkableConnector, qu as clearoutphoneConnector, r as sendblueConnector, ra as koFiConnector, rc as amazonTextractConnector, rd as beehiivConnector, rf as KafkaConnectorOptions, ri as gristConnector, rl as geminiConnector, rn as smartsuiteConnector, ro as formbricksConnector, rp as resolveConnectorAdapterFactoryOptions, rr as perplexityAiConnector, rs as chatDataConnector, rt as writesonicBulkConnector, ru as intercomConnector, s as inkboxConnector, sa as kimaiConnector, sc as amazonLambdaConnector, sd as apifyConnector, sf as rssConnector, si as googleVertexaiConnector, sl as auth0Connector, sn as simplirouteConnector, so as flowluConnector, sr as paywhirlConnector, ss as chatlingConnector, st as woodpeckerConnector, su as quickzuConnector, t as pricelabsConnector, ta as leapAiConnector, tc as ampecoConnector, td as buttondownConnector, tf as excelFilesConnector, ti as zoomConnector, tl as weaviateConnector, tn as snowflakeConnector, to as foreplayCoConnector, tp as ConnectorAdapterFactoryDefinition, tr as placidConnector, ts as checkoutConnector, tt as wrikeConnector, tu as frontConnector, u as ringcentralConnector, ua as jotformConnector, uc as alttextifyConnector, ud as aianswerConnector, uf as sageIntacctConnector, ui as mixpanelConnector, ul as clicksendConnector, un as signrequestConnector, uo as filloutFormsConnector, ur as paperformConnector, us as cashfreePaymentsConnector, ut as whatsappConnector, uu as ebayConnector, v as justcallConnector, va as instantlyAiConnector, vc as acumbamailConnector, vd as LinkedInOptions, vf as whatsappBusiness, vi as microsoft365PlannerConnector, vl as basecampConnector, vn as skyprepConnector, vo as emailoctopusConnector, vr as openRouterConnector, vs as brilliantDirectoriesConnector, vt as videoaskConnector, vu as zohoMailConnector, w as seamlessAiConnector, wa as housecallProConnector, wc as kustomerConnector, wd as supabaseConnector, wf as ClientCredentialsRestSpec, wi as messagebirdConnector, wl as adobeCreativeCloudConnector, wn as saasticConnector, wo as dubConnector, wr as notion, ws as bonjoroConnector, wt as vapiConnector, wu as pipedriveConnector, x as hightouchConnector, xa as neverbounceConnector, xc as agentxConnector, xd as instagramBusinessConnector, xf as phonyConnector, xi as memConnector, xl as mondayConnector, xn as scrapegraphaiConnector, xo as edenAiConnector, xr as odooConnector, xs as bexioConnector, xt as uscreenConnector, xu as zohoDeskConnector, y as signwellConnector, ya as insightlyConnector, yc as aidbaseConnector, yd as createLinkedinConnector, yf as PhonyConnectorOptions, yi as microsoftDynamics365BusinessCentralConnector, yl as clickupConnector, yn as seekTableConnector, yo as dustConnector, yr as omnihrConnector, ys as browseAiConnector, yt as vidlab7Connector, yu as zohoInvoiceConnector, z as snovIoConnector, za as googlePubSubConnector, zc as googleDocs, zd as amazonS3Connector, zf as GoogleErrorClass, zi as logrocketConnector, zl as zohoBookingsConnector, zn as raiaAiConnector, zo as dashworksConnector, zr as medullarConnector, zs as avomaConnector, zt as timelinesAiConnector, zu as detectingAiConnector } from "./index-CDVPZuIY.js";
 import { n as listBundledConnectorAdapters } from "./bundled-manifest-runtime-Dup1efUC.js";
-import { A as PendingOAuthFlow, B as oauthClientCredentialRedactionValues, C as verifyStripeSignature, D as OAuthFlowStore, E as InMemoryOAuthFlowStore, F as consumePendingFlow, H as refreshAccessToken, I as createOAuthBasicAuthorizationHeader, L as createOAuthTokenRequestHeaders, M as StartOAuthInput, N as StartOAuthOutput, O as OAuthPkceMode, P as _resetPendingFlowsForTests, R as exchangeAuthorizationCode, S as verifySlackSignature, T as ExchangeCodeInput, U as startOAuthFlow, V as redactOAuthSensitiveText, _ as TwilioVerifyOptions, a as bundledOAuth2Auth, b as verifyEmailSignature, c as hasBundledAdapter, d as DEFAULT_SIGNATURE_TOLERANCE_SECONDS, f as EmailVerifyOptions, g as StripeVerifyOptions, h as SlackVerifyOptions, i as bundledAuthMode, j as RefreshInput, k as OAuthTokens, l as listBundledAdapterKinds, m as ParsedStripeSignatureHeader, n as BundledOAuth2AuthContract, o as bundledOAuth2AuthContract, p as GenericHmacVerifyOptions, r as bundledApiKeyHint, s as getBundledAdapterManifest, t as BundledAuthMode, u as listBundledAdapterManifests, v as firstHeader, w as verifyTwilioSignature, x as verifyHmacSignature, y as parseStripeSignatureHeader, z as formEncodeOAuthClientCredential } from "./index-j2QziJA5.js";
-import { n as buildDefaultIntegrationRegistry, r as classifyIntegrationCatalogExecutability, t as IntegrationCatalogExecutability } from "./registry-BiUtB7gs.js";
-import { $ as createActivepiecesExecutorProvider, $n as BrokerToken, $t as InMemoryIntegrationHealthcheckStore, A as TangleIntegrationCatalogEntry, An as InMemoryIntegrationOAuthStateStore, Ar as CANONICAL_INTEGRATION_ACTIONS, At as invocationRequestFromEnvelope, B as extractExternalCatalogPublicCount, Bn as createConnectorAdapterProvider, Br as IntegrationApprovalStatus, Bt as PROVIDER_PASSTHROUGH_ACTION, C as TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, Cn as WorkspaceCapabilityDiscovery, Cr as IntegrationRequirementResolution, Ct as IntegrationInvocationEnvelopeValidationOptions, D as TangleCatalogRuntimePackageManifest, Dn as filterDiscoveryByWorkspaceScopes, Dr as IntegrationRuntimeOptions, Dt as NormalizedIntegrationResult, E as TangleCatalogExecutorProviderOptions, En as discoverWorkspaceCapabilities, Er as IntegrationRuntimeHub, Et as IntegrationSandboxHostOptions, F as TangleIntegrationImplementationKind, Fn as revokeConnection, Fr as ApprovalBackedPolicyEngine, Ft as CatalogExecutorInvocation, G as renderTangleCatalogRuntimePnpmAddCommand, Gn as renderConsentSummary, Gr as IntegrationErrorRuntimeCode, Gt as ManifestValidationIssue, H as listTangleIntegrationCatalogRuntimePackages, Hn as ConsentSummary, Hr as createApprovalBackedPolicyEngine, Ht as ProviderPassthroughPolicy, I as auditTangleIntegrationCatalogFreshness, In as ConnectorAdapterProviderOptions, Ir as ApprovalBackedPolicyOptions, It as CatalogExecutorProviderOptions, J as IntegrationCatalogFreshnessResult, Jn as TangleIntegrationsClient, Jt as assertValidIntegrationManifest, K as ACTIVEPIECES_PUBLIC_CATALOG_URL, Kn as TangleIntegrationInvokeInput, Kt as ManifestValidationResult, L as buildTangleCatalogRuntimePackageManifest, Ln as OAuthClientCredentials, Lr as InMemoryIntegrationApprovalStore, Lt as createCatalogExecutorProvider, M as TangleIntegrationCatalogFreshnessResult, Mn as createConnectionCredentialResolver, Mr as CanonicalLaunchConnectorOptions, Mt as redactCapability, N as TangleIntegrationContract, Nn as createCredentialBackedAdapterProvider, Nr as buildCanonicalLaunchConnectors, Nt as redactInvocationEnvelope, O as TangleCatalogRuntimePackageManifestOptions, On as ConnectionCredentialResolverOptions, Or as IntegrationSandboxBundle, Ot as buildIntegrationInvocationEnvelope, P as TangleIntegrationContractStatus, Pn as resolveConnectionCredentials, Pr as canonicalActionConnectorId, Pt as validateIntegrationInvocationEnvelope, Q as ActivepiecesExecutorProviderOptions, Qn as AppsOwnerPolicy, Qt as validateIntegrationManifest, R as buildTangleIntegrationCatalogConnectors, Rn as adapterManifestsToConnectors, Rr as IntegrationApprovalFilter, Rt as PlatformIntegrationPolicyPresetOptions, S as canonicalIntegrationKind, Sn as WorkspaceCapability, Sr as IntegrationRequirementMode, St as IntegrationInvocationEnvelope, T as TangleCatalogExecutorInvocation, Tn as WorkspaceTrigger, Tr as IntegrationRuntime, Tt as IntegrationSandboxHostHub, U as listTangleIntegrationContracts, Un as RenderConsentOptions, Ur as resolveIntegrationApproval, Ut as validateProviderPassthroughRequest, V as listTangleIntegrationCatalogEntries, Vn as manifestToConnector, Vr as IntegrationApprovalStore, Vt as ProviderHttpRequestInput, W as listTangleNativeAdapterIds, Wn as renderApprovalCopy, Wr as IntegrationError, Wt as InferIntegrationRequirementsOptions, X as extractActivepiecesPublicPieceCount, Xn as createTangleIntegrationsClient, Xt as explainMissingRequirements, Y as auditIntegrationCatalogFreshness, Yn as TangleIntegrationsClientOptions, Yt as calendarExercisePlannerManifest, Z as ActivepiecesExecutorInvocation, Zn as AppSummary, Zt as inferIntegrationManifestFromTools, _ as createMockIntegrationProvider, _n as IntegrationWorkflowRuntimeHub, _r as IntegrationGrant, _t as OpenApiDocument, a as IntegrationHubAuth, an as runIntegrationHealthcheck, ar as requireBrokerGrantReceipt, at as buildActivepiecesConnectors, b as verifyCapabilityToken, bn as createIntegrationWorkflowRuntime, br as IntegrationManifestResolution, bt as importMcpConnector, c as IntegrationHubRequestError, cn as IntegrationEventStore, cr as IntegrationBridgeToolBinding, ct as GatewayCatalogEntry, d as MintCapabilityBundleInput, dn as receiveIntegrationWebhook, dr as decodeIntegrationBridgePayload, dt as createGatewayCatalogProvider, en as IntegrationHealthcheckCheck, er as RegisterAppInput, et as ACTIVEPIECES_OVERRIDES, f as ResolveManifestInput, fn as storedEventToTriggerEvent, fr as encodeIntegrationBridgePayload, ft as normalizeGatewayCatalog, g as createHttpIntegrationProvider, gn as IntegrationWorkflowRuntime, gr as IntegrationCapabilityBinding, gt as McpCatalogTool, h as IntegrationHub, hn as IntegrationWorkflowDefinition, hr as InMemoryIntegrationGrantStore, ht as McpCatalog, i as CreateGrantsInput, in as healthcheckRequest, ir as createTangleAppsClient, it as ActivepiecesCatalogEntry, j as TangleIntegrationCatalogFreshnessOptions, jn as InMemoryIntegrationSecretStore, jr as CanonicalIntegrationActionId, jt as normalizeIntegrationResult, k as TangleCatalogTriggerInvocation, kn as CredentialBackedAdapterProviderOptions, kr as createIntegrationRuntime, kt as dispatchIntegrationInvocation, l as IntegrationOwnerPolicy, ln as IntegrationWebhookReceiverResult, lr as buildIntegrationBridgeEnvironment, lt as GatewayCatalogProviderOptions, m as InMemoryConnectionStore, mn as InstalledIntegrationWorkflow, mr as redactIntegrationBridgePayload, mt as ImportCatalogOptions, n as CheckConnectorInput, nn as IntegrationHealthcheckStatus, nr as TangleAppsClient, nt as getActivepiecesOverride, o as IntegrationHubClient, on as runIntegrationHealthchecks, or as DEFAULT_INTEGRATION_BRIDGE_ENV, ot as listActivepiecesCatalogEntries, p as createIntegrationHubClient, pn as InMemoryIntegrationWorkflowStore, pr as parseIntegrationBridgeEnvironment, pt as GraphqlOperationSpec, q as IntegrationCatalogFreshnessOptions, qn as TangleIntegrationInvokeResult, qt as MissingRequirementExplanation, r as CheckConnectorResult, rn as IntegrationHealthcheckStore, rr as TangleAppsClientOptions, rt as ActivepiecesCatalogAuthField, s as IntegrationHubClientOptions, sn as InMemoryIntegrationEventStore, sr as IntegrationBridgePayload, st as GatewayCatalogAction, t as CapabilityBundleResult, tn as IntegrationHealthcheckResult, tr as RegisteredApp, tt as ActivepiecesPieceOverride, u as ListGrantsInput, un as StoredIntegrationEvent, ur as buildIntegrationBridgePayload, ut as GatewayCatalogTrigger, v as sanitizeConnection, vn as IntegrationWorkflowRuntimeOptions, vr as IntegrationGrantStore, vt as OpenApiOperation, w as TANGLE_INTEGRATIONS_CATALOG_SOURCE, wn as WorkspaceToolSchema, wr as IntegrationRequirementStatus, wt as IntegrationSandboxHost, x as INTEGRATION_KIND_ALIASES, xn as DiscoverWorkspaceCapabilitiesInput, xr as IntegrationRequirement, xt as importOpenApiConnector, y as signCapability, yn as IntegrationWorkflowStore, yr as IntegrationManifest, yt as importGraphqlConnector, z as createTangleCatalogExecutorProvider, zn as createConnectorAdapterCatalogSource, zr as IntegrationApprovalRecord, zt as createPlatformIntegrationPolicyPreset } from "./consumer-BC6pCUzI.js";
+import { _ as redactOAuthSensitiveText, a as OAuthTokens, c as StartOAuthInput, d as consumePendingFlow, f as createOAuthBasicAuthorizationHeader, g as oauthClientCredentialRedactionValues, h as formEncodeOAuthClientCredential, i as OAuthPkceMode, l as StartOAuthOutput, m as exchangeAuthorizationCode, n as InMemoryOAuthFlowStore, o as PendingOAuthFlow, p as createOAuthTokenRequestHeaders, r as OAuthFlowStore, s as RefreshInput, t as ExchangeCodeInput, u as _resetPendingFlowsForTests, v as refreshAccessToken, y as startOAuthFlow } from "./oauth-C5pa5j3O.js";
+import { C as verifyStripeSignature, S as verifySlackSignature, _ as TwilioVerifyOptions, a as bundledOAuth2Auth, b as verifyEmailSignature, c as hasBundledAdapter, d as DEFAULT_SIGNATURE_TOLERANCE_SECONDS, f as EmailVerifyOptions, g as StripeVerifyOptions, h as SlackVerifyOptions, i as bundledAuthMode, l as listBundledAdapterKinds, m as ParsedStripeSignatureHeader, n as BundledOAuth2AuthContract, o as bundledOAuth2AuthContract, p as GenericHmacVerifyOptions, r as bundledApiKeyHint, s as getBundledAdapterManifest, t as BundledAuthMode, u as listBundledAdapterManifests, v as firstHeader, w as verifyTwilioSignature, x as verifyHmacSignature, y as parseStripeSignatureHeader } from "./index-BQXENE9p.js";
+import { $ as getActivepiecesOverride, $n as TangleAppsClient, $t as IntegrationHealthcheckStatus, A as TangleIntegrationContract, An as createCredentialBackedAdapterProvider, Ar as buildCanonicalLaunchConnectors, At as redactInvocationEnvelope, B as listTangleIntegrationContracts, Bn as RenderConsentOptions, Br as resolveIntegrationApproval, Bt as validateProviderPassthroughRequest, C as TangleCatalogExecutorProviderOptions, Cn as discoverWorkspaceCapabilities, Cr as IntegrationRuntimeHub, Ct as IntegrationSandboxHostOptions, D as TangleIntegrationCatalogEntry, Dn as InMemoryIntegrationOAuthStateStore, Dr as CANONICAL_INTEGRATION_ACTIONS, Dt as invocationRequestFromEnvelope, E as TangleCatalogTriggerInvocation, En as CredentialBackedAdapterProviderOptions, Er as createIntegrationRuntime, Et as dispatchIntegrationInvocation, F as buildTangleIntegrationCatalogConnectors, Fn as adapterManifestsToConnectors, Fr as IntegrationApprovalFilter, Ft as PlatformIntegrationPolicyPresetOptions, G as IntegrationCatalogFreshnessResult, Gn as TangleIntegrationsClient, Gt as assertValidIntegrationManifest, H as renderTangleCatalogRuntimePnpmAddCommand, Hn as renderConsentSummary, Hr as IntegrationErrorRuntimeCode, Ht as ManifestValidationIssue, I as createTangleCatalogExecutorProvider, In as createConnectorAdapterCatalogSource, Ir as IntegrationApprovalRecord, It as createPlatformIntegrationPolicyPreset, J as ActivepiecesExecutorInvocation, Jn as AppSummary, Jt as inferIntegrationManifestFromTools, K as auditIntegrationCatalogFreshness, Kn as TangleIntegrationsClientOptions, Kt as calendarExercisePlannerManifest, L as extractExternalCatalogPublicCount, Ln as createConnectorAdapterProvider, Lr as IntegrationApprovalStatus, Lt as PROVIDER_PASSTHROUGH_ACTION, M as TangleIntegrationImplementationKind, Mn as revokeConnection, Mr as ApprovalBackedPolicyEngine, Mt as CatalogExecutorInvocation, N as auditTangleIntegrationCatalogFreshness, Nn as ConnectorAdapterProviderOptions, Nr as ApprovalBackedPolicyOptions, Nt as CatalogExecutorProviderOptions, O as TangleIntegrationCatalogFreshnessOptions, On as InMemoryIntegrationSecretStore, Or as CanonicalIntegrationActionId, Ot as normalizeIntegrationResult, P as buildTangleCatalogRuntimePackageManifest, Pn as OAuthClientCredentials, Pr as InMemoryIntegrationApprovalStore, Pt as createCatalogExecutorProvider, Q as ActivepiecesPieceOverride, Qn as RegisteredApp, Qt as IntegrationHealthcheckResult, R as listTangleIntegrationCatalogEntries, Rn as manifestToConnector, Rr as IntegrationApprovalStore, Rt as ProviderHttpRequestInput, S as TangleCatalogExecutorInvocation, Sn as WorkspaceTrigger, Sr as IntegrationRuntime, St as IntegrationSandboxHostHub, T as TangleCatalogRuntimePackageManifestOptions, Tn as ConnectionCredentialResolverOptions, Tr as IntegrationSandboxBundle, Tt as buildIntegrationInvocationEnvelope, U as ACTIVEPIECES_PUBLIC_CATALOG_URL, Un as TangleIntegrationInvokeInput, Ut as ManifestValidationResult, V as listTangleNativeAdapterIds, Vn as renderApprovalCopy, Vr as IntegrationError, Vt as InferIntegrationRequirementsOptions, W as IntegrationCatalogFreshnessOptions, Wn as TangleIntegrationInvokeResult, Wt as MissingRequirementExplanation, X as createActivepiecesExecutorProvider, Xn as BrokerToken, Xt as InMemoryIntegrationHealthcheckStore, Y as ActivepiecesExecutorProviderOptions, Yn as AppsOwnerPolicy, Yt as validateIntegrationManifest, Z as ACTIVEPIECES_OVERRIDES, Zn as RegisterAppInput, Zt as IntegrationHealthcheckCheck, _ as sanitizeConnection, _n as createIntegrationWorkflowRuntime, _r as IntegrationManifestResolution, _t as importMcpConnector, a as IntegrationHubAuth, an as IntegrationEventStore, ar as IntegrationBridgeToolBinding, at as GatewayCatalogEntry, b as TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, bn as WorkspaceCapabilityDiscovery, br as IntegrationRequirementResolution, bt as IntegrationInvocationEnvelopeValidationOptions, c as IntegrationHubRequestError, cn as receiveIntegrationWebhook, cr as decodeIntegrationBridgePayload, ct as createGatewayCatalogProvider, d as MintCapabilityBundleInput, dn as InstalledIntegrationWorkflow, dr as redactIntegrationBridgePayload, dt as ImportCatalogOptions, en as IntegrationHealthcheckStore, er as TangleAppsClientOptions, et as ActivepiecesCatalogAuthField, f as ResolveManifestInput, fn as IntegrationWorkflowDefinition, fr as InMemoryIntegrationGrantStore, ft as McpCatalog, g as createMockIntegrationProvider, gn as IntegrationWorkflowStore, gr as IntegrationManifest, gt as importGraphqlConnector, h as createHttpIntegrationProvider, hn as IntegrationWorkflowRuntimeOptions, hr as IntegrationGrantStore, ht as OpenApiOperation, i as CreateGrantsInput, in as InMemoryIntegrationEventStore, ir as IntegrationBridgePayload, it as GatewayCatalogAction, j as TangleIntegrationContractStatus, jn as resolveConnectionCredentials, jr as canonicalActionConnectorId, jt as validateIntegrationInvocationEnvelope, k as TangleIntegrationCatalogFreshnessResult, kn as createConnectionCredentialResolver, kr as CanonicalLaunchConnectorOptions, kt as redactCapability, l as IntegrationOwnerPolicy, ln as storedEventToTriggerEvent, lr as encodeIntegrationBridgePayload, lt as normalizeGatewayCatalog, m as InMemoryConnectionStore, mn as IntegrationWorkflowRuntimeHub, mr as IntegrationGrant, mt as OpenApiDocument, n as CheckConnectorInput, nn as runIntegrationHealthcheck, nr as requireBrokerGrantReceipt, nt as buildActivepiecesConnectors, o as IntegrationHubClient, on as IntegrationWebhookReceiverResult, or as buildIntegrationBridgeEnvironment, ot as GatewayCatalogProviderOptions, p as createIntegrationHubClient, pn as IntegrationWorkflowRuntime, pr as IntegrationCapabilityBinding, pt as McpCatalogTool, q as extractActivepiecesPublicPieceCount, qn as createTangleIntegrationsClient, qt as explainMissingRequirements, r as CheckConnectorResult, rn as runIntegrationHealthchecks, rr as DEFAULT_INTEGRATION_BRIDGE_ENV, rt as listActivepiecesCatalogEntries, s as IntegrationHubClientOptions, sn as StoredIntegrationEvent, sr as buildIntegrationBridgePayload, st as GatewayCatalogTrigger, t as CapabilityBundleResult, tn as healthcheckRequest, tr as createTangleAppsClient, tt as ActivepiecesCatalogEntry, u as ListGrantsInput, un as InMemoryIntegrationWorkflowStore, ur as parseIntegrationBridgeEnvironment, ut as GraphqlOperationSpec, v as INTEGRATION_KIND_ALIASES, vn as DiscoverWorkspaceCapabilitiesInput, vr as IntegrationRequirement, vt as importOpenApiConnector, w as TangleCatalogRuntimePackageManifest, wn as filterDiscoveryByWorkspaceScopes, wr as IntegrationRuntimeOptions, wt as NormalizedIntegrationResult, x as TANGLE_INTEGRATIONS_CATALOG_SOURCE, xn as WorkspaceToolSchema, xr as IntegrationRequirementStatus, xt as IntegrationSandboxHost, y as canonicalIntegrationKind, yn as WorkspaceCapability, yr as IntegrationRequirementMode, yt as IntegrationInvocationEnvelope, z as listTangleIntegrationCatalogRuntimePackages, zn as ConsentSummary, zr as createApprovalBackedPolicyEngine, zt as ProviderPassthroughPolicy } from "./consumer-zHtoJixe.js";
 import { C as createIntegrationAuditEvent, S as createAuditingActionGuard, _ as IntegrationAuditEvent, a as StaticIntegrationPolicyOptions, b as IntegrationAuditSink, c as redactApprovalRequest, d as IntegrationIdempotencyRecord, f as IntegrationIdempotencyStore, g as InMemoryIntegrationAuditStore, h as createDefaultIntegrationActionGuard, i as StaticIntegrationPolicyEngine, l as DefaultIntegrationActionGuard, m as IntegrationRateLimiter, n as IntegrationPolicyEffect, o as buildApprovalRequest, p as IntegrationRateLimitDecision, r as IntegrationPolicyRule, s as createDefaultIntegrationPolicyEngine, t as IntegrationApprovalResolution, u as InMemoryIntegrationIdempotencyStore, v as IntegrationAuditEventType, w as sanitizeAuditConnection, x as IntegrationAuditStore, y as IntegrationAuditFilter } from "./policy-DCRcxl7B.js";
+import { n as buildDefaultIntegrationRegistry, r as classifyIntegrationCatalogExecutability, t as IntegrationCatalogExecutability } from "./registry-BiUtB7gs.js";
 import { a as normalizeIntegrationError, i as NormalizedIntegrationError, n as IntegrationRuntimeError, o as statusForCode, r as IntegrationUserAction, t as IntegrationErrorCode } from "./errors-8ePwEZRM.js";
 import { a as TangleAuthContext, c as expressTangleAuthMiddleware, d as requireTangleAuth, i as RequireTangleAuthOptions, l as extractToken, n as ExpressLikeResponse, o as TangleAuthOutcome, r as HonoLikeContext, s as TangleAuthReason, t as ExpressLikeRequest, u as honoTangleAuthMiddleware } from "./index-jnUINyEy.js";
+import { n as signCapability, r as verifyCapabilityToken, t as IntegrationHub } from "./hub-0Od2lgun.js";
 import { a as integrationCoverageChecklistMarkdown, i as buildIntegrationCoverageConnectors, n as IntegrationCoveragePriority, o as listIntegrationCoverageSpecs, r as IntegrationCoverageSpec, t as IntegrationActionPack } from "./coverage-catalog-DlfNsiGZ.js";
 import { A as IntegrationFamilySpec, B as OAuth2AuthSpec, C as CustomAuthSpec, D as IntegrationAuthMode, E as HmacAuthSpec, F as IntegrationSpecStatus, G as RenderedConsoleStep, H as PostSetupCheck, I as IntegrationSpecValidationIssue, K as ScopeDescriptor, L as IntegrationSpecValidationResult, M as IntegrationPlannerHints, N as IntegrationSetupSpec, O as IntegrationAuthSpec, P as IntegrationSpec, R as NoneAuthSpec, S as CredentialValidationResult, T as HealthcheckSpec, U as Quirk, V as PermissionDescriptor, W as RenderSpecOptions, _ as getIntegrationFamily, a as buildHealthcheckPlan, b as CredentialFieldSpec, c as renderConsoleSteps, d as getIntegrationSpec, f as integrationSpecToConnector, g as INTEGRATION_FAMILIES, h as resolveConnectorAuthSpec, i as validateIntegrationSpec, j as IntegrationLifecycleSpec, k as IntegrationFamilyId, l as renderRunbookMarkdown, m as listIntegrationSpecs, n as validateCredentialFormat, o as consoleStepsToText, p as listExecutableIntegrationSpecs, q as specAuthToConnectorAuth, r as validateCredentialSet, s as renderAgentToolDescription, t as assertValidIntegrationSpec, u as ConnectorAuthSpec, v as ApiKeyAuthSpec, w as HealthcheckPlan, x as CredentialValidationInput, y as ConsoleStep, z as NormalizedPermission } from "./index-CLRpZ0-_.js";
 export { ACTIVEPIECES_OVERRIDES, ACTIVEPIECES_PUBLIC_CATALOG_URL, ActivepiecesCatalogAuthField, ActivepiecesCatalogEntry, ActivepiecesExecutorInvocation, ActivepiecesExecutorProviderOptions, ActivepiecesPieceOverride, ApiKeyAuthSpec, AppSummary, ApprovalBackedPolicyEngine, ApprovalBackedPolicyOptions, AppsOwnerPolicy, AtomicClaimStatus, AtomicIdempotencyStore, AuthSpec, BillingAccessDecision, BrokerToken, type BundledAuthMode, type BundledOAuth2AuthContract, CANONICAL_INTEGRATION_ACTIONS, CASStrategy, CONNECTOR_ADAPTER_FACTORIES, type CalComOptions, CanonicalIntegrationActionId, CanonicalLaunchConnectorOptions, Capability, CapabilityBundleResult, CapabilityClass, CapabilityMutation, CapabilityMutationResult, CapabilityParameterSchema, CapabilityRead, CapabilityReadResult, CatalogExecutorInvocation, CatalogExecutorProviderOptions, CheckConnectorInput, CheckConnectorResult, type ClientCredentialsRegion, type ClientCredentialsRestSpec, CompleteAuthRequest, type ComposeIntegrationRegistryOptions, ConnectFlowOptions, ConnectionCredentialResolverOptions, ConnectorAdapter, type ConnectorAdapterFactoryDefinition, type ConnectorAdapterFactoryEnvNames, ConnectorAdapterProviderOptions, ConnectorAuthSpec, ConnectorCredentials, ConnectorInvocation, ConnectorManifest, ConnectorManifestValidationIssue, ConnectorManifestValidationResult, ConsentSummary, ConsistencyModel, ConsoleStep, CreateGrantsInput, CredentialBackedAdapterProviderOptions, CredentialFieldSpec, CredentialValidationInput, CredentialValidationResult, CredentialsExpired, CustomAuthSpec, DEFAULT_INTEGRATION_BRIDGE_ENV, DEFAULT_SIGNATURE_TOLERANCE_SECONDS, DEFAULT_TANGLE_PLATFORM_URL, DataSourceMetadata, DefaultIntegrationActionGuard, DiscoverWorkspaceCapabilitiesInput, type DocuSealOptions, EmailVerifyOptions, type EtsyOptions, EventHandlerResult, ExchangeCodeInput, ExpressLikeRequest, ExpressLikeResponse, FileSystemAtomicIdempotencyStore, FileSystemAtomicIdempotencyStoreOptions, FinishConnectInput, FinishConnectOutput, GatewayCatalogAction, GatewayCatalogEntry, GatewayCatalogProviderOptions, GatewayCatalogTrigger, GenericHmacVerifyOptions, type GmailOptions, type GoogleCalendarOptions, type GoogleDocsOptions, type GoogleDriveOptions, type GoogleErrorClass, type GoogleFormsOptions, type GoogleSheetsOptions, GraphqlOperationSpec, HealthcheckPlan, HealthcheckSpec, type HelloSignOptions, HmacAuthSpec, HonoLikeContext, HttpIntegrationProviderOptions, type HubSpotOptions, INTEGRATION_FAMILIES, INTEGRATION_KIND_ALIASES, IdempotencyRuntime, ImportCatalogOptions, InMemoryAtomicIdempotencyStore, InMemoryConnectStateStore, InMemoryConnectionStore, InMemoryIntegrationApprovalStore, InMemoryIntegrationAuditStore, InMemoryIntegrationEventStore, InMemoryIntegrationGrantStore, InMemoryIntegrationHealthcheckStore, InMemoryIntegrationIdempotencyStore, InMemoryIntegrationOAuthStateStore, InMemoryIntegrationSecretStore, InMemoryIntegrationWorkflowStore, InMemoryOAuthFlowStore, InboundEvent, InferIntegrationRequirementsOptions, InstalledIntegrationWorkflow, IntegrationActionGuard, IntegrationActionPack, IntegrationActionRequest, IntegrationActionResult, IntegrationActionRisk, IntegrationActor, IntegrationApprovalFilter, IntegrationApprovalRecord, IntegrationApprovalRequest, IntegrationApprovalResolution, IntegrationApprovalStatus, IntegrationApprovalStore, IntegrationAuditEvent, IntegrationAuditEventType, IntegrationAuditFilter, IntegrationAuditSink, IntegrationAuditStore, IntegrationAuthMode, IntegrationAuthSpec, IntegrationBridgePayload, IntegrationBridgeToolBinding, IntegrationCapability, IntegrationCapabilityBinding, IntegrationCatalogExecutability, IntegrationCatalogFreshnessOptions, IntegrationCatalogFreshnessResult, IntegrationCatalogSource, IntegrationCatalogView, IntegrationConnection, IntegrationConnectionStore, IntegrationConnector, IntegrationConnectorAction, IntegrationConnectorCategory, IntegrationConnectorTrigger, IntegrationCoveragePriority, IntegrationCoverageSpec, IntegrationCredentialsRotatedEvent, IntegrationDataClass, IntegrationError, IntegrationErrorCode, IntegrationErrorRuntimeCode, IntegrationEventStore, IntegrationFamilyId, IntegrationFamilySpec, IntegrationGrant, IntegrationGrantStore, IntegrationGuardContext, IntegrationHealthcheckCheck, IntegrationHealthcheckResult, IntegrationHealthcheckStatus, IntegrationHealthcheckStore, IntegrationHub, IntegrationHubAuth, IntegrationHubClient, IntegrationHubClientOptions, IntegrationHubOptions, IntegrationHubRequestError, IntegrationIdempotencyRecord, IntegrationIdempotencyStore, IntegrationInvocationEnvelope, IntegrationInvocationEnvelopeValidationOptions, IntegrationLifecycleSpec, IntegrationManifest, IntegrationManifestResolution, IntegrationOAuthState, IntegrationOAuthStateOutcome, IntegrationOAuthStateStore, IntegrationOwnerPolicy, IntegrationPlannerHints, IntegrationPolicyDecision, IntegrationPolicyEffect, IntegrationPolicyEngine, IntegrationPolicyRule, IntegrationProvider, IntegrationProviderKind, IntegrationRateLimitDecision, IntegrationRateLimiter, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, IntegrationRequirement, IntegrationRequirementMode, IntegrationRequirementResolution, IntegrationRequirementStatus, IntegrationRuntime, IntegrationRuntimeError, IntegrationRuntimeHub, IntegrationRuntimeOptions, IntegrationSandboxBundle, IntegrationSandboxHost, IntegrationSandboxHostHub, IntegrationSandboxHostOptions, IntegrationSecretStore, IntegrationSetupSpec, IntegrationSpec, IntegrationSpecStatus, IntegrationSpecValidationIssue, IntegrationSpecValidationResult, type IntegrationSupportTier, IntegrationToolDefinition, IntegrationToolSearchFilters, IntegrationToolSearchResult, IntegrationTriggerEvent, IntegrationTriggerSubscription, IntegrationUserAction, IntegrationWebhookReceiverResult, IntegrationWorkflowDefinition, IntegrationWorkflowRuntime, IntegrationWorkflowRuntimeHub, IntegrationWorkflowRuntimeOptions, IntegrationWorkflowStore, InvokeWithCapabilityRequest, IssueCapabilityRequest, IssuedIntegrationCapability, type KafkaConnectorOptions, type LinkedInOptions, ListGrantsInput, ManifestValidationIssue, ManifestValidationResult, McpCatalog, McpCatalogTool, McpToolDefinition, type MicrosoftCalendarOptions, type MicrosoftGraphOptions, type MicrosoftTeamsOptions, MintCapabilityBundleInput, MissingRequirementExplanation, type MongoDbConnectorOptions, type MySqlConnectorOptions, NO_PRODUCT_FREE_CREDITS_POLICY, NoneAuthSpec, NormalizedIntegrationError, NormalizedIntegrationResult, NormalizedPermission, type NotionOptions, OAuth2AuthSpec, OAuth2TokenClientAuthMethod, OAuth2UrlTemplateMetadataSpec, OAuthClientCredentials, OAuthFlowStore, OAuthPkceMode, OAuthTokens, type OneDriveOptions, OpenApiDocument, OpenApiOperation, type OutlookMailOptions, PLATFORM_ACCESS_ISSUER, PLATFORM_ACCESS_POLICY_VERSION, PLATFORM_FUNDING_REPLAY_RETENTION_MS, PRODUCT_FREE_CREDIT_SOURCES, PROVIDER_PASSTHROUGH_ACTION, type PandaDocOptions, ParsedStripeSignatureHeader, PendingOAuthFlow, PermissionDescriptor, type PhonyConnectorOptions, PlatformAccessEvidencePayload, PlatformEvidenceVerificationKey, PlatformExchangeRequest, PlatformExchangeResponse, PlatformIntegrationPolicyPresetOptions, PostSetupCheck, type PostgresConnectorOptions, ProductFreeCreditSource, ProviderConfigError, ProviderHttpErrorInit, ProviderHttpRequestInput, ProviderPassthroughPolicy, ProviderRateLimited, ProviderRateLimitedInit, Quirk, type RabbitMqConnectorOptions, RateLimitSpec, type RedditOptions, type RedisConnectorOptions, type RedshiftConnectorOptions, RefreshInput, RegisterAppInput, RegisteredApp, RenderConsentOptions, RenderSpecOptions, RenderedConsoleStep, RequireTangleAuthOptions, ResolveAtomicIdempotencyStoreOptions, ResolveManifestInput, ResolvedDataSource, ResourceContention, type RestConnectorSpec, type RestCredentialPlacement, type RestOperationSpec, type RestRequestSpec, ScopeDescriptor, SecretRef, type SftpConnectorOptions, type SharePointOptions, type SlackOptions, SlackVerifyOptions, StartAuthRequest, StartAuthResult, StartConnectInput, StartConnectOutput, StartOAuthInput, StartOAuthOutput, StaticIntegrationPolicyEngine, StaticIntegrationPolicyOptions, StoredIntegrationEvent, StripeVerifyOptions, TANGLE_API_KEY_PREFIX, TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, TANGLE_INTEGRATIONS_CATALOG_SOURCE, TANGLE_SERVICE_TOKEN_PREFIX, TELEGRAM_FILE_DOWNLOAD_ROOT, TangleAppsClient, TangleAppsClientOptions, TangleAuthContext, TangleAuthOutcome, TangleAuthReason, TangleCatalogExecutorInvocation, TangleCatalogExecutorProviderOptions, TangleCatalogRuntimePackageManifest, TangleCatalogRuntimePackageManifestOptions, TangleCatalogTriggerInvocation, type TangleIdentityClient, type TangleIdentityOptions, TangleIdentityUnreachableError, TangleIntegrationCatalogEntry, TangleIntegrationCatalogFreshnessOptions, TangleIntegrationCatalogFreshnessResult, TangleIntegrationContract, TangleIntegrationContractStatus, TangleIntegrationImplementationKind, TangleIntegrationInvokeInput, TangleIntegrationInvokeResult, TangleIntegrationsClient, TangleIntegrationsClientOptions, type TangleTokenVerifyFailure, type TangleTokenVerifyResult, type TangleUserSummary, type TangleWorkspaceSummary, type TikTokOptions, TokenMetadataSource, TrustedFundingEvidence, TrustedPlatformEvidence, TrustedPlatformPrincipal, TwilioVerifyOptions, type TwitterOptions, VerifyTrustedPlatformEvidenceOptions, type WhatsappBusinessOptions, WorkspaceCapability, WorkspaceCapabilityDiscovery, WorkspaceToolSchema, WorkspaceTrigger, _resetPendingFlowsForTests, activecampaignConnector, actualbudgetConnector, acuitySchedulingConnector, acumbamailConnector, adapterManifestsToConnectors, adobeCreativeCloudConnector, adobeSignConnector, adpConnector, affinityConnector, afforaiConnector, agentxConnector, aianswerConnector, aidbaseConnector, aipriseConnector, airOpsConnector, aircallConnector, airparserConnector, airtableConnector, airtopConnector, alaiConnector, altTextAiConnector, alttextifyConnector, amazonBedrockConnector, amazonCloudWatchConnector, amazonEventBridgeConnector, amazonLambdaConnector, amazonS3Connector, amazonSecretsManagerConnector, amazonSesConnector, amazonSnsConnector, amazonSqsConnector, amazonTextractConnector, aminosConnector, ampecoConnector, amplemarketConnector, amplitudeConnector, anthropicConnector, anyhookWebsocketConnector, apifyConnector, apitableConnector, apitemplateIoConnector, apolloConnector, appfollowConnector, asanaConnector, ashbyConnector, askHandleConnector, asknewsConnector, assemblyaiConnector, assertNoProductFreeTrial, assertValidConnectorManifest, assertValidIntegrationManifest, assertValidIntegrationSpec, attioConnector, auditIntegrationCatalogFreshness, auditTangleIntegrationCatalogFreshness, auth0Connector, autoboundConnector, autocallsConnector, avalaraConnector, avianConnector, avomaConnector, azureAdConnector, azureBlobStorageConnector, azureCommunicationServicesConnector, azureEventGridConnector, azureOpenaiConnector, azureServiceBusConnector, backblazeConnector, bamboohrConnector, bannerbearConnector, barcodeLookupConnector, baremetricsConnector, base44Connector, basecampConnector, baserowConnector, beamerConnector, beehiivConnector, bettercontactConnector, bettermodeConnector, bexioConnector, bigcommerceConnector, biginByZohoConnector, bikaConnector, billComConnector, billplzConnector, bitlyConnector, blandAiConnector, blueskyConnector, bolnaConnector, bonjoroConnector, bookedinConnector, boxConnector, braveSearchConnector, brazeConnector, brexConnector, brightdataConnector, brilliantDirectoriesConnector, browseAiConnector, buildActivepiecesConnectors, buildApprovalRequest, buildCanonicalLaunchConnectors, buildDefaultIntegrationRegistry, buildHealthcheckPlan, buildIntegrationBridgeEnvironment, buildIntegrationBridgePayload, buildIntegrationCatalogView, buildIntegrationCoverageConnectors, buildIntegrationInvocationEnvelope, buildIntegrationToolCatalog, buildTangleCatalogRuntimePackageManifest, buildTangleIntegrationCatalogConnectors, builtwithConnector, bundledApiKeyHint, bundledAuthMode, bundledOAuth2Auth, bundledOAuth2AuthContract, buttondownConnector, calCom, calComConnector, calendarExercisePlannerManifest, calendlyConnector, cambAiConnector, campaignMonitorConnector, cannyConnector, canonicalActionConnectorId, canonicalConnectorId, canonicalIntegrationKind, canvaConnector, capsuleCrmConnector, captainDataConnector, cartloomConnector, cashfreePaymentsConnector, certopusConnector, chainAwareConnector, chainalysisApiConnector, chaindeskConnector, chargebeeConnector, chargekeepConnector, chartlyConnector, chatAidConnector, chatDataConnector, chatbaseConnector, chatlingConnector, chatnodeConnector, chatsistantConnector, chatwootConnector, checkoutConnector, chessComConnector, circleConnector, classifyGoogleError, classifyGoogleReason, classifyIntegrationCatalogExecutability, claudeConnector, clayConnector, clearoutConnector, clearoutphoneConnector, clicdataConnector, clickfunnelsConnector, clicksendConnector, clickupConnector, clientCredentialsRestConnector, clioConnector, clockifyConnector, clockodoConnector, closeConnector, cloudbedsConnector, cloudconvertConnector, cloudflareConnector, cloudinaryConnector, cloutlyConnector, codaConnector, codyConnector, cognismConnector, cognitoFormsConnector, cohereConnector, cometapiConnector, comfyicuConnector, commonRoomConnector, composeIntegrationRegistry, confluenceConnector, consoleStepsToText, constantContactConnector, consumePendingFlow, contactoutConnector, contentfulConnector, contextualAiConnector, contiguityConnector, convertkitConnector, copperConnector, copyAiConnector, couchbaseConnector, createActivepiecesExecutorProvider, createApprovalBackedPolicyEngine, createAuditingActionGuard, createCatalogExecutorProvider, createConnectionCredentialResolver, createConnectorAdapterCatalogSource, createConnectorAdapterProvider, createCredentialBackedAdapterProvider, createDefaultIntegrationActionGuard, createDefaultIntegrationPolicyEngine, createGatewayCatalogProvider, createHttpIntegrationProvider, createIntegrationAuditEvent, createIntegrationHubClient, createIntegrationRuntime, createIntegrationWorkflowRuntime, createKafkaConnector, createLinkedinConnector, createMockIntegrationProvider, createMongoDbConnector, createMySqlConnector, createOAuthBasicAuthorizationHeader, createOAuthTokenRequestHeaders, createPhonyConnector, createPlatformIntegrationPolicyPreset, createPostgresConnector, createRabbitMqConnector, createRedisConnector, createRedshiftConnector, createSftpConnector, createTangleAppsClient, createTangleCatalogExecutorProvider, createTangleIdentityClient, createTangleIntegrationsClient, crispConnector, crustdataConnector, cryptolensConnector, csvFilesConnector, customerIoConnector, customgptConnector, dappierConnector, dashworksConnector, datadogConnector, datafuelConnector, datocmsConnector, decideBillingAccess, declarativeRestConnector, decodeIntegrationBridgePayload, deepgramConnector, deepseekConnector, demandbaseConnector, denserAiConnector, describeIntegrationTool, descriptConnector, detectingAiConnector, devinConnector, dialpadConnector, digitalOceanConnector, digitalPilotConnector, discordConnector, discourseConnector, discoverWorkspaceCapabilities, dispatchIntegrationInvocation, dittofeedConnector, docsbotConnector, doctlyConnector, documentproConnector, documergeConnector, docuseal, docusignConnector, dripConnector, dropboxConnector, dubConnector, duckdbConnector, dumplingAiConnector, dustConnector, easyPeasyAiConnector, ebayConnector, echowinConnector, edenAiConnector, elasticEmailConnector, elevenlabsConnector, emailitConnector, emailoctopusConnector, encodeIntegrationBridgePayload, enrichlayerConnector, esignaturesConnector, etsyConnector, everhourConnector, exaConnector, excelFilesConnector, exchangeAuthorizationCode, explainMissingRequirements, expressTangleAuthMiddleware, extractActivepiecesPublicPieceCount, extractExternalCatalogPublicCount, extractToken, facebookLeadsConnector, facebookPagesConnector, factorsAiConnector, fathomAnalyticsConnector, fathomConnector, featheryConnector, fellowConnector, figjamConnector, figmaConnector, filloutFormsConnector, filterDiscoveryByWorkspaceScopes, findymailConnector, finishConnectFlow, firebaseConnector, fireberryConnector, firecrawlConnector, firefliesAiConnector, firstHeader, flattenIntegrationToolDefinition, flipandoConnector, flowParserConnector, flowiseConnector, flowluConnector, folkConnector, foreplayCoConnector, formEncodeOAuthClientCredential, formbricksConnector, formstackConnector, fountainConnector, fragmentConnector, frameConnector, freeAgentConnector, freshdeskConnector, freshsalesConnector, freshserviceConnector, frontConnector, fullenrichConnector, gameballConnector, gammaConnector, geminiConnector, genderApiConnector, generatebannersConnector, getActivepiecesOverride, getBundledAdapterManifest, getIntegrationFamily, getIntegrationSpec, getresponseConnector, ghostcmsConnector, giftbitConnector, gistlyConnector, giteaConnector, githubConnector, gitlabConnector, glideConnector, gmail, gongConnector, googleAnalyticsConnector, googleApiError, googleBigqueryConnector, googleCalendar, googleCloudStorageConnector, googleContactsConnector, googleDocs, googleDrive, googleErrorReason, googleForms, googleGeminiConnector, googleMeetConnector, googleMyBusinessConnector, googlePubSubConnector, googleSearchConnector, googleSearchConsoleConnector, googleSheets, googleSlidesConnector, googleTasksConnector, googleTestFailureReason, googleVertexaiConnector, googlechatConnector, gorgiasConnector, gotifyConnector, gptzeroDetectAiConnector, granolaConnector, greenhouseConnector, greenptConnector, greipConnector, griptapeConnector, gristConnector, guideliteConnector, gustoConnector, harvestConnector, hasBundledAdapter, hashiCorpVaultConnector, hastewireConnector, healthcheckRequest, heartbeatConnector, hedyConnector, hellosign, helpscoutConnector, heygenConnector, heymarketSmsConnector, heyreachConnector, hightouchConnector, honoTangleAuthMiddleware, housecallProConnector, httpConnector, hubspot, huggingFaceConnector, huggingfaceConnector, humeAiConnector, hunterConnector, hystructConnector, ibmCognoseConnector, imageRouterConnector, imapConnector, importGraphqlConnector, importMcpConnector, importOpenApiConnector, inferIntegrationManifestFromTools, inferIntegrationSupportTier, influencersClubConnector, inkboxConnector, insightlyConnector, insightoAiConnector, instaChartsConnector, instagramBusinessConnector, instantlyAiConnector, instasentConnector, integrationCoverageChecklistMarkdown, integrationSpecToConnector, integrationToolName, intercomConnector, invocationRequestFromEnvelope, invoiceninjaConnector, ironcladConnector, isRealNonPlaceholderEmail, isTrustedPlatformEvidence, jinaAiConnector, jiraCloudConnector, jiraDataCenterConnector, joggAiConnector, jotformConnector, justInvoiceConnector, justcallConnector, kafkaConnector, kallabotAiConnector, kapsoConnector, kimaiConnector, kissflowConnector, kizeoFormsConnector, klaviyoConnector, klentyConnector, knackConnector, knockConnector, koFiConnector, kommoConnector, kudosityConnector, kustomerConnector, lagrowthmachineConnector, leadConnectorConnector, leadfeederConnector, leadmagicConnector, leapAiConnector, leexiConnector, lemlistConnector, lemonSqueezyConnector, letsCalendarConnector, lettaConnector, leverConnector, lightfunnelsConnector, linearConnector, linkaConnector, linkedinConnector, linkupConnector, linqConnector, linqWhatsappConnector, listActivepiecesCatalogEntries, listBundledAdapterKinds, listBundledAdapterManifests, listBundledConnectorAdapters, listExecutableIntegrationSpecs, listIntegrationCoverageSpecs, listIntegrationSpecs, listTangleIntegrationCatalogEntries, listTangleIntegrationCatalogRuntimePackages, listTangleIntegrationContracts, listTangleNativeAdapterIds, llmrailsConnector, lobstermailConnector, localaiConnector, loftyConnector, logrocketConnector, logsnagConnector, lokaliseConnector, loopsConnector, lucidyaConnector, lushaConnector, luxuryPresenceConnector, magicalApiConnector, mailchainConnector, mailchimpConnector, mailerLiteConnector, mailercheckConnector, mailerooConnector, mailgunConnector, makeConnector, manifestToConnector, manychatConnector, marketoConnector, mastodonConnector, matomoConnector, matrixConnector, mattermostConnector, mauticConnector, medullarConnector, meetgeekAiConnector, memConnector, messagebirdConnector, metabaseConnector, microsoft365PeopleConnector, microsoft365PlannerConnector, microsoftCalendar, microsoftDynamics365BusinessCentralConnector, microsoftDynamicsCrmConnector, microsoftExcel365Connector, microsoftGraph, microsoftOnenoteConnector, microsoftPowerBiConnector, microsoftTeams, microsoftTodoConnector, millionverifierConnector, mindStudioConnector, mindeeConnector, miroConnector, missiveConnector, mixmaxConnector, mixpanelConnector, modelslabConnector, modjoConnector, mollieConnector, mondayConnector, mongodbConnector, mycaseConnector, mysqlConnector, n8nConnector, netlifyConnector, netsuiteConnector, neverbounceConnector, niftyConnector, ninjapipeConnector, nocodbConnector, nooksConnector, normalizeGatewayCatalog, normalizeIntegrationError, normalizeIntegrationResult, notion, notionConnector, ntfyConnector, oauthClientCredentialRedactionValues, oceanIoConnector, odooConnector, oktaConnector, omniCoConnector, omnihrConnector, oneDrive, oneSpanSignConnector, oneloginConnector, openPhoneConnector, openRouterConnector, openaiConnector, openmicAiConnector, opnformConnector, opportifyConnector, opsgenieConnector, oracleDatabaseConnector, orimonConnector, outlookMail, outreachConnector, paddleConnector, pagerdutyConnector, pandadoc, paperformConnector, parquetFilesConnector, parseIntegrationBridgeEnvironment, parseIntegrationToolName, parseStripeSignatureHeader, parseurConnector, pastefyConnector, paychexConnector, paywhirlConnector, pdfmonkeyConnector, peekshotConnector, perplexityAiConnector, personalAiConnector, phantombusterConnector, phonyConnector, pinchPaymentsConnector, pineconeConnector, pingIdentityConnector, pipedreamConnector, pipedriveConnector, placidConnector, plaidConnector, plausibleConnector, pocketbaseConnector, pollybotAiConnector, polytomicConnector, postgresConnector, posthogConnector, postizConnector, postmarkConnector, predictLeadsConnector, pricelabsConnector, productboardConnector, proxycurlConnector, publicKafkaSocketFactory, pushbulletConnector, pushoverConnector, qawafelConnector, qdrantConnector, quadernoConnector, quickbooksConnector, quickzuConnector, rabbitMqConnector, raiaAiConnector, rampConnector, rapidtextAiConnector, reachinboxConnector, recallAiConnector, receiveIntegrationWebhook, recurlyConnector, redactApprovalRequest, redactCapability, redactIntegrationBridgePayload, redactInvocationEnvelope, redactOAuthSensitiveText, reddit, redditConnector, redisConnector, redshiftConnector, refreshAccessToken, renderAgentToolDescription, renderApprovalCopy, renderConsentSummary, renderConsoleSteps, renderRunbookMarkdown, renderTangleCatalogRuntimePnpmAddCommand, reoonVerifierConnector, replyIoConnector, requireBrokerGrantReceipt, requireTangleAuth, resendConnector, resolveAtomicIdempotencyStore, resolveConnectionCredentials, resolveConnectorAdapterFactoryOptions, resolveConnectorAuthSpec, resolveIntegrationApproval, retableConnector, retellAiConnector, revokeConnectFlow, revokeConnection, ringcentralConnector, ripplingConnector, robollyConnector, rssConnector, runIntegrationHealthcheck, runIntegrationHealthchecks, runwareConnector, saasticConnector, sageIntacctConnector, saleorConnector, salesforceConnector, saleshandyConnector, salesloftConnector, sanitizeAuditConnection, sanitizeConnection, sanityConnector, sardisConnector, savvycalConnector, scimConnector, scrapegraphaiConnector, scrapelessConnector, seamlessAiConnector, searchIntegrationTools, seekTableConnector, segmentConnector, semrushConnector, sendblueConnector, sendgridConnector, sendinblueConnector, sendpulseConnector, senjaConnector, sentryConnector, serperConnector, serpstatConnector, serviceNowConnector, sftpConnector, sharepoint, shippoConnector, shopifyConnector, shortIoConnector, signCapability, signNowConnector, signrequestConnector, signwellConnector, similarwebConnector, simplirouteConnector, simplybookmeConnector, skyprepConnector, slack, slackEventsConnector, smartleadConnector, smartsheetConnector, smartsuiteConnector, smooveConnector, smsmodeConnector, snovIoConnector, snowflakeConnector, socialkitConnector, specAuthToConnectorAuth, squareConnector, startConnectFlow, startOAuthFlow, statusForCode, storedEventToTriggerEvent, stripeConnector, stripePackConnector, stripeWebhookReceiverConnector, summarizeIntegrationRegistry, supabaseConnector, supadataConnector, swarmnodeConnector, systemeIoConnector, tableauConnector, talkableConnector, tallyConnector, tangleIdentity, taxjarConnector, teableConnector, telegramConnector, telnyxConnector, tenzoConnector, textcortexAiConnector, theirstackConnector, ticktickConnector, tiktok, tiktokConnector, timeOpsConnector, timelinesAiConnector, tlDvConnector, toMcpTools, todoistConnector, togglTrackConnector, totalcmsConnector, trelloConnector, twentyConnector, twilioConnector, twilioSmsConnector, twinLabsConnector, twitter, twitterConnector, typeformConnector, typefullyConnector, umamiConnector, upgradechatConnector, uscreenConnector, usergemsConnector, validateConnectorManifest, validateCredentialFormat, validateCredentialSet, validateIntegrationInvocationEnvelope, validateIntegrationManifest, validateIntegrationSpec, validateProviderPassthroughRequest, validatedmailsConnector, vapiConnector, vboutConnector, vercelConnector, verifyCapabilityToken, verifyEmailSignature, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTrustedPlatformEvidence, verifyTwilioSignature, videoaskConnector, vidlab7Connector, vlmRunConnector, voucheryIoConnector, vtexConnector, vtigerConnector, wafeqConnector, warmlyConnector, weaviateConnector, webflowConnector, webhookConnector, webscrapingAiConnector, whatConvertsConnector, whatsappBusiness, whatsappConnector, whatsscaleConnector, wizaConnector, wonderchatConnector, woocommerceConnector, woodpeckerConnector, wootricConnector, wordpressConnector, workableConnector, workdayConnector, wrikeConnector, writesonicBulkConnector, wufooConnector, xeroConnector, youcanbookmeConnector, youtubeDataConnector, zagomailConnector, zapierConnector, zendeskConnector, zendeskSellConnector, zenrowsConnector, zeplinConnector, zerobounceConnector, zohoBookingsConnector, zohoBooksConnector, zohoCampaignsConnector, zohoCrmConnector, zohoDeskConnector, zohoInvoiceConnector, zohoMailConnector, zoomConnector, zoominfoConnector, zuoraConnector };