@axtary/adapters 0.0.1 → 0.2.0

package/dist/index.js

@@ -1,86 +1,27 @@
-import { verifyActionPass, } from "@axtary/actionpass";
-import { createHash, createHmac } from "node:crypto";
+import { actionPassDpopTarget, InMemoryDpopReplayStore, verifyActionPass, analyzePostgresSelect, POSTGRES_NATIVE_CONNECTOR_GOVERNANCE, DRIVE_NATIVE_CONNECTOR_GOVERNANCE, GITHUB_NATIVE_CONNECTOR_GOVERNANCE, JIRA_NATIVE_CONNECTOR_GOVERNANCE, LINEAR_NATIVE_CONNECTOR_GOVERNANCE, } from "@axtary/actionpass";
+import { SignJWT } from "jose";
+import { Client } from "pg";
+import { createHash, createHmac, createPrivateKey } from "node:crypto";
 import { readdir, readFile, stat } from "node:fs/promises";
 import { basename, extname, isAbsolute, relative, resolve, sep } from "node:path";
 export const GITHUB_REST_API_BASE_URL = "https://api.github.com";
 export const GITHUB_REST_USER_AGENT = "axtary-local-proxy";
 export const SLACK_WEB_API_BASE_URL = "https://slack.com/api";
 export const LINEAR_GRAPHQL_API_URL = "https://api.linear.app/graphql";
+export const JIRA_CLOUD_API_BASE_URL = "https://api.atlassian.com";
 export const AWS_STS_API_URL = "https://sts.amazonaws.com/";
 export const GCP_CLOUD_RESOURCE_MANAGER_API_BASE_URL = "https://cloudresourcemanager.googleapis.com";
 export const GCP_STORAGE_API_BASE_URL = "https://storage.googleapis.com/storage/v1";
+export const GOOGLE_DRIVE_API_BASE_URL = "https://www.googleapis.com/drive/v3";
 export const DEFAULT_PROVIDER_RETRIES = 2;
+export function createNativeConnectorHandlers(descriptor, config, options = {}) {
+    const handlers = descriptor.createHandlers(config);
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
 export const CONNECTOR_CAPABILITY_REGISTRY = [
-    {
-        id: "github-pr-create",
-        provider: "github",
-        connector: "github-rest",
-        label: "Create pull request",
-        tool: "github.pull_requests.create",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake", "rest"],
-        requiresActionPass: true,
-        defaultPolicy: "step_up",
-        payloadFields: ["title", "baseBranch", "filesChanged", "testsPassed", "touchesProduction"],
-        approvalTriggers: [
-            "protected path",
-            "production impact",
-            "base branch mismatch",
-            "missing tests",
-            "large file set",
-        ],
-        credentialBoundary: "GitHub token stays in the proxy/adapter; the agent receives an ActionPass-bound result.",
-        smokeCheck: "GET /user",
-    },
-    {
-        id: "github-content-read",
-        provider: "github",
-        connector: "github-rest",
-        label: "Read repository content",
-        tool: "github.contents.read",
-        operation: "read",
-        status: "supported",
-        supportedModes: ["fake", "rest"],
-        requiresActionPass: true,
-        defaultPolicy: "deny_until_scoped",
-        payloadFields: ["path", "ref"],
-        approvalTriggers: ["denied secret or production path"],
-        credentialBoundary: "Repository content is fetched by the adapter after policy checks deny protected paths.",
-        smokeCheck: "GET /user",
-    },
-    {
-        id: "github-branch-create",
-        provider: "github",
-        connector: "github-rest",
-        label: "Create branch",
-        tool: "github.branches.create",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake", "rest"],
-        requiresActionPass: true,
-        defaultPolicy: "allow",
-        payloadFields: ["branch", "baseBranch", "sha", "allowExisting"],
-        approvalTriggers: ["base branch mismatch"],
-        credentialBoundary: "Branch creation runs through the proxy and is bound to the same ActionPass verification path.",
-        smokeCheck: "GET /user",
-    },
-    {
-        id: "github-content-write",
-        provider: "github",
-        connector: "github-rest",
-        label: "Write repository content",
-        tool: "github.contents.write",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake", "rest"],
-        requiresActionPass: true,
-        defaultPolicy: "step_up",
-        payloadFields: ["path", "branch", "message", "sha", "content"],
-        approvalTriggers: ["protected path"],
-        credentialBoundary: "File content is never written until policy and ActionPass verification both pass.",
-        smokeCheck: "GET /user",
-    },
+    ...GITHUB_NATIVE_CONNECTOR_GOVERNANCE.tools.map((tool) => tool.capability),
     {
         id: "slack-message-create",
         provider: "slack",
@@ -97,102 +38,10 @@ export const CONNECTOR_CAPABILITY_REGISTRY = [
         credentialBoundary: "Slack bot token stays adapter-side; exact outbound text is the approval payload.",
         smokeCheck: "auth.test",
     },
-    {
-        id: "linear-issue-read",
-        provider: "linear",
-        connector: "linear-graphql",
-        label: "Read issue",
-        tool: "linear.issues.read",
-        operation: "read",
-        status: "supported",
-        supportedModes: ["fake", "graphql"],
-        requiresActionPass: true,
-        defaultPolicy: "allow",
-        payloadFields: ["issueKey", "projectKey"],
-        approvalTriggers: [],
-        credentialBoundary: "Linear API key stays adapter-side; policy pins issue access by project key.",
-        smokeCheck: "viewer",
-    },
-    {
-        id: "linear-comment-create",
-        provider: "linear",
-        connector: "linear-graphql",
-        label: "Create issue comment",
-        tool: "linear.comments.create",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake", "graphql"],
-        requiresActionPass: true,
-        defaultPolicy: "allow",
-        payloadFields: ["issueKey", "projectKey", "body"],
-        approvalTriggers: [],
-        credentialBoundary: "Linear comments execute only through proxy policy and ActionPass verification.",
-        smokeCheck: "viewer",
-    },
-    {
-        id: "linear-issue-update",
-        provider: "linear",
-        connector: "linear-graphql",
-        label: "Update issue",
-        tool: "linear.issues.update",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake", "graphql"],
-        requiresActionPass: true,
-        defaultPolicy: "step_up",
-        payloadFields: ["issueKey", "projectKey", "status", "title", "description", "priority"],
-        approvalTriggers: ["protected status"],
-        credentialBoundary: "Issue mutations stay behind adapter credentials and project/status policy checks.",
-        smokeCheck: "viewer",
-    },
-    {
-        id: "jira-issue-read",
-        provider: "jira",
-        connector: "jira-fake",
-        label: "Read issue",
-        tool: "jira.issues.read",
-        operation: "read",
-        status: "supported",
-        supportedModes: ["fake"],
-        requiresActionPass: true,
-        defaultPolicy: "allow",
-        payloadFields: ["issueKey", "projectKey"],
-        approvalTriggers: [],
-        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
-        smokeCheck: null,
-    },
-    {
-        id: "jira-comment-create",
-        provider: "jira",
-        connector: "jira-fake",
-        label: "Create issue comment",
-        tool: "jira.comments.create",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake"],
-        requiresActionPass: true,
-        defaultPolicy: "allow",
-        payloadFields: ["issueKey", "projectKey", "body"],
-        approvalTriggers: [],
-        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
-        smokeCheck: null,
-    },
-    {
-        id: "jira-issue-update",
-        provider: "jira",
-        connector: "jira-fake",
-        label: "Update issue",
-        tool: "jira.issues.update",
-        operation: "write",
-        status: "supported",
-        supportedModes: ["fake"],
-        requiresActionPass: true,
-        defaultPolicy: "step_up",
-        payloadFields: ["issueKey", "projectKey", "status"],
-        approvalTriggers: ["protected status"],
-        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
-        smokeCheck: null,
-    },
+    ...LINEAR_NATIVE_CONNECTOR_GOVERNANCE.tools.map((tool) => tool.capability),
+    ...JIRA_NATIVE_CONNECTOR_GOVERNANCE.tools.map((tool) => tool.capability),
+    ...POSTGRES_NATIVE_CONNECTOR_GOVERNANCE.tools.map((tool) => tool.capability),
+    ...DRIVE_NATIVE_CONNECTOR_GOVERNANCE.tools.map((tool) => tool.capability),
     {
         id: "aws-identity-get",
         provider: "aws",
@@ -348,6 +197,298 @@ export function getConnectorCapability(tool) {
 export function getConnectorCapabilitiesByProvider(provider) {
     return CONNECTOR_CAPABILITY_REGISTRY.filter((capability) => capability.provider === provider);
 }
+export async function buildConnectorReadinessReport(input = {}) {
+    const env = input.env ?? process.env;
+    const providers = [
+        providerReadiness({
+            provider: "github",
+            mode: input.adapters?.github?.mode ?? "fake",
+            requiredEnv: input.adapters?.github?.mode === "rest"
+                ? [input.adapters.github.tokenEnv ?? "GITHUB_TOKEN"]
+                : input.adapters?.github?.mode === "app"
+                    ? githubAppRequiredEnv({
+                        appId: input.adapters.github.appId,
+                        appIdEnv: input.adapters.github.appIdEnv,
+                        installationId: input.adapters.github.installationId,
+                        installationIdEnv: input.adapters.github.installationIdEnv,
+                        privateKeyEnv: input.adapters.github.privateKeyEnv ?? "AXTARY_GITHUB_APP_PRIVATE_KEY",
+                    })
+                    : [],
+            env,
+            smokeCheck: input.adapters?.github?.mode === "app"
+                ? "POST /app/installations/{id}/access_tokens"
+                : "GET /user + X-Accepted-GitHub-Permissions",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Fake GitHub adapter is active for deterministic local execution.",
+            readySummary: input.adapters?.github?.mode === "app"
+                ? "GitHub App mode mints short-lived installation tokens from an env-backed private key."
+                : "GitHub REST mode has an env-backed token configured.",
+        }),
+        providerReadiness({
+            provider: "slack",
+            mode: input.adapters?.slack?.mode ?? "fake",
+            requiredEnv: input.adapters?.slack?.mode === "web"
+                ? [input.adapters.slack.tokenEnv ?? "SLACK_BOT_TOKEN"]
+                : [],
+            env,
+            smokeCheck: "auth.test",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Fake Slack adapter is active for deterministic local execution.",
+            readySummary: "Slack Web API mode has an env-backed bot token configured.",
+        }),
+        providerReadiness({
+            provider: "linear",
+            mode: input.adapters?.linear?.mode ?? "fake",
+            requiredEnv: input.adapters?.linear?.mode === "graphql"
+                ? [input.adapters.linear.tokenEnv ?? "LINEAR_API_KEY"]
+                : [],
+            env,
+            smokeCheck: "viewer",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Fake Linear adapter is active for deterministic local execution.",
+            readySummary: "Linear GraphQL mode has an env-backed API key configured.",
+        }),
+        providerReadiness({
+            provider: "jira",
+            mode: input.adapters?.jira?.mode ?? "fake",
+            requiredEnv: input.adapters?.jira?.mode === "rest"
+                ? input.adapters.jira.auth === "oauth"
+                    ? [
+                        input.adapters.jira.tokenEnv ?? "JIRA_OAUTH_TOKEN",
+                        ...(input.adapters.jira.cloudId
+                            ? []
+                            : [
+                                input.adapters.jira.cloudIdEnv ??
+                                    "AXTARY_JIRA_CLOUD_ID",
+                            ]),
+                    ]
+                    : [
+                        input.adapters.jira.emailEnv ?? "JIRA_EMAIL",
+                        input.adapters.jira.tokenEnv ?? "JIRA_API_TOKEN",
+                    ]
+                : [],
+            env,
+            configuredResources: [
+                ...(input.adapters?.jira?.mode === "rest" &&
+                    input.adapters?.jira?.cloudId
+                    ? [`cloud:${input.adapters.jira.cloudId}`]
+                    : []),
+                ...(input.adapters?.jira?.mode === "rest" &&
+                    input.adapters?.jira?.siteUrl
+                    ? [`site:${input.adapters.jira.siteUrl}`]
+                    : []),
+            ],
+            smokeCheck: "GET /myself",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Fake Jira adapter is active for deterministic local execution.",
+            readySummary: input.adapters?.jira?.auth === "oauth"
+                ? "Jira REST mode has an OAuth credential and cloud site configured."
+                : "Jira REST mode has an email and API token configured.",
+        }),
+        providerReadiness({
+            provider: "postgres",
+            mode: input.adapters?.postgres?.mode ?? "off",
+            requiredEnv: input.adapters?.postgres?.mode === "postgres"
+                ? [input.adapters.postgres.dsnEnv ?? "AXTARY_POSTGRES_DSN"]
+                : [],
+            env,
+            configuredResources: input.adapters?.postgres?.allowedTables?.map((table) => `table:${table}`) ?? [],
+            smokeCheck: "current role/database, read-only state, and RLS metadata",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Postgres adapter is disabled until a DSN and explicit table scope are configured.",
+            readySummary: "Postgres native mode has an env-backed DSN; smoke still verifies least privilege, read-only transactions, and RLS.",
+        }),
+        providerReadiness({
+            provider: "drive",
+            mode: input.adapters?.drive?.mode ?? "off",
+            requiredEnv: input.adapters?.drive?.mode === "rest"
+                ? [input.adapters.drive.tokenEnv ?? "AXTARY_DRIVE_ACCESS_TOKEN"]
+                : [],
+            env,
+            configuredResources: input.adapters?.drive?.selectedFileId
+                ? [`file:${input.adapters.drive.selectedFileId}`]
+                : [],
+            smokeCheck: "selected-file metadata and provider isAppAuthorized state",
+            smokeCommand: "axtary doctor connectors --config axtary.yml",
+            localSummary: "Google Drive is disabled until REST mode and a local OAuth connection are configured.",
+            readySummary: "Google Drive REST mode has an env-backed token; local broker credentials can also satisfy runtime execution.",
+        }),
+        providerReadiness({
+            provider: "aws",
+            mode: input.adapters?.aws?.mode ?? "off",
+            requiredEnv: input.adapters?.aws?.mode === "rest"
+                ? [
+                    input.adapters.aws.accessKeyIdEnv ?? "AWS_ACCESS_KEY_ID",
+                    input.adapters.aws.secretAccessKeyEnv ?? "AWS_SECRET_ACCESS_KEY",
+                ]
+                : [],
+            optionalEnv: input.adapters?.aws?.mode === "rest"
+                ? [input.adapters.aws.sessionTokenEnv ?? "AWS_SESSION_TOKEN"]
+                : [],
+            env,
+            smokeCheck: "STS GetCallerIdentity",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "AWS adapter is disabled in the active local config.",
+            readySummary: "AWS REST mode has access key and secret env vars configured.",
+        }),
+        providerReadiness({
+            provider: "gcp",
+            mode: input.adapters?.gcp?.mode ?? "off",
+            requiredEnv: input.adapters?.gcp?.mode === "rest"
+                ? [input.adapters.gcp.accessTokenEnv ?? "GCP_ACCESS_TOKEN"]
+                : [],
+            env,
+            smokeCheck: "Cloud Resource Manager project get",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            configuredResources: input.adapters?.gcp?.projectId
+                ? [`project:${input.adapters.gcp.projectId}`]
+                : [],
+            localSummary: "GCP adapter is disabled in the active local config.",
+            readySummary: "GCP REST mode has an env-backed access token configured.",
+        }),
+        await docsReadiness(input),
+        providerReadiness({
+            provider: "mcp",
+            mode: "local-wrapper",
+            requiredEnv: [],
+            env,
+            smokeCheck: null,
+            smokeCommand: null,
+            localSummary: "MCP wrapper is local and verifies server identity, schema version, and tool definition hashes.",
+            readySummary: "MCP wrapper is local and verifies server identity, schema version, and tool definition hashes.",
+        }),
+    ];
+    const totals = providers.reduce((acc, provider) => {
+        if (provider.status === "ready")
+            acc.ready += 1;
+        if (provider.status === "local_only")
+            acc.localOnly += 1;
+        if (provider.status === "missing_env")
+            acc.missingEnv += 1;
+        if (provider.status === "off")
+            acc.off += 1;
+        if (provider.status === "planned")
+            acc.planned += 1;
+        acc.supportedCapabilities += provider.supportedCapabilities;
+        acc.plannedCapabilities += provider.plannedCapabilities;
+        return acc;
+    }, {
+        ready: 0,
+        localOnly: 0,
+        missingEnv: 0,
+        off: 0,
+        planned: 0,
+        supportedCapabilities: 0,
+        plannedCapabilities: 0,
+    });
+    return {
+        schemaVersion: "axtary.connector_readiness.v0",
+        source: "package_registry",
+        generatedAt: input.generatedAt ?? new Date().toISOString(),
+        providers,
+        totals,
+    };
+}
+function providerReadiness(input) {
+    const capabilities = getConnectorCapabilitiesByProvider(input.provider);
+    const supportedCapabilities = capabilities.filter((capability) => capability.status === "supported").length;
+    const plannedCapabilities = capabilities.length - supportedCapabilities;
+    const presentEnv = [...input.requiredEnv, ...(input.optionalEnv ?? [])].filter((name) => Boolean(input.env[name]));
+    const missingEnv = input.requiredEnv.filter((name) => !input.env[name]);
+    const status = providerStatus(input.mode, missingEnv);
+    return {
+        provider: input.provider,
+        mode: input.mode,
+        status,
+        supportedCapabilities,
+        plannedCapabilities,
+        requiredEnv: input.requiredEnv,
+        optionalEnv: input.optionalEnv ?? [],
+        presentEnv,
+        missingEnv,
+        configuredResources: input.configuredResources ?? [],
+        smokeCheck: input.smokeCheck,
+        smokeCommand: input.smokeCommand,
+        summary: status === "missing_env"
+            ? `Missing required env: ${missingEnv.join(", ")}.`
+            : status === "ready"
+                ? input.readySummary
+                : input.localSummary,
+    };
+}
+async function docsReadiness(input) {
+    const docs = input.adapters?.docs;
+    const mode = docs?.mode ?? "local";
+    const roots = docs?.roots ?? [];
+    const baseDir = input.docsBaseDir ?? /* turbopackIgnore: true */ process.cwd();
+    if (mode === "off") {
+        return providerReadiness({
+            provider: "docs",
+            mode: "off",
+            requiredEnv: [],
+            env: input.env ?? process.env,
+            smokeCheck: "configured roots exist",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            localSummary: "Local docs connector is disabled in the active config.",
+            readySummary: "Local docs connector is disabled in the active config.",
+        });
+    }
+    const missingRoots = [];
+    for (const root of roots) {
+        const rootPath = isAbsolute(root) ? root : resolve(baseDir, root);
+        try {
+            const stats = await stat(rootPath);
+            if (!stats.isDirectory())
+                missingRoots.push(root);
+        }
+        catch {
+            missingRoots.push(root);
+        }
+    }
+    if (missingRoots.length > 0) {
+        const capabilities = getConnectorCapabilitiesByProvider("docs");
+        return {
+            provider: "docs",
+            mode: "local",
+            status: "missing_env",
+            supportedCapabilities: capabilities.filter((capability) => capability.status === "supported").length,
+            plannedCapabilities: capabilities.filter((capability) => capability.status === "planned").length,
+            requiredEnv: [],
+            optionalEnv: [],
+            presentEnv: [],
+            missingEnv: missingRoots.map((root) => `root:${root}`),
+            configuredResources: roots.map((root) => `root:${root}`),
+            smokeCheck: "configured roots exist",
+            smokeCommand: "axtary smoke --config axtary.yml",
+            summary: `Missing configured docs roots: ${missingRoots.join(", ")}.`,
+        };
+    }
+    return providerReadiness({
+        provider: "docs",
+        mode: "local",
+        requiredEnv: [],
+        env: input.env ?? process.env,
+        configuredResources: [
+            `workspace:${docs?.workspace ?? "local"}`,
+            ...roots.map((root) => `root:${root}`),
+        ],
+        smokeCheck: "configured roots exist",
+        smokeCommand: "axtary smoke --config axtary.yml",
+        localSummary: "Local docs connector roots exist and are bounded by docs policy.",
+        readySummary: "Local docs connector roots exist and are bounded by docs policy.",
+    });
+}
+function providerStatus(mode, missingEnv) {
+    if (mode === "planned")
+        return "planned";
+    if (mode === "off")
+        return "off";
+    if (missingEnv.length > 0)
+        return "missing_env";
+    if (mode === "fake" || mode === "local" || mode === "local-wrapper")
+        return "local_only";
+    return "ready";
+}
 export function createFakeAdapterState() {
     return {
         github: {
@@ -405,16 +546,19 @@ export function createFakeHandlers(state = createFakeAdapterState(), options = {
         ? wrapHandlersWithActionPassVerification(handlers, options.verification)
         : handlers;
 }
-export function createGitHubRestHandlers(config, options = {}) {
-    const handlers = {
+function createGitHubRestHandlersRaw(config) {
+    return {
         "github.contents.read": createGitHubRestContentReadHandler(config),
         "github.pull_requests.create": createGitHubRestPullRequestHandler(config),
         "github.branches.create": createGitHubRestBranchCreateHandler(config),
         "github.contents.write": createGitHubRestContentWriteHandler(config),
+        "github.pull_request_review_comments.create": createGitHubRestReviewCommentHandler(config),
+        "github.check_runs.create": createGitHubRestCheckRunHandler(config),
+        "github.issue_comments.create": createGitHubRestIssueCommentHandler(config),
     };
-    return options.verification
-        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
-        : handlers;
+}
+export function createGitHubRestHandlers(config, options = {}) {
+    return createNativeConnectorHandlers(GITHUB_NATIVE_CONNECTOR, config, options);
 }
 export function createSlackWebHandlers(config, options = {}) {
     const handlers = {
@@ -424,15 +568,282 @@ export function createSlackWebHandlers(config, options = {}) {
         ? wrapHandlersWithActionPassVerification(handlers, options.verification)
         : handlers;
 }
-export function createLinearGraphqlHandlers(config, options = {}) {
-    const handlers = {
+function createLinearGraphqlHandlersRaw(config) {
+    return {
         "linear.issues.read": createLinearIssueReadHandler(config),
         "linear.comments.create": createLinearCommentCreateHandler(config),
         "linear.issues.update": createLinearIssueUpdateHandler(config),
     };
-    return options.verification
-        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
-        : handlers;
+}
+export const LINEAR_NATIVE_CONNECTOR = {
+    ...LINEAR_NATIVE_CONNECTOR_GOVERNANCE,
+    createHandlers: createLinearGraphqlHandlersRaw,
+    smoke: smokeLinearGraphqlCredentials,
+    doctor: async (config, context) => {
+        const credential = await context.resolveCredential?.("linear");
+        const token = credential?.token ?? context.env[config.tokenEnv];
+        return {
+            provider: "linear",
+            mode: config.mode,
+            activeMode: "graphql",
+            capability: config.mode === "graphql" ? "real-write" : "fake",
+            requiredEnv: config.mode === "graphql" && !token ? [config.tokenEnv] : [],
+            requiredScopes: config.mode === "graphql"
+                ? [...LINEAR_NATIVE_CONNECTOR_GOVERNANCE.requiredScopes]
+                : [],
+            smokeCheck: config.mode === "graphql"
+                ? LINEAR_NATIVE_CONNECTOR_GOVERNANCE.smokeCheck
+                : null,
+            runSmoke: config.mode === "graphql"
+                ? () => smokeLinearGraphqlCredentials({
+                    token: token ?? "",
+                    apiUrl: config.apiUrl,
+                    fetch: context.fetch,
+                    maxRetries: 0,
+                })
+                : undefined,
+        };
+    },
+};
+export const GITHUB_NATIVE_CONNECTOR = {
+    ...GITHUB_NATIVE_CONNECTOR_GOVERNANCE,
+    createHandlers: createGitHubRestHandlersRaw,
+    smoke: smokeGitHubRestCredentials,
+    doctor: async (config, context) => {
+        const credential = await context.resolveCredential?.("github");
+        const restToken = credential?.token ?? context.env[config.tokenEnv];
+        const appRequiredEnv = config.mode === "app"
+            ? githubAppRequiredEnv({
+                appId: config.appId,
+                appIdEnv: config.appIdEnv,
+                installationId: config.installationId,
+                installationIdEnv: config.installationIdEnv,
+                privateKeyEnv: config.privateKeyEnv,
+            })
+            : [];
+        const missingEnv = config.mode === "rest"
+            ? restToken
+                ? []
+                : [config.tokenEnv]
+            : config.mode === "app"
+                ? appRequiredEnv.filter((name) => !context.env[name])
+                : [];
+        return {
+            provider: "github",
+            mode: config.mode,
+            activeMode: config.mode === "app" ? "app" : "rest",
+            capability: config.mode === "app" || config.mode === "rest"
+                ? "real-write"
+                : "fake",
+            requiredEnv: missingEnv,
+            requiredScopes: config.mode === "app" || config.mode === "rest"
+                ? [...GITHUB_NATIVE_CONNECTOR_GOVERNANCE.requiredScopes]
+                : [],
+            smokeCheck: config.mode === "app" || config.mode === "rest"
+                ? GITHUB_NATIVE_CONNECTOR_GOVERNANCE.smokeCheck
+                : null,
+            runSmoke: config.mode === "rest"
+                ? () => smokeGitHubRestCredentials({
+                    token: restToken ?? "",
+                    apiBaseUrl: config.apiBaseUrl,
+                    userAgent: config.userAgent,
+                    fetch: context.fetch,
+                    maxRetries: 0,
+                })
+                : config.mode === "app" && missingEnv.length === 0
+                    ? () => {
+                        const resolved = resolveGithubAppCredentials({
+                            appId: config.appId,
+                            appIdEnv: config.appIdEnv,
+                            installationId: config.installationId,
+                            installationIdEnv: config.installationIdEnv,
+                            privateKeyEnv: config.privateKeyEnv,
+                        }, context.env);
+                        return smokeGithubAppCredentials({
+                            ...resolved,
+                            apiBaseUrl: config.apiBaseUrl,
+                            userAgent: config.userAgent,
+                            fetch: context.fetch,
+                        });
+                    }
+                    : undefined,
+        };
+    },
+};
+export function createLinearGraphqlHandlers(config, options = {}) {
+    return createNativeConnectorHandlers(LINEAR_NATIVE_CONNECTOR, config, options);
+}
+function createJiraRestHandlersRaw(config) {
+    return {
+        "jira.issues.read": createJiraIssueReadHandler(config),
+        "jira.comments.create": createJiraCommentCreateHandler(config),
+        "jira.issues.update": createJiraIssueUpdateHandler(config),
+    };
+}
+export const JIRA_NATIVE_CONNECTOR = {
+    ...JIRA_NATIVE_CONNECTOR_GOVERNANCE,
+    createHandlers: createJiraRestHandlersRaw,
+    smoke: smokeJiraRestCredentials,
+    doctor: async (config, context) => {
+        const credential = await context.resolveCredential?.("jira");
+        const cloudId = credential?.cloudId ??
+            config.cloudId ??
+            context.env[config.cloudIdEnv];
+        const siteUrl = credential?.siteUrl ?? config.siteUrl;
+        const token = credential?.token ?? context.env[config.tokenEnv];
+        const email = credential?.email ?? context.env[config.emailEnv];
+        const missingEnv = config.mode !== "rest"
+            ? []
+            : config.auth === "oauth"
+                ? [
+                    ...(!token ? [config.tokenEnv] : []),
+                    ...(!cloudId ? [config.cloudIdEnv] : []),
+                ]
+                : [
+                    ...(!email ? [config.emailEnv] : []),
+                    ...(!token ? [config.tokenEnv] : []),
+                ];
+        const auth = config.auth === "oauth"
+            ? { type: "bearer", token: token ?? "" }
+            : { type: "basic", email: email ?? "", apiToken: token ?? "" };
+        return {
+            provider: "jira",
+            mode: config.mode,
+            activeMode: "rest",
+            capability: config.mode === "rest" ? "real-write" : "fake",
+            requiredEnv: missingEnv,
+            requiredScopes: config.mode === "rest"
+                ? [...JIRA_NATIVE_CONNECTOR_GOVERNANCE.requiredScopes]
+                : [],
+            smokeCheck: config.mode === "rest"
+                ? JIRA_NATIVE_CONNECTOR_GOVERNANCE.smokeCheck
+                : null,
+            runSmoke: config.mode === "rest"
+                ? () => smokeJiraRestCredentials({
+                    auth,
+                    apiBaseUrl: auth.type === "bearer"
+                        ? `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId ?? "")}/rest/api/3`
+                        : `${siteUrl.replace(/\/$/, "")}/rest/api/3`,
+                    siteUrl,
+                    fetch: context.fetch,
+                    maxRetries: 0,
+                })
+                : undefined,
+        };
+    },
+};
+export function createJiraRestHandlers(config, options = {}) {
+    return createNativeConnectorHandlers(JIRA_NATIVE_CONNECTOR, config, options);
+}
+function createPostgresNativeHandlersRaw(config) {
+    return {
+        "postgres.query.select": createPostgresSelectHandler(config),
+    };
+}
+function createDriveRestHandlersRaw(config) {
+    return {
+        "drive.files.read": createDriveFileReadHandler(config),
+    };
+}
+export const POSTGRES_NATIVE_CONNECTOR = {
+    ...POSTGRES_NATIVE_CONNECTOR_GOVERNANCE,
+    createHandlers: createPostgresNativeHandlersRaw,
+    smoke: smokePostgresCredentials,
+    doctor: async (config, context) => {
+        const connectionString = context.env[config.dsnEnv];
+        return {
+            provider: "postgres",
+            mode: config.mode,
+            activeMode: "postgres",
+            capability: config.mode === "postgres" ? "read-only" : "off",
+            requiredEnv: config.mode === "postgres" && !connectionString ? [config.dsnEnv] : [],
+            requiredScopes: config.mode === "postgres"
+                ? [...POSTGRES_NATIVE_CONNECTOR_GOVERNANCE.requiredScopes]
+                : [],
+            smokeCheck: config.mode === "postgres"
+                ? POSTGRES_NATIVE_CONNECTOR_GOVERNANCE.smokeCheck
+                : null,
+            runSmoke: config.mode === "postgres" && connectionString
+                ? () => smokePostgresCredentials({
+                    connectionString,
+                    allowedTables: config.allowedTables,
+                    allowedFunctions: config.allowedFunctions,
+                    requireRls: config.requireRls,
+                    maxRows: config.maxRows,
+                    statementTimeoutMs: config.statementTimeoutMs,
+                    lockTimeoutMs: config.lockTimeoutMs,
+                    idleTransactionTimeoutMs: config.idleTransactionTimeoutMs,
+                })
+                : undefined,
+        };
+    },
+};
+export const DRIVE_NATIVE_CONNECTOR = {
+    ...DRIVE_NATIVE_CONNECTOR_GOVERNANCE,
+    createHandlers: createDriveRestHandlersRaw,
+    smoke: smokeDriveRestCredentials,
+    doctor: async (config, context) => {
+        const credential = await context.resolveCredential?.("drive");
+        const accessToken = credential?.token ?? context.env[config.tokenEnv];
+        const selectedFileId = credential?.selectedFileId ?? config.selectedFileId;
+        const missing = [];
+        if (config.mode === "rest" && !accessToken) {
+            missing.push(`axtary connect drive or ${config.tokenEnv}`);
+        }
+        if (config.mode === "rest" && !selectedFileId) {
+            missing.push("Picker-selected file id");
+        }
+        return {
+            provider: "drive",
+            mode: config.mode,
+            activeMode: "rest",
+            capability: config.mode === "rest" ? "read-only" : "off",
+            requiredEnv: missing,
+            requiredScopes: config.mode === "rest"
+                ? [...DRIVE_NATIVE_CONNECTOR_GOVERNANCE.requiredScopes]
+                : [],
+            smokeCheck: config.mode === "rest"
+                ? DRIVE_NATIVE_CONNECTOR_GOVERNANCE.smokeCheck
+                : null,
+            runSmoke: config.mode === "rest" && accessToken && selectedFileId
+                ? () => smokeDriveRestCredentials({
+                    accessToken,
+                    selectedFileId,
+                    apiBaseUrl: config.apiBaseUrl,
+                    allowedMimeTypes: config.allowedMimeTypes,
+                    maxReadBytes: config.maxReadBytes,
+                    fetch: context.fetch,
+                    maxRetries: 0,
+                })
+                : undefined,
+        };
+    },
+};
+export function createPostgresNativeHandlers(config, options = {}) {
+    return createNativeConnectorHandlers(POSTGRES_NATIVE_CONNECTOR, config, options);
+}
+export function createDriveRestHandlers(config, options = {}) {
+    return createNativeConnectorHandlers(DRIVE_NATIVE_CONNECTOR, config, options);
+}
+export const NATIVE_CONNECTOR_DESCRIPTORS = [
+    GITHUB_NATIVE_CONNECTOR,
+    LINEAR_NATIVE_CONNECTOR,
+    JIRA_NATIVE_CONNECTOR,
+    POSTGRES_NATIVE_CONNECTOR,
+    DRIVE_NATIVE_CONNECTOR,
+];
+export async function buildNativeConnectorDoctorPlans(input) {
+    const plans = [
+        LINEAR_NATIVE_CONNECTOR.doctor(input.configs.linear, input.context),
+        JIRA_NATIVE_CONNECTOR.doctor(input.configs.jira, input.context),
+    ];
+    if (input.configs.postgres) {
+        plans.push(POSTGRES_NATIVE_CONNECTOR.doctor(input.configs.postgres, input.context));
+    }
+    if (input.configs.drive) {
+        plans.push(DRIVE_NATIVE_CONNECTOR.doctor(input.configs.drive, input.context));
+    }
+    return Promise.all(plans);
 }
 export function createAwsRestHandlers(config, options = {}) {
     const handlers = {
@@ -479,9 +890,94 @@ export async function smokeLocalDocsRoots(config) {
         },
     };
 }
+/**
+ * Env var names that must be set for app mode given the config. A literal
+ * satisfies its slot, so its env name drops out of the requirement. Used for
+ * readiness/doctor reporting (which env names are missing) — never values.
+ */
+export function githubAppRequiredEnv(config) {
+    const names = [config.privateKeyEnv];
+    if (!config.appId && config.appIdEnv)
+        names.push(config.appIdEnv);
+    if (!config.installationId && config.installationIdEnv)
+        names.push(config.installationIdEnv);
+    return names;
+}
+/**
+ * Resolve effective App ID, Installation ID, and private key from config + env
+ * (literal wins over env name). Throws a descriptive, value-free error naming
+ * the missing literal or env var.
+ */
+export function resolveGithubAppCredentials(config, env) {
+    const appId = config.appId ?? (config.appIdEnv ? env[config.appIdEnv] : undefined);
+    const installationId = config.installationId ?? (config.installationIdEnv ? env[config.installationIdEnv] : undefined);
+    const privateKey = env[config.privateKeyEnv];
+    if (!privateKey) {
+        throw new Error(`missing_github_app_private_key_env:${config.privateKeyEnv}`);
+    }
+    if (!appId) {
+        throw new Error(config.appIdEnv ? `missing_github_app_id_env:${config.appIdEnv}` : "missing_github_app_id");
+    }
+    if (!installationId) {
+        throw new Error(config.installationIdEnv
+            ? `missing_github_installation_id_env:${config.installationIdEnv}`
+            : "missing_github_installation_id");
+    }
+    return { appId, installationId, privateKey };
+}
+/**
+ * Mint a short-lived GitHub App installation token. Builds an RS256 app JWT
+ * (iss=appId, ~9 min lifetime, iat backdated 60s for clock skew) and exchanges
+ * it at POST /app/installations/{id}/access_tokens. The returned token is
+ * fine-grained to the App's installed permissions and expires in ~1h — the
+ * credential the proxy actually hands to provider calls. The PEM private key is
+ * never logged; on a malformed key we throw before any network call.
+ */
+export async function mintGithubInstallationToken(input) {
+    const fetchImpl = input.fetch ?? fetch;
+    const apiBaseUrl = (input.apiBaseUrl ?? GITHUB_REST_API_BASE_URL).replace(/\/$/, "");
+    const userAgent = input.userAgent ?? GITHUB_REST_USER_AGENT;
+    let signingKey;
+    try {
+        // createPrivateKey accepts both PKCS#1 ("BEGIN RSA PRIVATE KEY", GitHub's
+        // download format) and PKCS#8 ("BEGIN PRIVATE KEY"); jose.importPKCS8 would
+        // reject the former. jose's SignJWT.sign accepts a Node KeyObject.
+        signingKey = createPrivateKey(input.privateKey);
+    }
+    catch {
+        throw new ProviderRequestError("github_app_private_key_invalid", 0, "auth_error");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const appJwt = await new SignJWT({})
+        .setProtectedHeader({ alg: "RS256", typ: "JWT" })
+        .setIssuer(input.appId)
+        .setIssuedAt(now - 60)
+        .setExpirationTime(now + 540)
+        .sign(signingKey);
+    const response = await fetchImpl(`${apiBaseUrl}/app/installations/${encodeURIComponent(input.installationId)}/access_tokens`, {
+        method: "POST",
+        headers: {
+            accept: "application/vnd.github+json",
+            authorization: `Bearer ${appJwt}`,
+            "user-agent": userAgent,
+            "x-github-api-version": "2022-11-28",
+        },
+    });
+    if (!response.ok) {
+        // 401 => bad private key / app id; 404 => bad installation id or app not
+        // installed on the repo. providerError keeps the body bounded and category-tagged.
+        throw await providerError("github_app", response);
+    }
+    const parsed = (await response.json());
+    if (!parsed.token) {
+        throw new ProviderRequestError("github_app_token_missing", response.status, "provider_error");
+    }
+    return { token: parsed.token, expiresAt: parsed.expires_at ?? "" };
+}
 export async function smokeGitHubRestCredentials(config) {
     const client = createGitHubRestClient(config);
-    const user = await client.request("/user", { method: "GET" });
+    const response = await client.requestWithMetadata("/user", { method: "GET" });
+    const user = response.data;
     return {
         provider: "github",
         ok: true,
@@ -489,6 +985,25 @@ export async function smokeGitHubRestCredentials(config) {
         details: {
             login: user.login,
             id: user.id,
+            acceptedPermissions: response.metadata.acceptedPermissions,
+            rateLimit: response.metadata.rateLimit,
+        },
+    };
+}
+export async function smokeGithubAppCredentials(input) {
+    // Minting proves the App id, private key, and installation id all work
+    // together. The token is discarded — no repo state is touched.
+    const minted = await mintGithubInstallationToken(input);
+    return {
+        provider: "github",
+        ok: true,
+        summary: minted.expiresAt
+            ? `installation token minted (expires ${minted.expiresAt})`
+            : "installation token minted",
+        details: {
+            appId: input.appId,
+            installationId: input.installationId,
+            expiresAt: minted.expiresAt || null,
         },
     };
 }
@@ -529,6 +1044,83 @@ export async function smokeLinearGraphqlCredentials(config) {
         },
     };
 }
+export async function smokeJiraRestCredentials(config) {
+    const client = createJiraRestClient(config);
+    const myself = await client.request("/myself", {
+        method: "GET",
+    });
+    return {
+        provider: "jira",
+        ok: true,
+        summary: `user: ${myself.displayName}`,
+        details: {
+            accountId: myself.accountId,
+            displayName: myself.displayName,
+            emailAddress: myself.emailAddress ?? null,
+            siteUrl: config.siteUrl ?? null,
+        },
+    };
+}
+export async function smokePostgresCredentials(config) {
+    if (config.allowedTables.length === 0) {
+        throw new Error("postgres_allowed_tables_required");
+    }
+    const client = postgresClient(config);
+    await client.connect();
+    try {
+        await beginPostgresReadOnly(client, config);
+        const safety = await inspectPostgresSession(client, config.allowedTables);
+        enforcePostgresSafety(safety, config);
+        await client.query("ROLLBACK");
+        return {
+            provider: "postgres",
+            ok: true,
+            summary: `database: ${safety.database}, role: ${safety.role}, read-only: ${safety.transactionReadOnly}`,
+            details: {
+                database: safety.database,
+                role: safety.role,
+                transactionReadOnly: safety.transactionReadOnly,
+                roleLeastPrivilege: safety.roleLeastPrivilege,
+                tables: safety.tables.map((table) => ({
+                    name: table.name,
+                    selectGranted: table.selectGranted,
+                    writeGranted: table.writeGranted,
+                    rlsEnabled: table.rlsEnabled,
+                    rlsForced: table.rlsForced,
+                    roleOwnsTable: table.roleOwnsTable,
+                })),
+            },
+        };
+    }
+    catch (error) {
+        await rollbackQuietly(client);
+        throw new Error(postgresErrorReason("postgres_smoke_failed", error));
+    }
+    finally {
+        await client.end();
+    }
+}
+export async function smokeDriveRestCredentials(config) {
+    if (!config.selectedFileId) {
+        throw new Error("drive_selected_file_required");
+    }
+    const metadata = await getDriveFileMetadata(config, config.selectedFileId);
+    if (metadata.isAppAuthorized !== true) {
+        throw new Error("drive_file_not_authorized");
+    }
+    return {
+        provider: "drive",
+        ok: true,
+        summary: `selected file: ${metadata.name}`,
+        details: {
+            fileId: metadata.id,
+            title: metadata.name,
+            mimeType: metadata.mimeType,
+            appAuthorized: metadata.isAppAuthorized,
+            scope: "https://www.googleapis.com/auth/drive.file",
+        },
+    };
+}
 export async function smokeAwsRestCredentials(config) {
     const client = createAwsClient(config);
     const identity = await getAwsCallerIdentity(client);
@@ -575,24 +1167,38 @@ export async function smokeGcpRestCredentials(config) {
     };
 }
 export function wrapHandlersWithActionPassVerification(handlers, config) {
+    const verificationConfig = {
+        ...config,
+        dpopReplayStore: config.dpopReplayStore ?? new InMemoryDpopReplayStore(),
+    };
     return Object.fromEntries(Object.entries(handlers).map(([tool, handler]) => [
         tool,
-        createActionPassVerifiedHandler(handler, config),
+        createActionPassVerifiedHandler(handler, verificationConfig),
     ]));
 }
 export function createActionPassVerifiedHandler(handler, config) {
+    const dpopReplayStore = config.dpopReplayStore ?? new InMemoryDpopReplayStore();
     return async (request) => {
         if (!request.actionPass) {
             throw new Error("adapter_actionpass_required");
         }
+        const target = actionPassDpopTarget(request.action);
         const verified = await verifyActionPass({
             token: request.actionPass.token,
             action: request.action,
             verificationKey: config.verificationKey,
+            verificationKeys: config.verificationKeys,
             issuer: config.issuer,
             algorithms: config.algorithms,
             clockTolerance: config.clockTolerance,
             currentDate: config.currentDate?.(),
+            dpopProof: request.dpopProof ?? undefined,
+            dpopMethod: target.method,
+            dpopUri: target.uri,
+            dpopNonce: config.dpopNonce,
+            dpopReplayStore,
+            isRevoked: config.isRevoked,
+            getStatus: config.getStatus,
         });
         if (!verified.valid) {
             throw new Error(`adapter_actionpass_invalid:${verified.reason}`);
@@ -923,6 +1529,120 @@ export function createGitHubRestContentWriteHandler(config) {
         };
     };
 }
+export function createGitHubRestReviewCommentHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const payload = action.capability.payload;
+        const pullNumber = requirePositiveInteger(payload.pullNumber, "github_rest_missing_pull_number");
+        const line = requirePositiveInteger(payload.line, "github_rest_missing_review_line");
+        const side = requireEnumString(payload.side, ["LEFT", "RIGHT"], "github_rest_invalid_review_side");
+        const startLine = parseOptionalPositiveInteger(payload.startLine, "github_rest_invalid_review_start_line");
+        const startSide = payload.startSide === undefined
+            ? undefined
+            : requireEnumString(payload.startSide, ["LEFT", "RIGHT"], "github_rest_invalid_review_start_side");
+        const response = await client.requestWithMetadata(`/repos/${repo.owner}/${repo.name}/pulls/${pullNumber}/comments`, {
+            method: "POST",
+            body: {
+                body: requireString(payload.body, "github_rest_missing_review_body"),
+                commit_id: requireString(payload.commitId, "github_rest_missing_commit_id"),
+                path: requireString(payload.path, "github_rest_missing_review_path"),
+                line,
+                side,
+                start_line: startLine,
+                start_side: startSide,
+            },
+        });
+        return {
+            provider: "github",
+            kind: "pull_request_review_comment",
+            id: String(response.data.id),
+            url: response.data.html_url,
+            pullNumber,
+            path: response.data.path,
+            line: response.data.line,
+            side: response.data.side,
+            acceptedPermissions: response.metadata.acceptedPermissions,
+            rateLimit: response.metadata.rateLimit,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestCheckRunHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const payload = action.capability.payload;
+        const output = getObject(payload.output);
+        const response = await client.requestWithMetadata(`/repos/${repo.owner}/${repo.name}/check-runs`, {
+            method: "POST",
+            body: {
+                name: requireString(payload.name, "github_rest_missing_check_name"),
+                head_sha: requireString(payload.headSha, "github_rest_missing_check_head_sha"),
+                status: payload.status === undefined
+                    ? undefined
+                    : requireEnumString(payload.status, ["queued", "in_progress", "completed", "pending"], "github_rest_invalid_check_status"),
+                conclusion: payload.conclusion === undefined
+                    ? undefined
+                    : requireEnumString(payload.conclusion, [
+                        "action_required",
+                        "cancelled",
+                        "failure",
+                        "neutral",
+                        "success",
+                        "skipped",
+                        "stale",
+                        "timed_out",
+                    ], "github_rest_invalid_check_conclusion"),
+                details_url: getString(payload.detailsUrl) ?? undefined,
+                external_id: getString(payload.externalId) ?? undefined,
+                output: output
+                    ? removeUndefined({
+                        title: requireString(output.title, "github_rest_missing_check_output_title"),
+                        summary: requireString(output.summary, "github_rest_missing_check_output_summary"),
+                        text: getString(output.text) ?? undefined,
+                    })
+                    : undefined,
+            },
+        });
+        return {
+            provider: "github",
+            kind: "check_run",
+            id: String(response.data.id),
+            url: response.data.html_url,
+            status: response.data.status,
+            conclusion: response.data.conclusion,
+            headSha: response.data.head_sha,
+            acceptedPermissions: response.metadata.acceptedPermissions,
+            rateLimit: response.metadata.rateLimit,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestIssueCommentHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const payload = action.capability.payload;
+        const issueNumber = requirePositiveInteger(payload.issueNumber, "github_rest_missing_issue_number");
+        const response = await client.requestWithMetadata(`/repos/${repo.owner}/${repo.name}/issues/${issueNumber}/comments`, {
+            method: "POST",
+            body: {
+                body: requireString(payload.body, "github_rest_missing_issue_comment_body"),
+            },
+        });
+        return {
+            provider: "github",
+            kind: "issue_comment",
+            id: String(response.data.id),
+            url: response.data.html_url,
+            issueNumber,
+            acceptedPermissions: response.metadata.acceptedPermissions,
+            rateLimit: response.metadata.rateLimit,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
 export function createSlackWebPostMessageHandler(config) {
     const client = createSlackWebClient(config);
     return async ({ action, actionPass }) => {
@@ -1062,6 +1782,213 @@ export function createLinearIssueUpdateHandler(config) {
         };
     };
 }
+export function createJiraIssueReadHandler(config) {
+    const client = createJiraRestClient(config);
+    return async ({ action, actionPass }) => {
+        const issueKey = issueIdentifier(action.capability.payload);
+        const issue = await getJiraIssue(client, issueKey);
+        return jiraIssueResult(issue, config, actionPass?.claims.jti ?? null);
+    };
+}
+export function createJiraCommentCreateHandler(config) {
+    const client = createJiraRestClient(config);
+    return async ({ action, actionPass }) => {
+        const issueKey = issueIdentifier(action.capability.payload);
+        const body = requireString(action.capability.payload.body, "jira_rest_missing_comment_body");
+        const comment = await client.request(`/issue/${encodeURIComponent(issueKey)}/comment`, {
+            method: "POST",
+            body: {
+                body: jiraAdfDocument(body),
+            },
+        });
+        return {
+            provider: "jira",
+            kind: "issue_comment",
+            id: comment.id,
+            issueKey,
+            url: jiraIssueUrl(config, issueKey),
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createJiraIssueUpdateHandler(config) {
+    const client = createJiraRestClient(config);
+    return async ({ action, actionPass }) => {
+        const payload = action.capability.payload;
+        const issueKey = issueIdentifier(payload);
+        const status = getString(payload.status);
+        const fields = removeUndefined({
+            title: getString(payload.title) ?? undefined,
+            summary: getString(payload.title) ?? undefined,
+            description: getString(payload.description)
+                ? jiraAdfDocument(getString(payload.description))
+                : undefined,
+            priority: getString(payload.priorityId)
+                ? { id: getString(payload.priorityId) }
+                : undefined,
+        });
+        // "title" is Axtary's normalized field; Jira calls it "summary".
+        delete fields.title;
+        if (Object.keys(fields).length === 0 && !status) {
+            throw new Error("jira_rest_missing_update_fields");
+        }
+        if (Object.keys(fields).length > 0) {
+            await client.request(`/issue/${encodeURIComponent(issueKey)}`, {
+                method: "PUT",
+                body: { fields },
+                expectEmpty: true,
+            });
+        }
+        let transitionId = null;
+        if (status) {
+            const transitions = await client.request(`/issue/${encodeURIComponent(issueKey)}/transitions?expand=transitions.fields`, { method: "GET" });
+            const transition = transitions.transitions.find((candidate) => candidate.name.localeCompare(status, undefined, {
+                sensitivity: "base",
+            }) === 0 ||
+                candidate.to?.name.localeCompare(status, undefined, {
+                    sensitivity: "base",
+                }) === 0);
+            if (!transition) {
+                const available = transitions.transitions
+                    .map((candidate) => candidate.to?.name ?? candidate.name)
+                    .join(",");
+                throw new Error(`jira_rest_transition_not_found:${status}:available=${available}`);
+            }
+            transitionId = transition.id;
+            await client.request(`/issue/${encodeURIComponent(issueKey)}/transitions`, {
+                method: "POST",
+                body: { transition: { id: transition.id } },
+                expectEmpty: true,
+            });
+        }
+        const issue = await getJiraIssue(client, issueKey);
+        return {
+            ...jiraIssueResult(issue, config, actionPass?.claims.jti ?? null),
+            kind: "issue_update",
+            transitionId,
+        };
+    };
+}
+export function createPostgresSelectHandler(config) {
+    return async ({ action, actionPass }) => {
+        const payload = action.capability.payload;
+        const statement = requireString(payload.statement, "postgres_statement_required");
+        const parameters = Array.isArray(payload.parameters)
+            ? payload.parameters
+            : null;
+        const maxRows = requirePositiveInteger(payload.maxRows, "postgres_max_rows_required");
+        if (!parameters)
+            throw new Error("postgres_parameters_required");
+        const analyzed = analyzePostgresSelect(statement);
+        if (!analyzed.ok)
+            throw new Error(analyzed.reason);
+        const analysis = analyzed.analysis;
+        enforcePostgresQueryScope(analysis, parameters.length, maxRows, config);
+        const expectedDatabase = parsePostgresDatabaseResource(action.capability.resource);
+        const client = postgresClient(config);
+        await client.connect();
+        try {
+            await beginPostgresReadOnly(client, config);
+            const safety = await inspectPostgresSession(client, analysis.tables);
+            enforcePostgresSafety(safety, config);
+            if (safety.database !== expectedDatabase) {
+                throw new Error("postgres_database_resource_mismatch");
+            }
+            const limitParameter = analysis.parameterCount + 1;
+            const boundedStatement = `SELECT * FROM (${analysis.canonicalStatement}) AS axtary_scoped_query LIMIT $${limitParameter}`;
+            const result = await client.query(boundedStatement, [
+                ...parameters,
+                maxRows + 1,
+            ]);
+            const truncated = result.rows.length > maxRows;
+            const rows = result.rows.slice(0, maxRows).map(jsonSafePostgresRow);
+            const fields = result.fields.map((field) => field.name);
+            await client.query("COMMIT");
+            return {
+                provider: "postgres",
+                kind: "query_select",
+                database: safety.database,
+                role: safety.role,
+                transactionReadOnly: safety.transactionReadOnly,
+                roleLeastPrivilege: safety.roleLeastPrivilege,
+                statementHash: analysis.statementHash,
+                predicateHash: analysis.predicateHash,
+                tables: analysis.tables,
+                rowCount: rows.length,
+                fields,
+                truncated,
+                rls: safety.tables.map((table) => ({
+                    table: table.name,
+                    selectGranted: table.selectGranted,
+                    writeGranted: table.writeGranted,
+                    enabled: table.rlsEnabled,
+                    forced: table.rlsForced,
+                    roleOwnsTable: table.roleOwnsTable,
+                })),
+                rows,
+                actionPassId: actionPass?.claims.jti ?? null,
+            };
+        }
+        catch (error) {
+            await rollbackQuietly(client);
+            throw new Error(postgresErrorReason("postgres_query_failed", error));
+        }
+        finally {
+            await client.end();
+        }
+    };
+}
+export function createDriveFileReadHandler(config) {
+    return async ({ action, actionPass }) => {
+        const fileId = requireString(action.capability.payload.fileId, "drive_file_id_required");
+        const maxBytes = requirePositiveInteger(action.capability.payload.maxBytes, "drive_max_bytes_required");
+        if (action.capability.resource !== `drive:file:${fileId}`) {
+            throw new Error("drive_file_resource_mismatch");
+        }
+        if (maxBytes > config.maxReadBytes) {
+            throw new Error("drive_read_byte_limit_exceeded");
+        }
+        const metadata = await getDriveFileMetadata(config, fileId);
+        if (metadata.isAppAuthorized !== true) {
+            throw new Error("drive_file_not_authorized");
+        }
+        if (!config.allowedMimeTypes.includes(metadata.mimeType)) {
+            throw new Error(`drive_mime_type_not_allowed:${metadata.mimeType}`);
+        }
+        if (metadata.size !== null &&
+            metadata.size > maxBytes) {
+            throw new Error("drive_content_too_large");
+        }
+        const contentUrl = driveContentUrl(config, metadata);
+        const response = await driveFetch(config, contentUrl, {
+            headers: {
+                authorization: `Bearer ${config.accessToken}`,
+                accept: "text/plain, text/*;q=0.9, application/json;q=0.8",
+            },
+        });
+        if (!response.ok) {
+            throw await driveResponseError(response);
+        }
+        const content = await readDriveTextBounded(response, maxBytes);
+        const bytes = Buffer.byteLength(content, "utf8");
+        return {
+            provider: "drive",
+            kind: "file_read",
+            id: metadata.id,
+            fileId: metadata.id,
+            title: metadata.name,
+            mimeType: metadata.mimeType,
+            modifiedTime: metadata.modifiedTime,
+            url: metadata.webViewLink,
+            scope: "https://www.googleapis.com/auth/drive.file",
+            appAuthorized: metadata.isAppAuthorized,
+            bytes,
+            truncated: false,
+            content,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
 export function createAwsIdentityGetHandler(config) {
     const client = createAwsClient(config);
     return async ({ actionPass }) => {
@@ -1411,33 +2338,183 @@ function createGcpRestClient(config) {
         },
     };
 }
+async function getDriveFileMetadata(config, fileId) {
+    const apiBaseUrl = (config.apiBaseUrl ?? GOOGLE_DRIVE_API_BASE_URL).replace(/\/$/, "");
+    const fields = [
+        "id",
+        "name",
+        "mimeType",
+        "modifiedTime",
+        "size",
+        "webViewLink",
+        "isAppAuthorized",
+    ].join(",");
+    const url = `${apiBaseUrl}/files/${encodeURIComponent(fileId)}` +
+        `?supportsAllDrives=true&fields=${encodeURIComponent(fields)}`;
+    const response = await driveFetch(config, url, {
+        headers: {
+            authorization: `Bearer ${config.accessToken}`,
+            accept: "application/json",
+        },
+    });
+    if (!response.ok) {
+        throw await driveResponseError(response);
+    }
+    const value = (await response.json());
+    if (typeof value.id !== "string" ||
+        typeof value.name !== "string" ||
+        typeof value.mimeType !== "string") {
+        throw new Error("drive_metadata_invalid");
+    }
+    const size = typeof value.size === "string" && /^\d+$/.test(value.size)
+        ? Number.parseInt(value.size, 10)
+        : typeof value.size === "number" && Number.isFinite(value.size)
+            ? value.size
+            : null;
+    return {
+        id: value.id,
+        name: value.name,
+        mimeType: value.mimeType,
+        modifiedTime: typeof value.modifiedTime === "string" ? value.modifiedTime : null,
+        size,
+        webViewLink: typeof value.webViewLink === "string" ? value.webViewLink : null,
+        isAppAuthorized: value.isAppAuthorized === true,
+    };
+}
+function driveContentUrl(config, metadata) {
+    const apiBaseUrl = (config.apiBaseUrl ?? GOOGLE_DRIVE_API_BASE_URL).replace(/\/$/, "");
+    const filePath = `${apiBaseUrl}/files/${encodeURIComponent(metadata.id)}`;
+    return metadata.mimeType === "application/vnd.google-apps.document"
+        ? `${filePath}/export?mimeType=${encodeURIComponent("text/plain")}`
+        : `${filePath}?alt=media&supportsAllDrives=true`;
+}
+async function driveFetch(config, url, init) {
+    const fetchImpl = config.fetch ?? fetch;
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return requestWithRetry(maxRetries, async () => {
+        const response = await fetchImpl(url, init);
+        if (!response.ok) {
+            throw await driveResponseError(response);
+        }
+        return response;
+    });
+}
+async function driveResponseError(response) {
+    const body = (await response.text()).slice(0, 1_000);
+    const retryAfter = providerRetryAfter(response, body);
+    if (/appNotAuthorizedToFile/i.test(body)) {
+        return new ProviderRequestError("drive_file_not_authorized", response.status, "auth_error");
+    }
+    if (response.status === 404) {
+        return new ProviderRequestError("drive_file_not_found_or_inaccessible", response.status, "provider_error");
+    }
+    if (response.status === 401) {
+        return new ProviderRequestError("drive_oauth_token_invalid", response.status, "auth_error");
+    }
+    if (response.status === 429 || /rateLimitExceeded/i.test(body)) {
+        return new ProviderRequestError("drive_rate_limited", response.status, "rate_limited", retryAfter);
+    }
+    if (response.status === 403) {
+        return new ProviderRequestError("drive_access_denied", response.status, "auth_error");
+    }
+    if (response.status >= 500) {
+        return new ProviderRequestError(`drive_provider_unavailable:${response.status}`, response.status, "server_error", retryAfter);
+    }
+    return new ProviderRequestError(`drive_request_failed:${response.status}`, response.status, "provider_error");
+}
+async function readDriveTextBounded(response, maxBytes) {
+    if (!response.body) {
+        const value = await response.arrayBuffer();
+        if (value.byteLength > maxBytes) {
+            throw new Error("drive_content_too_large");
+        }
+        return new TextDecoder().decode(value);
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error("drive_content_too_large");
+        }
+        chunks.push(value);
+    }
+    const joined = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(joined);
+}
 function createGitHubRestClient(config) {
     const fetchImpl = config.fetch ?? fetch;
     const apiBaseUrl = (config.apiBaseUrl ?? GITHUB_REST_API_BASE_URL).replace(/\/$/, "");
     const userAgent = config.userAgent ?? GITHUB_REST_USER_AGENT;
     const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    async function requestWithMetadata(path, options) {
+        return requestWithRetry(maxRetries, async () => {
+            const response = await fetchImpl(`${apiBaseUrl}${path}`, {
+                method: options.method,
+                headers: {
+                    accept: "application/vnd.github+json",
+                    authorization: `Bearer ${config.token}`,
+                    "content-type": "application/json",
+                    "user-agent": userAgent,
+                    "x-github-api-version": "2022-11-28",
+                },
+                body: options.body
+                    ? JSON.stringify(removeUndefined(options.body))
+                    : undefined,
+            });
+            if (!response.ok) {
+                throw await providerError("github_rest", response);
+            }
+            return {
+                data: (await response.json()),
+                metadata: githubResponseMetadata(response.headers),
+            };
+        });
+    }
     return {
         async request(path, options) {
-            return requestWithRetry(maxRetries, async () => {
-                const response = await fetchImpl(`${apiBaseUrl}${path}`, {
-                    method: options.method,
-                    headers: {
-                        accept: "application/vnd.github+json",
-                        authorization: `Bearer ${config.token}`,
-                        "content-type": "application/json",
-                        "user-agent": userAgent,
-                        "x-github-api-version": "2022-11-28",
-                    },
-                    body: options.body ? JSON.stringify(removeUndefined(options.body)) : undefined,
-                });
-                if (!response.ok) {
-                    throw await providerError("github_rest", response);
-                }
-                return response.json();
-            });
+            return (await requestWithMetadata(path, options)).data;
         },
+        requestWithMetadata,
     };
 }
+function githubResponseMetadata(headers) {
+    const reset = parseOptionalIntegerHeader(headers.get("x-ratelimit-reset"));
+    return {
+        acceptedPermissions: parseAcceptedGitHubPermissions(headers.get("x-accepted-github-permissions")),
+        rateLimit: {
+            limit: parseOptionalIntegerHeader(headers.get("x-ratelimit-limit")),
+            remaining: parseOptionalIntegerHeader(headers.get("x-ratelimit-remaining")),
+            resetAt: reset === null ? null : new Date(reset * 1000).toISOString(),
+            resource: headers.get("x-ratelimit-resource"),
+        },
+    };
+}
+function parseAcceptedGitHubPermissions(value) {
+    if (!value)
+        return [];
+    return value
+        .split(";")
+        .map((permission) => permission.trim())
+        .filter(Boolean)
+        .sort();
+}
+function parseOptionalIntegerHeader(value) {
+    if (!value)
+        return null;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) ? parsed : null;
+}
 function createSlackWebClient(config) {
     const fetchImpl = config.fetch ?? fetch;
     const apiBaseUrl = (config.apiBaseUrl ?? SLACK_WEB_API_BASE_URL).replace(/\/$/, "");
@@ -1500,6 +2577,73 @@ function createLinearGraphqlClient(config) {
         },
     };
 }
+function createJiraRestClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const apiBaseUrl = config.apiBaseUrl.replace(/\/$/, "");
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    const authorization = config.auth.type === "bearer"
+        ? `Bearer ${config.auth.token}`
+        : `Basic ${Buffer.from(`${config.auth.email}:${config.auth.apiToken}`, "utf8").toString("base64")}`;
+    return {
+        async request(path, options) {
+            return requestWithRetry(maxRetries, async () => {
+                const response = await fetchImpl(`${apiBaseUrl}${path}`, {
+                    method: options.method,
+                    headers: {
+                        authorization,
+                        accept: "application/json",
+                        ...(options.body ? { "content-type": "application/json" } : {}),
+                    },
+                    body: options.body
+                        ? JSON.stringify(removeUndefined(options.body))
+                        : undefined,
+                });
+                if (!response.ok) {
+                    throw await providerError("jira_rest", response);
+                }
+                if (options.expectEmpty || response.status === 204) {
+                    return undefined;
+                }
+                return (await response.json());
+            });
+        },
+    };
+}
+async function getJiraIssue(client, issueKey) {
+    return client.request(`/issue/${encodeURIComponent(issueKey)}?fields=summary,status,project,priority,description`, { method: "GET" });
+}
+function jiraIssueResult(issue, config, actionPassId) {
+    return {
+        provider: "jira",
+        kind: "issue",
+        id: issue.id,
+        issueKey: issue.key,
+        projectKey: issue.fields.project?.key ?? issue.key.split("-", 1)[0],
+        title: issue.fields.summary,
+        status: issue.fields.status?.name ?? null,
+        statusId: issue.fields.status?.id ?? null,
+        priority: issue.fields.priority?.name ?? null,
+        priorityId: issue.fields.priority?.id ?? null,
+        url: jiraIssueUrl(config, issue.key),
+        actionPassId,
+    };
+}
+function jiraIssueUrl(config, issueKey) {
+    if (!config.siteUrl)
+        return null;
+    return `${config.siteUrl.replace(/\/$/, "")}/browse/${encodeURIComponent(issueKey)}`;
+}
+function jiraAdfDocument(text) {
+    const paragraphs = text.split(/\r?\n/).map((line) => ({
+        type: "paragraph",
+        content: line.length > 0 ? [{ type: "text", text: line }] : [],
+    }));
+    return {
+        type: "doc",
+        version: 1,
+        content: paragraphs.length > 0 ? paragraphs : [{ type: "paragraph" }],
+    };
+}
 class ProviderRequestError extends Error {
     status;
     category;
@@ -1514,9 +2658,13 @@ class ProviderRequestError extends Error {
 }
 async function providerError(prefix, response) {
     const message = (await response.text()).slice(0, 500);
-    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    const retryAfter = providerRetryAfter(response, message);
+    const githubRateLimited = response.status === 403 &&
+        (response.headers.get("retry-after") !== null ||
+            response.headers.get("x-ratelimit-remaining") === "0" ||
+            /secondary rate limit|rate limit exceeded/i.test(message));
     const category = response.status === 401 || response.status === 403
-        ? response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0"
+        ? githubRateLimited
             ? "rate_limited"
             : "auth_error"
         : response.status === 429
@@ -1526,6 +2674,23 @@ async function providerError(prefix, response) {
                 : "provider_error";
     return new ProviderRequestError(`${prefix}_${category}_${response.status}:${message}`, response.status, category, retryAfter);
 }
+function providerRetryAfter(response, message) {
+    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    if (retryAfter !== null)
+        return retryAfter;
+    if (response.headers.get("x-ratelimit-remaining") === "0") {
+        const reset = parseOptionalIntegerHeader(response.headers.get("x-ratelimit-reset"));
+        if (reset !== null) {
+            return Math.max(0, reset * 1000 - Date.now());
+        }
+    }
+    if (response.status === 429 ||
+        (response.status === 403 &&
+            /secondary rate limit|rate limit exceeded/i.test(message))) {
+        return 60_000;
+    }
+    return null;
+}
 async function requestWithRetry(maxRetries, run) {
     let attempt = 0;
     while (true) {
@@ -1617,7 +2782,8 @@ function signAwsRequest(input) {
             : {}),
     });
     const canonicalHeaders = Object.entries(headers)
-        .sort(([left], [right]) => left.localeCompare(right))
+        // SigV4 requires code-point order; must match the signedHeaders sort below.
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
         .map(([key, value]) => `${key}:${value.trim()}\n`)
         .join("");
     const signedHeaders = Object.keys(headers).sort().join(";");
@@ -1726,6 +2892,204 @@ function requireString(value, reason) {
     }
     return text;
 }
+function requirePositiveInteger(value, reason) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value <= 0) {
+        throw new Error(reason);
+    }
+    return value;
+}
+function parseOptionalPositiveInteger(value, reason) {
+    return value === undefined ? undefined : requirePositiveInteger(value, reason);
+}
+function requireEnumString(value, allowed, reason) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new Error(reason);
+    }
+    return value;
+}
+function postgresClient(config) {
+    return config.clientFactory
+        ? config.clientFactory(config.connectionString)
+        : new Client({ connectionString: config.connectionString });
+}
+async function beginPostgresReadOnly(client, config) {
+    const statementTimeout = positiveConfigInteger(config.statementTimeoutMs, 5_000);
+    const lockTimeout = positiveConfigInteger(config.lockTimeoutMs, 1_000);
+    const idleTimeout = positiveConfigInteger(config.idleTransactionTimeoutMs, 5_000);
+    await client.query("BEGIN READ ONLY");
+    await client.query(`SET LOCAL statement_timeout = '${statementTimeout}ms'`);
+    await client.query(`SET LOCAL lock_timeout = '${lockTimeout}ms'`);
+    await client.query(`SET LOCAL idle_in_transaction_session_timeout = '${idleTimeout}ms'`);
+}
+async function inspectPostgresSession(client, tables) {
+    const identity = await client.query(`SELECT
+       current_database() AS database,
+       current_user AS role,
+       current_setting('transaction_read_only') AS transaction_read_only,
+       r.rolsuper,
+       r.rolcreatedb,
+       r.rolcreaterole,
+       r.rolreplication,
+       r.rolbypassrls
+     FROM pg_roles r
+     WHERE r.rolname = current_user`);
+    const row = identity.rows[0];
+    if (!row)
+        throw new Error("postgres_role_metadata_missing");
+    const tableResult = await client.query(`SELECT
+       n.nspname || '.' || c.relname AS table_name,
+       c.relrowsecurity,
+       c.relforcerowsecurity,
+       has_table_privilege(current_user, c.oid, 'SELECT') AS select_granted,
+       (
+         has_table_privilege(current_user, c.oid, 'INSERT') OR
+         has_table_privilege(current_user, c.oid, 'UPDATE') OR
+         has_table_privilege(current_user, c.oid, 'DELETE') OR
+         has_table_privilege(current_user, c.oid, 'TRUNCATE') OR
+         has_table_privilege(current_user, c.oid, 'REFERENCES') OR
+         has_table_privilege(current_user, c.oid, 'TRIGGER')
+       ) AS write_granted,
+       pg_get_userbyid(c.relowner) = current_user AS role_owns_table
+     FROM pg_class c
+     JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname || '.' || c.relname = ANY($1::text[])
+     ORDER BY table_name`, [tables]);
+    const tableRows = tableResult.rows;
+    const found = new Map(tableRows.map((table) => [table.table_name, table]));
+    const tableSafety = tables.map((table) => {
+        const metadata = found.get(table);
+        if (!metadata)
+            throw new Error(`postgres_table_metadata_missing:${table}`);
+        return {
+            name: table,
+            selectGranted: metadata.select_granted,
+            writeGranted: metadata.write_granted,
+            rlsEnabled: metadata.relrowsecurity,
+            rlsForced: metadata.relforcerowsecurity,
+            roleOwnsTable: metadata.role_owns_table,
+        };
+    });
+    return {
+        database: row.database,
+        role: row.role,
+        transactionReadOnly: row.transaction_read_only === "on",
+        roleLeastPrivilege: !row.rolsuper &&
+            !row.rolcreatedb &&
+            !row.rolcreaterole &&
+            !row.rolreplication &&
+            !row.rolbypassrls,
+        tables: tableSafety,
+    };
+}
+function enforcePostgresSafety(safety, config) {
+    if (!safety.transactionReadOnly) {
+        throw new Error("postgres_transaction_not_read_only");
+    }
+    if (!safety.roleLeastPrivilege) {
+        throw new Error("postgres_role_not_least_privilege");
+    }
+    if (config.requireRls ?? true) {
+        for (const table of safety.tables) {
+            if (!table.selectGranted) {
+                throw new Error(`postgres_select_not_granted:${table.name}`);
+            }
+            if (table.writeGranted) {
+                throw new Error(`postgres_write_privilege_present:${table.name}`);
+            }
+            if (!table.rlsEnabled) {
+                throw new Error(`postgres_rls_not_enabled:${table.name}`);
+            }
+            if (table.roleOwnsTable && !table.rlsForced) {
+                throw new Error(`postgres_table_owner_bypasses_rls:${table.name}`);
+            }
+        }
+    }
+}
+function enforcePostgresQueryScope(analysis, parameterLength, maxRows, config) {
+    if (analysis.parameterCount !== parameterLength) {
+        throw new Error("postgres_parameter_count_mismatch");
+    }
+    if (analysis.tables.some((table) => !table.includes("."))) {
+        throw new Error("postgres_table_must_be_schema_qualified");
+    }
+    if (analysis.tables.some((table) => !config.allowedTables.includes(table))) {
+        throw new Error("postgres_table_not_allowed");
+    }
+    const allowedFunctions = config.allowedFunctions ?? [];
+    if (analysis.functions.some((functionName) => !allowedFunctions.includes(functionName))) {
+        throw new Error("postgres_function_not_allowed");
+    }
+    if (maxRows > (config.maxRows ?? 100)) {
+        throw new Error("postgres_row_limit_exceeded");
+    }
+}
+function parsePostgresDatabaseResource(resource) {
+    const match = /^postgres:database\/([^/]+)$/.exec(resource);
+    if (!match)
+        throw new Error("postgres_database_resource_invalid");
+    return match[1];
+}
+function jsonSafePostgresRow(row) {
+    return Object.fromEntries(Object.entries(row).map(([key, value]) => [key, jsonSafePostgresValue(value)]));
+}
+function jsonSafePostgresValue(value) {
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        return Number.isFinite(value) ? value : String(value);
+    }
+    if (typeof value === "bigint")
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Buffer.isBuffer(value))
+        return value.toString("base64");
+    if (Array.isArray(value))
+        return value.map(jsonSafePostgresValue);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+            key,
+            jsonSafePostgresValue(child),
+        ]));
+    }
+    return String(value);
+}
+function positiveConfigInteger(value, fallback) {
+    return Number.isInteger(value) && (value ?? 0) > 0 ? value : fallback;
+}
+async function rollbackQuietly(client) {
+    try {
+        await client.query("ROLLBACK");
+    }
+    catch {
+        // Preserve the original failure; rollback diagnostics may contain SQL text.
+    }
+}
+function postgresErrorReason(prefix, error) {
+    if (error instanceof Error && /^postgres_[a-z0-9_.:-]+$/.test(error.message)) {
+        return error.message;
+    }
+    if (error &&
+        typeof error === "object" &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        /^[A-Z0-9]{5}$/.test(error.code)) {
+        return `${prefix}:${error.code}`;
+    }
+    return prefix;
+}
+function getObject(value) {
+    return value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value)
+        ? value
+        : null;
+}
 function issueIdentifier(payload) {
     return (getString(payload.issueId) ??
         getString(payload.issueKey) ??