@axtary/adapters 0.0.1

package/dist/index.js

@@ -0,0 +1,1768 @@
+import { verifyActionPass, } from "@axtary/actionpass";
+import { createHash, createHmac } from "node:crypto";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { basename, extname, isAbsolute, relative, resolve, sep } from "node:path";
+export const GITHUB_REST_API_BASE_URL = "https://api.github.com";
+export const GITHUB_REST_USER_AGENT = "axtary-local-proxy";
+export const SLACK_WEB_API_BASE_URL = "https://slack.com/api";
+export const LINEAR_GRAPHQL_API_URL = "https://api.linear.app/graphql";
+export const AWS_STS_API_URL = "https://sts.amazonaws.com/";
+export const GCP_CLOUD_RESOURCE_MANAGER_API_BASE_URL = "https://cloudresourcemanager.googleapis.com";
+export const GCP_STORAGE_API_BASE_URL = "https://storage.googleapis.com/storage/v1";
+export const DEFAULT_PROVIDER_RETRIES = 2;
+export const CONNECTOR_CAPABILITY_REGISTRY = [
+    {
+        id: "github-pr-create",
+        provider: "github",
+        connector: "github-rest",
+        label: "Create pull request",
+        tool: "github.pull_requests.create",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake", "rest"],
+        requiresActionPass: true,
+        defaultPolicy: "step_up",
+        payloadFields: ["title", "baseBranch", "filesChanged", "testsPassed", "touchesProduction"],
+        approvalTriggers: [
+            "protected path",
+            "production impact",
+            "base branch mismatch",
+            "missing tests",
+            "large file set",
+        ],
+        credentialBoundary: "GitHub token stays in the proxy/adapter; the agent receives an ActionPass-bound result.",
+        smokeCheck: "GET /user",
+    },
+    {
+        id: "github-content-read",
+        provider: "github",
+        connector: "github-rest",
+        label: "Read repository content",
+        tool: "github.contents.read",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["fake", "rest"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["path", "ref"],
+        approvalTriggers: ["denied secret or production path"],
+        credentialBoundary: "Repository content is fetched by the adapter after policy checks deny protected paths.",
+        smokeCheck: "GET /user",
+    },
+    {
+        id: "github-branch-create",
+        provider: "github",
+        connector: "github-rest",
+        label: "Create branch",
+        tool: "github.branches.create",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake", "rest"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: ["branch", "baseBranch", "sha", "allowExisting"],
+        approvalTriggers: ["base branch mismatch"],
+        credentialBoundary: "Branch creation runs through the proxy and is bound to the same ActionPass verification path.",
+        smokeCheck: "GET /user",
+    },
+    {
+        id: "github-content-write",
+        provider: "github",
+        connector: "github-rest",
+        label: "Write repository content",
+        tool: "github.contents.write",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake", "rest"],
+        requiresActionPass: true,
+        defaultPolicy: "step_up",
+        payloadFields: ["path", "branch", "message", "sha", "content"],
+        approvalTriggers: ["protected path"],
+        credentialBoundary: "File content is never written until policy and ActionPass verification both pass.",
+        smokeCheck: "GET /user",
+    },
+    {
+        id: "slack-message-create",
+        provider: "slack",
+        connector: "slack-web",
+        label: "Post message",
+        tool: "slack.chat.postMessage",
+        operation: "external_message",
+        status: "supported",
+        supportedModes: ["fake", "web"],
+        requiresActionPass: true,
+        defaultPolicy: "step_up",
+        payloadFields: ["channel", "message", "text", "externalRecipients"],
+        approvalTriggers: ["external recipient"],
+        credentialBoundary: "Slack bot token stays adapter-side; exact outbound text is the approval payload.",
+        smokeCheck: "auth.test",
+    },
+    {
+        id: "linear-issue-read",
+        provider: "linear",
+        connector: "linear-graphql",
+        label: "Read issue",
+        tool: "linear.issues.read",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["fake", "graphql"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: ["issueKey", "projectKey"],
+        approvalTriggers: [],
+        credentialBoundary: "Linear API key stays adapter-side; policy pins issue access by project key.",
+        smokeCheck: "viewer",
+    },
+    {
+        id: "linear-comment-create",
+        provider: "linear",
+        connector: "linear-graphql",
+        label: "Create issue comment",
+        tool: "linear.comments.create",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake", "graphql"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: ["issueKey", "projectKey", "body"],
+        approvalTriggers: [],
+        credentialBoundary: "Linear comments execute only through proxy policy and ActionPass verification.",
+        smokeCheck: "viewer",
+    },
+    {
+        id: "linear-issue-update",
+        provider: "linear",
+        connector: "linear-graphql",
+        label: "Update issue",
+        tool: "linear.issues.update",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake", "graphql"],
+        requiresActionPass: true,
+        defaultPolicy: "step_up",
+        payloadFields: ["issueKey", "projectKey", "status", "title", "description", "priority"],
+        approvalTriggers: ["protected status"],
+        credentialBoundary: "Issue mutations stay behind adapter credentials and project/status policy checks.",
+        smokeCheck: "viewer",
+    },
+    {
+        id: "jira-issue-read",
+        provider: "jira",
+        connector: "jira-fake",
+        label: "Read issue",
+        tool: "jira.issues.read",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["fake"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: ["issueKey", "projectKey"],
+        approvalTriggers: [],
+        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
+        smokeCheck: null,
+    },
+    {
+        id: "jira-comment-create",
+        provider: "jira",
+        connector: "jira-fake",
+        label: "Create issue comment",
+        tool: "jira.comments.create",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: ["issueKey", "projectKey", "body"],
+        approvalTriggers: [],
+        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
+        smokeCheck: null,
+    },
+    {
+        id: "jira-issue-update",
+        provider: "jira",
+        connector: "jira-fake",
+        label: "Update issue",
+        tool: "jira.issues.update",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["fake"],
+        requiresActionPass: true,
+        defaultPolicy: "step_up",
+        payloadFields: ["issueKey", "projectKey", "status"],
+        approvalTriggers: ["protected status"],
+        credentialBoundary: "Jira is currently fake/local in this repo; future credentials must remain adapter-side.",
+        smokeCheck: null,
+    },
+    {
+        id: "aws-identity-get",
+        provider: "aws",
+        connector: "aws-rest",
+        label: "Get caller identity",
+        tool: "aws.identity.get",
+        operation: "identity_read",
+        status: "supported",
+        supportedModes: ["rest"],
+        requiresActionPass: true,
+        defaultPolicy: "allow",
+        payloadFields: [],
+        approvalTriggers: [],
+        credentialBoundary: "AWS credentials are read from local env/config by the adapter; prefer temporary credentials.",
+        smokeCheck: "STS GetCallerIdentity",
+    },
+    {
+        id: "aws-s3-list",
+        provider: "aws",
+        connector: "aws-rest",
+        label: "List S3 objects",
+        tool: "aws.s3.objects.list",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["rest"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["accountId", "region", "bucket", "prefix", "maxKeys"],
+        approvalTriggers: ["unscoped bucket", "denied prefix", "region mismatch"],
+        credentialBoundary: "S3 reads run adapter-side with scoped bucket/prefix policy and bounded result limits.",
+        smokeCheck: "STS GetCallerIdentity",
+    },
+    {
+        id: "gcp-project-get",
+        provider: "gcp",
+        connector: "gcp-rest",
+        label: "Get project",
+        tool: "gcp.projects.get",
+        operation: "identity_read",
+        status: "supported",
+        supportedModes: ["rest"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["projectId"],
+        approvalTriggers: ["unscoped project"],
+        credentialBoundary: "GCP access token stays adapter-side; prefer workload identity or impersonation later.",
+        smokeCheck: "Cloud Resource Manager project get",
+    },
+    {
+        id: "gcp-storage-list",
+        provider: "gcp",
+        connector: "gcp-rest",
+        label: "List storage objects",
+        tool: "gcp.storage.objects.list",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["rest"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["bucket", "prefix", "maxResults"],
+        approvalTriggers: ["unscoped bucket", "denied prefix"],
+        credentialBoundary: "Storage reads run adapter-side with scoped bucket/prefix policy and bounded result limits.",
+        smokeCheck: "Cloud Resource Manager project get",
+    },
+    {
+        id: "docs-document-search",
+        provider: "docs",
+        connector: "local-docs",
+        label: "Search local documents",
+        tool: "docs.documents.search",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["local"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["workspace", "query", "maxResults"],
+        approvalTriggers: ["workspace mismatch", "result limit"],
+        credentialBoundary: "Local document roots stay adapter-side; returned snippets are bounded and redacted.",
+        smokeCheck: "configured roots exist",
+    },
+    {
+        id: "docs-document-read",
+        provider: "docs",
+        connector: "local-docs",
+        label: "Read local document",
+        tool: "docs.documents.read",
+        operation: "read",
+        status: "supported",
+        supportedModes: ["local"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["workspace", "path", "maxBytes"],
+        approvalTriggers: ["workspace mismatch", "denied path", "byte limit"],
+        credentialBoundary: "Document reads are resolved under configured roots and redacted before returning to the agent.",
+        smokeCheck: "configured roots exist",
+    },
+    {
+        id: "mcp-tool-call",
+        provider: "mcp",
+        connector: "mcp-wrapper",
+        label: "Call MCP tool",
+        tool: "mcp.tool.call",
+        operation: "write",
+        status: "supported",
+        supportedModes: ["local-wrapper"],
+        requiresActionPass: true,
+        defaultPolicy: "deny_until_scoped",
+        payloadFields: ["toolName", "arguments"],
+        approvalTriggers: ["new tool definition", "definition hash drift"],
+        credentialBoundary: "MCP server credentials stay outside the agent; Axtary binds execution to server identity, schema version, and tool definition hash.",
+        smokeCheck: null,
+    },
+    {
+        id: "aws-iam-mutation",
+        provider: "aws",
+        connector: "aws-rest",
+        label: "Mutate IAM",
+        tool: "aws.iam.*",
+        operation: "identity_mutation",
+        status: "planned",
+        supportedModes: [],
+        requiresActionPass: true,
+        defaultPolicy: "deny",
+        payloadFields: ["accountId", "role", "policyArn", "principal"],
+        approvalTriggers: ["always"],
+        credentialBoundary: "Not executable yet; future support must use scoped temporary authority and reviewer permissions.",
+        smokeCheck: null,
+    },
+    {
+        id: "gcp-iam-mutation",
+        provider: "gcp",
+        connector: "gcp-rest",
+        label: "Mutate IAM",
+        tool: "gcp.iam.*",
+        operation: "identity_mutation",
+        status: "planned",
+        supportedModes: [],
+        requiresActionPass: true,
+        defaultPolicy: "deny",
+        payloadFields: ["projectId", "role", "member", "serviceAccount"],
+        approvalTriggers: ["always"],
+        credentialBoundary: "Not executable yet; future support must use scoped impersonation and reviewer permissions.",
+        smokeCheck: null,
+    },
+];
+export function getConnectorCapabilities() {
+    return CONNECTOR_CAPABILITY_REGISTRY;
+}
+export function getConnectorCapability(tool) {
+    return (CONNECTOR_CAPABILITY_REGISTRY.find((capability) => capability.tool === tool) ??
+        null);
+}
+export function getConnectorCapabilitiesByProvider(provider) {
+    return CONNECTOR_CAPABILITY_REGISTRY.filter((capability) => capability.provider === provider);
+}
+export function createFakeAdapterState() {
+    return {
+        github: {
+            pullRequests: [],
+            contentReads: [],
+            contentWrites: [],
+            branches: [],
+        },
+        slack: {
+            messages: [],
+        },
+        issueTrackers: {
+            linear: {
+                issues: [
+                    {
+                        provider: "linear",
+                        issueKey: "AXT-418",
+                        projectKey: "AXT",
+                        title: "Fix auth redirect bug",
+                        status: "In Progress",
+                    },
+                ],
+                comments: [],
+            },
+            jira: {
+                issues: [
+                    {
+                        provider: "jira",
+                        issueKey: "AXT-772",
+                        projectKey: "AXT",
+                        title: "Document ActionPass audit flow",
+                        status: "To Do",
+                    },
+                ],
+                comments: [],
+            },
+        },
+    };
+}
+export function createFakeHandlers(state = createFakeAdapterState(), options = {}) {
+    const handlers = {
+        "github.pull_requests.create": createFakeGitHubPullRequestHandler(state),
+        "github.contents.read": createFakeGitHubContentReadHandler(state),
+        "github.contents.write": createFakeGitHubContentWriteHandler(state),
+        "github.branches.create": createFakeGitHubBranchCreateHandler(state),
+        "slack.chat.postMessage": createFakeSlackMessageHandler(state),
+        "linear.issues.read": createFakeIssueReadHandler(state, "linear"),
+        "linear.comments.create": createFakeIssueCommentHandler(state, "linear"),
+        "linear.issues.update": createFakeIssueUpdateHandler(state, "linear"),
+        "jira.issues.read": createFakeIssueReadHandler(state, "jira"),
+        "jira.comments.create": createFakeIssueCommentHandler(state, "jira"),
+        "jira.issues.update": createFakeIssueUpdateHandler(state, "jira"),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createGitHubRestHandlers(config, options = {}) {
+    const handlers = {
+        "github.contents.read": createGitHubRestContentReadHandler(config),
+        "github.pull_requests.create": createGitHubRestPullRequestHandler(config),
+        "github.branches.create": createGitHubRestBranchCreateHandler(config),
+        "github.contents.write": createGitHubRestContentWriteHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createSlackWebHandlers(config, options = {}) {
+    const handlers = {
+        "slack.chat.postMessage": createSlackWebPostMessageHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createLinearGraphqlHandlers(config, options = {}) {
+    const handlers = {
+        "linear.issues.read": createLinearIssueReadHandler(config),
+        "linear.comments.create": createLinearCommentCreateHandler(config),
+        "linear.issues.update": createLinearIssueUpdateHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createAwsRestHandlers(config, options = {}) {
+    const handlers = {
+        "aws.identity.get": createAwsIdentityGetHandler(config),
+        "aws.s3.objects.list": createAwsS3ObjectsListHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createGcpRestHandlers(config, options = {}) {
+    const handlers = {
+        "gcp.projects.get": createGcpProjectGetHandler(config),
+        "gcp.storage.objects.list": createGcpStorageObjectsListHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export function createLocalDocsHandlers(config, options = {}) {
+    const handlers = {
+        "docs.documents.search": createLocalDocsSearchHandler(config),
+        "docs.documents.read": createLocalDocsReadHandler(config),
+    };
+    return options.verification
+        ? wrapHandlersWithActionPassVerification(handlers, options.verification)
+        : handlers;
+}
+export async function smokeLocalDocsRoots(config) {
+    const roots = normalizeDocsRoots(config);
+    for (const root of roots) {
+        const rootStat = await stat(root.absolutePath);
+        if (!rootStat.isDirectory()) {
+            throw new Error(`docs_root_not_directory:${root.configuredPath}`);
+        }
+    }
+    return {
+        provider: "docs",
+        ok: true,
+        summary: `${roots.length} root${roots.length === 1 ? "" : "s"} available`,
+        details: {
+            workspace: config.workspace ?? "local",
+            roots: roots.map((root) => root.configuredPath),
+        },
+    };
+}
+export async function smokeGitHubRestCredentials(config) {
+    const client = createGitHubRestClient(config);
+    const user = await client.request("/user", { method: "GET" });
+    return {
+        provider: "github",
+        ok: true,
+        summary: `logged in as ${user.login}`,
+        details: {
+            login: user.login,
+            id: user.id,
+        },
+    };
+}
+export async function smokeSlackWebCredentials(config) {
+    const client = createSlackWebClient(config);
+    const response = await client.request("auth.test", {});
+    return {
+        provider: "slack",
+        ok: true,
+        summary: `workspace: ${response.team}, user: ${response.user}`,
+        details: {
+            team: response.team,
+            user: response.user,
+            teamId: response.team_id ?? null,
+            userId: response.user_id ?? null,
+        },
+    };
+}
+export async function smokeLinearGraphqlCredentials(config) {
+    const client = createLinearGraphqlClient(config);
+    const response = await client.request(`
+      query AxtarySmokeViewer {
+        viewer {
+          id
+          name
+          email
+        }
+      }
+    `, {});
+    return {
+        provider: "linear",
+        ok: true,
+        summary: `viewer: ${response.viewer.name}`,
+        details: {
+            id: response.viewer.id,
+            name: response.viewer.name,
+            email: response.viewer.email,
+        },
+    };
+}
+export async function smokeAwsRestCredentials(config) {
+    const client = createAwsClient(config);
+    const identity = await getAwsCallerIdentity(client);
+    return {
+        provider: "aws",
+        ok: true,
+        summary: `account: ${identity.account}`,
+        details: {
+            account: identity.account,
+            arn: identity.arn,
+            userId: identity.userId,
+        },
+    };
+}
+export async function smokeGcpRestCredentials(config) {
+    const client = createGcpRestClient(config);
+    const projectId = config.projectId;
+    if (projectId) {
+        const project = await client.request(`${config.cloudResourceManagerApiBaseUrl ?? GCP_CLOUD_RESOURCE_MANAGER_API_BASE_URL}/v1/projects/${encodeURIComponent(projectId)}`);
+        return {
+            provider: "gcp",
+            ok: true,
+            summary: `project: ${project.projectId ?? project.name}`,
+            details: {
+                projectId: project.projectId ?? projectId,
+                name: project.name ?? null,
+                displayName: project.displayName ?? null,
+            },
+        };
+    }
+    const projects = await client.request(`${config.cloudResourceManagerApiBaseUrl ?? GCP_CLOUD_RESOURCE_MANAGER_API_BASE_URL}/v1/projects?pageSize=1`);
+    const firstProject = projects.projects?.[0] ?? null;
+    return {
+        provider: "gcp",
+        ok: true,
+        summary: firstProject
+            ? `project access: ${firstProject.projectId ?? firstProject.name}`
+            : "project access: no visible projects",
+        details: {
+            projectId: firstProject?.projectId ?? null,
+            name: firstProject?.name ?? null,
+            displayName: firstProject?.displayName ?? null,
+        },
+    };
+}
+export function wrapHandlersWithActionPassVerification(handlers, config) {
+    return Object.fromEntries(Object.entries(handlers).map(([tool, handler]) => [
+        tool,
+        createActionPassVerifiedHandler(handler, config),
+    ]));
+}
+export function createActionPassVerifiedHandler(handler, config) {
+    return async (request) => {
+        if (!request.actionPass) {
+            throw new Error("adapter_actionpass_required");
+        }
+        const verified = await verifyActionPass({
+            token: request.actionPass.token,
+            action: request.action,
+            verificationKey: config.verificationKey,
+            issuer: config.issuer,
+            algorithms: config.algorithms,
+            clockTolerance: config.clockTolerance,
+            currentDate: config.currentDate?.(),
+        });
+        if (!verified.valid) {
+            throw new Error(`adapter_actionpass_invalid:${verified.reason}`);
+        }
+        return handler(request);
+    };
+}
+export function createFakeGitHubPullRequestHandler(state) {
+    return ({ action, actionPass }) => {
+        const payload = action.capability.payload;
+        const filesChanged = getStringArray(payload.filesChanged);
+        const number = state.github.pullRequests.length + 1;
+        const pullRequest = {
+            id: `fake_pr_${number}`,
+            number,
+            resource: action.capability.resource,
+            title: getString(payload.title) ?? action.intent.declaredGoal,
+            baseBranch: getString(payload.baseBranch),
+            filesChanged,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        state.github.pullRequests.push(pullRequest);
+        return {
+            provider: "fake-github",
+            kind: "pull_request",
+            id: pullRequest.id,
+            number: pullRequest.number,
+            url: `https://github.fake/${encodeURIComponent(action.capability.resource)}/pull/${number}`,
+            actionPassId: pullRequest.actionPassId,
+        };
+    };
+}
+export function createFakeGitHubContentReadHandler(state) {
+    return ({ action, actionPass }) => {
+        const path = getString(action.capability.payload.path);
+        if (!path) {
+            throw new Error("fake_github_missing_path");
+        }
+        const read = {
+            resource: action.capability.resource,
+            path,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        state.github.contentReads.push(read);
+        return {
+            provider: "fake-github",
+            kind: "content_read",
+            path,
+            content: `// fake content for ${path}`,
+            actionPassId: read.actionPassId,
+        };
+    };
+}
+export function createFakeGitHubContentWriteHandler(state) {
+    return ({ action, actionPass }) => {
+        const path = requireString(action.capability.payload.path, "fake_github_missing_path");
+        const content = requireString(action.capability.payload.content, "fake_github_missing_content");
+        const branch = requireString(action.capability.payload.branch, "fake_github_missing_branch");
+        const message = getString(action.capability.payload.message) ?? `Update ${path} via Axtary`;
+        const write = {
+            resource: action.capability.resource,
+            path,
+            branch,
+            message,
+            contentLength: content.length,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        state.github.contentWrites.push(write);
+        return {
+            provider: "fake-github",
+            kind: "content_write",
+            path,
+            branch,
+            commitSha: `fake_commit_${state.github.contentWrites.length}`,
+            actionPassId: write.actionPassId,
+        };
+    };
+}
+export function createFakeGitHubBranchCreateHandler(state) {
+    return ({ action, actionPass }) => {
+        const branch = requireString(action.capability.payload.branch, "fake_github_missing_branch");
+        const baseBranch = getString(action.capability.payload.baseBranch);
+        const sha = getString(action.capability.payload.sha);
+        const created = {
+            resource: action.capability.resource,
+            branch,
+            baseBranch,
+            sha,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        state.github.branches.push(created);
+        return {
+            provider: "fake-github",
+            kind: "branch",
+            branch,
+            sha,
+            actionPassId: created.actionPassId,
+        };
+    };
+}
+export function createFakeSlackMessageHandler(state) {
+    return ({ action, actionPass }) => {
+        const channel = getString(action.capability.payload.channel);
+        const message = getString(action.capability.payload.message);
+        if (!channel) {
+            throw new Error("fake_slack_missing_channel");
+        }
+        if (!message) {
+            throw new Error("fake_slack_missing_message");
+        }
+        const number = state.slack.messages.length + 1;
+        const slackMessage = {
+            id: `fake_slack_msg_${number}`,
+            workspace: action.capability.resource,
+            channel,
+            message,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        state.slack.messages.push(slackMessage);
+        return {
+            provider: "fake-slack",
+            kind: "message",
+            id: slackMessage.id,
+            channel,
+            actionPassId: slackMessage.actionPassId,
+        };
+    };
+}
+export function createFakeIssueReadHandler(state, provider) {
+    return ({ action, actionPass }) => {
+        const issueKey = getString(action.capability.payload.issueKey);
+        if (!issueKey) {
+            throw new Error(`fake_${provider}_missing_issue_key`);
+        }
+        const issue = findIssue(state, provider, issueKey);
+        if (!issue) {
+            throw new Error(`fake_${provider}_issue_not_found`);
+        }
+        return {
+            provider: `fake-${provider}`,
+            kind: "issue",
+            issueKey: issue.issueKey,
+            projectKey: issue.projectKey,
+            title: issue.title,
+            status: issue.status,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createFakeIssueCommentHandler(state, provider) {
+    return ({ action, actionPass }) => {
+        const issueKey = getString(action.capability.payload.issueKey);
+        const body = getString(action.capability.payload.body);
+        if (!issueKey) {
+            throw new Error(`fake_${provider}_missing_issue_key`);
+        }
+        if (!body) {
+            throw new Error(`fake_${provider}_missing_comment_body`);
+        }
+        const issue = findIssue(state, provider, issueKey);
+        if (!issue) {
+            throw new Error(`fake_${provider}_issue_not_found`);
+        }
+        const comments = state.issueTrackers[provider].comments;
+        const number = comments.length + 1;
+        const comment = {
+            id: `fake_${provider}_comment_${number}`,
+            provider,
+            issueKey,
+            body,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+        comments.push(comment);
+        return {
+            provider: `fake-${provider}`,
+            kind: "issue_comment",
+            id: comment.id,
+            issueKey,
+            actionPassId: comment.actionPassId,
+        };
+    };
+}
+export function createFakeIssueUpdateHandler(state, provider) {
+    return ({ action, actionPass }) => {
+        const issueKey = getString(action.capability.payload.issueKey);
+        const status = getString(action.capability.payload.status);
+        if (!issueKey) {
+            throw new Error(`fake_${provider}_missing_issue_key`);
+        }
+        const issue = findIssue(state, provider, issueKey);
+        if (!issue) {
+            throw new Error(`fake_${provider}_issue_not_found`);
+        }
+        if (status) {
+            issue.status = status;
+        }
+        return {
+            provider: `fake-${provider}`,
+            kind: "issue_update",
+            issueKey,
+            status: issue.status,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestContentReadHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const path = requireString(action.capability.payload.path, "github_rest_missing_path");
+        const ref = getString(action.capability.payload.ref);
+        const query = ref ? `?ref=${encodeURIComponent(ref)}` : "";
+        const content = await client.request(`/repos/${repo.owner}/${repo.name}/contents/${encodeGitHubPath(path)}${query}`, { method: "GET" });
+        if (Array.isArray(content)) {
+            throw new Error("github_rest_expected_file_content");
+        }
+        const encoding = content.encoding;
+        const body = encoding === "base64"
+            ? Buffer.from(content.content.replace(/\n/g, ""), "base64").toString("utf8")
+            : content.content;
+        return {
+            provider: "github",
+            kind: "content_read",
+            owner: repo.owner,
+            repo: repo.name,
+            path: content.path,
+            sha: content.sha,
+            encoding,
+            content: body,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestPullRequestHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const payload = action.capability.payload;
+        const title = getString(payload.title) ?? action.intent.declaredGoal;
+        const head = requireString(payload.headBranch, "github_rest_missing_head_branch");
+        const base = requireString(payload.baseBranch, "github_rest_missing_base_branch");
+        const body = getString(payload.body);
+        const draft = getBoolean(payload.draft) ?? true;
+        const maintainerCanModify = getBoolean(payload.maintainerCanModify) ?? true;
+        const changes = getObjectArray(payload.changes);
+        const createdBranch = changes.length > 0 || getBoolean(payload.createBranch) === true
+            ? await createGitHubBranch(client, repo, {
+                branch: head,
+                baseBranch: base,
+                allowExisting: getBoolean(payload.allowExistingHeadBranch) ?? false,
+            })
+            : null;
+        const commits = [];
+        for (const change of changes) {
+            commits.push(await writeGitHubContent(client, repo, {
+                path: requireString(change.path, "github_rest_change_missing_path"),
+                content: requireString(change.content, "github_rest_change_missing_content"),
+                branch: head,
+                message: getString(change.message) ??
+                    getString(payload.commitMessage) ??
+                    `Update ${requireString(change.path, "github_rest_change_missing_path")}`,
+                sha: getString(change.sha),
+            }));
+        }
+        const pullRequest = await client.request(`/repos/${repo.owner}/${repo.name}/pulls`, {
+            method: "POST",
+            body: {
+                title,
+                head,
+                base,
+                body,
+                draft,
+                maintainer_can_modify: maintainerCanModify,
+            },
+        });
+        return {
+            provider: "github",
+            kind: "pull_request",
+            id: String(pullRequest.id),
+            number: pullRequest.number,
+            url: pullRequest.html_url,
+            state: pullRequest.state,
+            draft: pullRequest.draft,
+            branchCreated: createdBranch,
+            commits,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestBranchCreateHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const branch = requireString(action.capability.payload.branch, "github_rest_missing_branch");
+        const baseBranch = requireString(action.capability.payload.baseBranch, "github_rest_missing_base_branch");
+        const created = await createGitHubBranch(client, repo, {
+            branch,
+            baseBranch,
+            sha: getString(action.capability.payload.sha),
+            allowExisting: getBoolean(action.capability.payload.allowExisting) ?? false,
+        });
+        return {
+            provider: "github",
+            kind: "branch",
+            branch,
+            sha: created.sha,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGitHubRestContentWriteHandler(config) {
+    const client = createGitHubRestClient(config);
+    return async ({ action, actionPass }) => {
+        const repo = parseGitHubRepoResource(action.capability.resource);
+        const written = await writeGitHubContent(client, repo, {
+            path: requireString(action.capability.payload.path, "github_rest_missing_path"),
+            content: requireString(action.capability.payload.content, "github_rest_missing_content"),
+            branch: requireString(action.capability.payload.branch, "github_rest_missing_branch"),
+            message: getString(action.capability.payload.message) ??
+                `Update ${requireString(action.capability.payload.path, "github_rest_missing_path")}`,
+            sha: getString(action.capability.payload.sha),
+        });
+        return {
+            provider: "github",
+            kind: "content_write",
+            ...written,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createSlackWebPostMessageHandler(config) {
+    const client = createSlackWebClient(config);
+    return async ({ action, actionPass }) => {
+        const channel = requireString(action.capability.payload.channel, "slack_web_missing_channel");
+        const text = getString(action.capability.payload.text) ??
+            requireString(action.capability.payload.message, "slack_web_missing_text");
+        const response = await client.request("chat.postMessage", {
+            channel,
+            text,
+            thread_ts: getString(action.capability.payload.threadTs) ?? undefined,
+            unfurl_links: getBoolean(action.capability.payload.unfurlLinks) ?? false,
+            unfurl_media: getBoolean(action.capability.payload.unfurlMedia) ?? false,
+        });
+        return {
+            provider: "slack",
+            kind: "message",
+            channel: response.channel,
+            ts: response.ts,
+            text,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createLinearIssueReadHandler(config) {
+    const client = createLinearGraphqlClient(config);
+    return async ({ action, actionPass }) => {
+        const issueId = issueIdentifier(action.capability.payload);
+        const response = await client.request(`
+        query AxtaryIssueRead($id: String!) {
+          issue(id: $id) {
+            id
+            identifier
+            title
+            url
+            state { id name }
+            team { key }
+          }
+        }
+      `, { id: issueId });
+        const issue = response.issue;
+        if (!issue) {
+            throw new Error(`linear_graphql_issue_not_found:${issueId}`);
+        }
+        return {
+            provider: "linear",
+            kind: "issue",
+            id: issue.id,
+            issueKey: issue.identifier,
+            projectKey: issue.team?.key ?? null,
+            title: issue.title,
+            url: issue.url,
+            status: issue.state?.name ?? null,
+            stateId: issue.state?.id ?? null,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createLinearCommentCreateHandler(config) {
+    const client = createLinearGraphqlClient(config);
+    return async ({ action, actionPass }) => {
+        const issueId = issueIdentifier(action.capability.payload);
+        const body = requireString(action.capability.payload.body, "linear_graphql_missing_body");
+        const response = await client.request(`
+        mutation AxtaryCommentCreate($input: CommentCreateInput!) {
+          commentCreate(input: $input) {
+            success
+            comment {
+              id
+              url
+              body
+              issue { id identifier }
+            }
+          }
+        }
+      `, {
+            input: {
+                issueId,
+                body,
+            },
+        });
+        if (!response.commentCreate.success || !response.commentCreate.comment) {
+            throw new Error("linear_graphql_comment_create_failed");
+        }
+        return {
+            provider: "linear",
+            kind: "issue_comment",
+            id: response.commentCreate.comment.id,
+            issueKey: response.commentCreate.comment.issue?.identifier ?? issueId,
+            url: response.commentCreate.comment.url,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createLinearIssueUpdateHandler(config) {
+    const client = createLinearGraphqlClient(config);
+    return async ({ action, actionPass }) => {
+        const issueId = issueIdentifier(action.capability.payload);
+        const input = removeUndefined({
+            title: getString(action.capability.payload.title) ?? undefined,
+            description: getString(action.capability.payload.description) ?? undefined,
+            stateId: getString(action.capability.payload.stateId) ?? undefined,
+            priority: getNumber(action.capability.payload.priority) ?? undefined,
+        });
+        if (Object.keys(input).length === 0) {
+            throw new Error("linear_graphql_missing_update_fields");
+        }
+        const response = await client.request(`
+        mutation AxtaryIssueUpdate($id: String!, $input: IssueUpdateInput!) {
+          issueUpdate(id: $id, input: $input) {
+            success
+            issue {
+              id
+              identifier
+              title
+              url
+              state { id name }
+            }
+          }
+        }
+      `, {
+            id: issueId,
+            input,
+        });
+        if (!response.issueUpdate.success || !response.issueUpdate.issue) {
+            throw new Error("linear_graphql_issue_update_failed");
+        }
+        return {
+            provider: "linear",
+            kind: "issue_update",
+            id: response.issueUpdate.issue.id,
+            issueKey: response.issueUpdate.issue.identifier,
+            title: response.issueUpdate.issue.title,
+            url: response.issueUpdate.issue.url,
+            status: response.issueUpdate.issue.state?.name ?? null,
+            stateId: response.issueUpdate.issue.state?.id ?? null,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createAwsIdentityGetHandler(config) {
+    const client = createAwsClient(config);
+    return async ({ actionPass }) => {
+        const identity = await getAwsCallerIdentity(client);
+        return {
+            provider: "aws",
+            kind: "identity",
+            account: identity.account,
+            arn: identity.arn,
+            userId: identity.userId,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createAwsS3ObjectsListHandler(config) {
+    const client = createAwsClient(config);
+    return async ({ action, actionPass }) => {
+        const bucket = requireString(action.capability.payload.bucket, "aws_s3_missing_bucket");
+        const region = getString(action.capability.payload.region) ?? config.region ?? "us-east-1";
+        const prefix = getString(action.capability.payload.prefix);
+        const maxKeys = Math.min(Math.max(getNumber(action.capability.payload.maxKeys) ?? 25, 1), 1000);
+        const url = new URL(`https://${bucket}.s3.${region}.amazonaws.com/`);
+        url.searchParams.set("list-type", "2");
+        url.searchParams.set("max-keys", String(maxKeys));
+        if (prefix) {
+            url.searchParams.set("prefix", prefix);
+        }
+        const xml = await client.requestText({
+            method: "GET",
+            url,
+            region,
+            service: "s3",
+        });
+        const objects = parseAwsS3ListBucketResult(xml);
+        return {
+            provider: "aws",
+            kind: "s3_objects",
+            bucket,
+            region,
+            prefix: prefix ?? null,
+            objects,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGcpProjectGetHandler(config) {
+    const client = createGcpRestClient(config);
+    const baseUrl = config.cloudResourceManagerApiBaseUrl ?? GCP_CLOUD_RESOURCE_MANAGER_API_BASE_URL;
+    return async ({ action, actionPass }) => {
+        const projectId = getString(action.capability.payload.projectId) ??
+            config.projectId ??
+            fail("gcp_missing_project_id");
+        const project = await client.request(`${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`);
+        return {
+            provider: "gcp",
+            kind: "project",
+            projectId: project.projectId ?? projectId,
+            name: project.name ?? null,
+            displayName: project.displayName ?? null,
+            state: project.state ?? null,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createGcpStorageObjectsListHandler(config) {
+    const client = createGcpRestClient(config);
+    const baseUrl = config.storageApiBaseUrl ?? GCP_STORAGE_API_BASE_URL;
+    return async ({ action, actionPass }) => {
+        const bucket = requireString(action.capability.payload.bucket, "gcp_storage_missing_bucket");
+        const prefix = getString(action.capability.payload.prefix);
+        const maxResults = Math.min(Math.max(getNumber(action.capability.payload.maxResults) ?? 25, 1), 1000);
+        const url = new URL(`${baseUrl}/b/${encodeURIComponent(bucket)}/o`);
+        url.searchParams.set("maxResults", String(maxResults));
+        if (prefix) {
+            url.searchParams.set("prefix", prefix);
+        }
+        const response = await client.request(url.toString());
+        return {
+            provider: "gcp",
+            kind: "storage_objects",
+            bucket,
+            prefix: prefix ?? null,
+            objects: (response.items ?? []).map((item) => ({
+                name: item.name,
+                size: item.size ?? null,
+                updated: item.updated ?? null,
+            })),
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createLocalDocsSearchHandler(config) {
+    const workspace = config.workspace ?? "local";
+    const maxSearchResults = config.maxSearchResults ?? 10;
+    const allowedExtensions = new Set((config.allowedExtensions ?? [".md", ".mdx", ".txt"]).map((extension) => extension.toLowerCase()));
+    return async ({ action, actionPass }) => {
+        const requestedWorkspace = getString(action.capability.payload.workspace) ?? workspace;
+        const query = requireString(action.capability.payload.query, "docs_search_query_required").trim();
+        const maxResults = Math.min(Math.max(getNumber(action.capability.payload.maxResults) ?? 5, 1), maxSearchResults);
+        if (!query) {
+            throw new Error("docs_search_query_required");
+        }
+        if (requestedWorkspace !== workspace) {
+            throw new Error(`docs_workspace_not_available:${requestedWorkspace}`);
+        }
+        const queryLower = query.toLowerCase();
+        const roots = normalizeDocsRoots(config);
+        const results = [];
+        for (const root of roots) {
+            const files = await collectLocalDocsFiles(root, allowedExtensions);
+            for (const file of files) {
+                const content = await readFile(file.absolutePath, "utf8");
+                const matchIndex = content.toLowerCase().indexOf(queryLower);
+                if (matchIndex === -1) {
+                    continue;
+                }
+                results.push({
+                    path: file.relativePath,
+                    root: root.configuredPath,
+                    snippet: redactDocumentText(snippetAround(content, matchIndex, query.length)),
+                });
+                if (results.length >= maxResults) {
+                    return {
+                        provider: "docs",
+                        kind: "document_search",
+                        workspace,
+                        query,
+                        results,
+                        actionPassId: actionPass?.claims.jti ?? null,
+                    };
+                }
+            }
+        }
+        return {
+            provider: "docs",
+            kind: "document_search",
+            workspace,
+            query,
+            results,
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+export function createLocalDocsReadHandler(config) {
+    const workspace = config.workspace ?? "local";
+    const maxReadBytes = config.maxReadBytes ?? 20_000;
+    return async ({ action, actionPass }) => {
+        const requestedWorkspace = getString(action.capability.payload.workspace) ?? workspace;
+        const requestedPath = requireString(action.capability.payload.path, "docs_read_path_required");
+        const normalizedPath = normalizeDocumentPath(requestedPath);
+        const maxBytes = Math.min(Math.max(getNumber(action.capability.payload.maxBytes) ?? maxReadBytes, 1), maxReadBytes);
+        if (requestedWorkspace !== workspace) {
+            throw new Error(`docs_workspace_not_available:${requestedWorkspace}`);
+        }
+        const roots = normalizeDocsRoots(config);
+        const resolved = await resolveLocalDocsPath(roots, normalizedPath);
+        const content = await readFile(resolved.absolutePath, "utf8");
+        const buffer = Buffer.from(content, "utf8");
+        const truncated = buffer.byteLength > maxBytes;
+        const body = truncated ? buffer.subarray(0, maxBytes).toString("utf8") : content;
+        return {
+            provider: "docs",
+            kind: "document",
+            workspace,
+            path: resolved.relativePath,
+            root: resolved.root.configuredPath,
+            bytes: Math.min(buffer.byteLength, maxBytes),
+            truncated,
+            content: redactDocumentText(body),
+            actionPassId: actionPass?.claims.jti ?? null,
+        };
+    };
+}
+function normalizeDocsRoots(config) {
+    if (config.roots.length === 0) {
+        throw new Error("docs_roots_required");
+    }
+    return config.roots.map((rootPath) => ({
+        configuredPath: rootPath,
+        absolutePath: resolve(rootPath),
+        pathPrefix: localDocsRootPrefix(rootPath),
+    }));
+}
+async function collectLocalDocsFiles(root, allowedExtensions) {
+    const files = [];
+    await collectLocalDocsFilesInto(root, root.absolutePath, allowedExtensions, files);
+    return files;
+}
+async function collectLocalDocsFilesInto(root, dir, allowedExtensions, files) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const absolutePath = resolve(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (!entry.name.startsWith(".")) {
+                await collectLocalDocsFilesInto(root, absolutePath, allowedExtensions, files);
+            }
+            continue;
+        }
+        if (!entry.isFile()) {
+            continue;
+        }
+        if (!allowedExtensions.has(extname(entry.name).toLowerCase())) {
+            continue;
+        }
+        const relativePath = withLocalDocsRootPrefix(root, toPosixPath(relative(root.absolutePath, absolutePath)));
+        if (isUnsafeDocumentPath(relativePath)) {
+            continue;
+        }
+        files.push({
+            root,
+            absolutePath,
+            relativePath,
+        });
+    }
+}
+async function resolveLocalDocsPath(roots, requestedPath) {
+    for (const root of roots) {
+        const pathInsideRoot = root.pathPrefix && requestedPath.startsWith(root.pathPrefix)
+            ? requestedPath.slice(root.pathPrefix.length)
+            : requestedPath;
+        const absolutePath = resolve(root.absolutePath, pathInsideRoot);
+        const relativePath = toPosixPath(relative(root.absolutePath, absolutePath));
+        if (isUnsafeDocumentPath(relativePath)) {
+            continue;
+        }
+        try {
+            const stats = await stat(absolutePath);
+            if (stats.isFile()) {
+                return {
+                    root,
+                    absolutePath,
+                    relativePath: withLocalDocsRootPrefix(root, relativePath),
+                };
+            }
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+    throw new Error(`docs_path_not_found:${requestedPath}`);
+}
+function normalizeDocumentPath(path) {
+    const normalized = toPosixPath(path.trim());
+    if (isUnsafeDocumentPath(normalized)) {
+        throw new Error("docs_path_unsafe");
+    }
+    return normalized;
+}
+function isUnsafeDocumentPath(path) {
+    if (!path || path.startsWith("/") || path.startsWith("\\") || path.includes("\0")) {
+        return true;
+    }
+    return path.split("/").some((segment) => segment === ".." || segment === "");
+}
+function toPosixPath(path) {
+    return path.split(sep).join("/").replace(/\\/g, "/");
+}
+function localDocsRootPrefix(rootPath) {
+    const name = basename(rootPath);
+    if (!name || name === "." || (isAbsolute(rootPath) && name !== "docs" && name !== "product")) {
+        return null;
+    }
+    return `${name}/`;
+}
+function withLocalDocsRootPrefix(root, relativePath) {
+    return root.pathPrefix && !relativePath.startsWith(root.pathPrefix)
+        ? `${root.pathPrefix}${relativePath}`
+        : relativePath;
+}
+function snippetAround(content, matchIndex, queryLength) {
+    const start = Math.max(0, matchIndex - 80);
+    const end = Math.min(content.length, matchIndex + queryLength + 120);
+    const prefix = start > 0 ? "..." : "";
+    const suffix = end < content.length ? "..." : "";
+    return `${prefix}${content.slice(start, end).replace(/\s+/g, " ").trim()}${suffix}`;
+}
+function redactDocumentText(text) {
+    return text
+        .replace(/\b(token|secret|password|api[_-]?key)\s*[:=]\s*([^\s`'"]+)/gi, "$1=[redacted]")
+        .replace(/\b(Authorization:\s*Bearer\s+)([^\s`'"]+)/gi, "$1[redacted]");
+}
+function findIssue(state, provider, issueKey) {
+    return state.issueTrackers[provider].issues.find((issue) => issue.issueKey === issueKey);
+}
+function createAwsClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return {
+        stsUrl: config.stsUrl ?? AWS_STS_API_URL,
+        async requestText(input) {
+            return requestWithRetry(maxRetries, async () => {
+                const signed = signAwsRequest({
+                    ...input,
+                    credentials: config.credentials,
+                });
+                const response = await fetchImpl(input.url.toString(), {
+                    method: input.method,
+                    headers: signed.headers,
+                    body: input.body,
+                });
+                if (!response.ok) {
+                    throw await providerError("aws_rest", response);
+                }
+                return response.text();
+            });
+        },
+    };
+}
+async function getAwsCallerIdentity(client) {
+    const url = new URL(client.stsUrl);
+    const body = "Action=GetCallerIdentity&Version=2011-06-15";
+    const xml = await client.requestText({
+        method: "POST",
+        url,
+        region: "us-east-1",
+        service: "sts",
+        body,
+        headers: {
+            "content-type": "application/x-www-form-urlencoded; charset=utf-8",
+        },
+    });
+    return {
+        account: requireXmlText(xml, "Account", "aws_sts_missing_account"),
+        arn: requireXmlText(xml, "Arn", "aws_sts_missing_arn"),
+        userId: requireXmlText(xml, "UserId", "aws_sts_missing_user_id"),
+    };
+}
+function createGcpRestClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return {
+        async request(url) {
+            return requestWithRetry(maxRetries, async () => {
+                const response = await fetchImpl(url, {
+                    method: "GET",
+                    headers: {
+                        authorization: `Bearer ${config.accessToken}`,
+                    },
+                });
+                if (!response.ok) {
+                    throw await providerError("gcp_rest", response);
+                }
+                return response.json();
+            });
+        },
+    };
+}
+function createGitHubRestClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const apiBaseUrl = (config.apiBaseUrl ?? GITHUB_REST_API_BASE_URL).replace(/\/$/, "");
+    const userAgent = config.userAgent ?? GITHUB_REST_USER_AGENT;
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return {
+        async request(path, options) {
+            return requestWithRetry(maxRetries, async () => {
+                const response = await fetchImpl(`${apiBaseUrl}${path}`, {
+                    method: options.method,
+                    headers: {
+                        accept: "application/vnd.github+json",
+                        authorization: `Bearer ${config.token}`,
+                        "content-type": "application/json",
+                        "user-agent": userAgent,
+                        "x-github-api-version": "2022-11-28",
+                    },
+                    body: options.body ? JSON.stringify(removeUndefined(options.body)) : undefined,
+                });
+                if (!response.ok) {
+                    throw await providerError("github_rest", response);
+                }
+                return response.json();
+            });
+        },
+    };
+}
+function createSlackWebClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const apiBaseUrl = (config.apiBaseUrl ?? SLACK_WEB_API_BASE_URL).replace(/\/$/, "");
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return {
+        async request(method, body) {
+            return requestWithRetry(maxRetries, async () => {
+                const response = await fetchImpl(`${apiBaseUrl}/${method}`, {
+                    method: "POST",
+                    headers: {
+                        authorization: `Bearer ${config.token}`,
+                        "content-type": "application/json; charset=utf-8",
+                    },
+                    body: JSON.stringify(removeUndefined(body)),
+                });
+                if (!response.ok) {
+                    throw await providerError("slack_web", response);
+                }
+                const parsed = (await response.json());
+                if (!parsed.ok) {
+                    throw new ProviderRequestError(`slack_web_error:${parsed.error ?? "unknown"}`, 200, parsed.error === "ratelimited" ? "rate_limited" : "provider_error");
+                }
+                return parsed;
+            });
+        },
+    };
+}
+function createLinearGraphqlClient(config) {
+    const fetchImpl = config.fetch ?? fetch;
+    const apiUrl = config.apiUrl ?? LINEAR_GRAPHQL_API_URL;
+    const maxRetries = config.maxRetries ?? DEFAULT_PROVIDER_RETRIES;
+    return {
+        async request(query, variables) {
+            return requestWithRetry(maxRetries, async () => {
+                const response = await fetchImpl(apiUrl, {
+                    method: "POST",
+                    headers: {
+                        authorization: config.token,
+                        "content-type": "application/json",
+                    },
+                    body: JSON.stringify({
+                        query,
+                        variables,
+                    }),
+                });
+                if (!response.ok) {
+                    throw await providerError("linear_graphql", response);
+                }
+                const parsed = (await response.json());
+                if (parsed.errors && parsed.errors.length > 0) {
+                    throw new ProviderRequestError(`linear_graphql_error:${parsed.errors
+                        .map((error) => error.message ?? "unknown")
+                        .join(";")}`, 200, "provider_error");
+                }
+                if (!parsed.data) {
+                    throw new Error("linear_graphql_missing_data");
+                }
+                return parsed.data;
+            });
+        },
+    };
+}
+class ProviderRequestError extends Error {
+    status;
+    category;
+    retryAfterMs;
+    constructor(message, status, category, retryAfterMs = null) {
+        super(message);
+        this.name = "ProviderRequestError";
+        this.status = status;
+        this.category = category;
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+async function providerError(prefix, response) {
+    const message = (await response.text()).slice(0, 500);
+    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    const category = response.status === 401 || response.status === 403
+        ? response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0"
+            ? "rate_limited"
+            : "auth_error"
+        : response.status === 429
+            ? "rate_limited"
+            : response.status >= 500
+                ? "server_error"
+                : "provider_error";
+    return new ProviderRequestError(`${prefix}_${category}_${response.status}:${message}`, response.status, category, retryAfter);
+}
+async function requestWithRetry(maxRetries, run) {
+    let attempt = 0;
+    while (true) {
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (!(error instanceof ProviderRequestError) ||
+                attempt >= maxRetries ||
+                (error.category !== "rate_limited" && error.category !== "server_error")) {
+                throw error;
+            }
+            await sleep(error.retryAfterMs ?? Math.min(250, 25 * 2 ** attempt));
+            attempt += 1;
+        }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function parseRetryAfter(value) {
+    if (!value) {
+        return null;
+    }
+    const seconds = Number.parseInt(value, 10);
+    return Number.isFinite(seconds) && seconds >= 0 ? seconds * 1000 : null;
+}
+async function createGitHubBranch(client, repo, input) {
+    const sha = input.sha ??
+        (await client.request(`/repos/${repo.owner}/${repo.name}/branches/${encodeURIComponent(input.baseBranch)}`, { method: "GET" })).commit.sha;
+    try {
+        const created = await client.request(`/repos/${repo.owner}/${repo.name}/git/refs`, {
+            method: "POST",
+            body: {
+                ref: `refs/heads/${input.branch}`,
+                sha,
+            },
+        });
+        return {
+            ref: created.ref,
+            sha: created.object.sha,
+            alreadyExisted: false,
+        };
+    }
+    catch (error) {
+        if (input.allowExisting &&
+            error instanceof ProviderRequestError &&
+            error.status === 422) {
+            const existing = await client.request(`/repos/${repo.owner}/${repo.name}/git/ref/heads/${encodeGitHubPath(input.branch)}`, { method: "GET" });
+            return {
+                ref: existing.ref,
+                sha: existing.object.sha,
+                alreadyExisted: true,
+            };
+        }
+        throw error;
+    }
+}
+async function writeGitHubContent(client, repo, input) {
+    const response = await client.request(`/repos/${repo.owner}/${repo.name}/contents/${encodeGitHubPath(input.path)}`, {
+        method: "PUT",
+        body: {
+            message: input.message,
+            content: Buffer.from(input.content, "utf8").toString("base64"),
+            branch: input.branch,
+            sha: input.sha ?? undefined,
+        },
+    });
+    return {
+        path: response.content?.path ?? input.path,
+        branch: input.branch,
+        commitSha: response.commit.sha,
+        contentSha: response.content?.sha ?? null,
+    };
+}
+function signAwsRequest(input) {
+    const now = new Date();
+    const amzDate = toAwsAmzDate(now);
+    const dateStamp = amzDate.slice(0, 8);
+    const body = input.body ?? "";
+    const headers = lowerCaseHeaders({
+        ...(input.headers ?? {}),
+        host: input.url.host,
+        "x-amz-date": amzDate,
+        ...(input.credentials.sessionToken
+            ? { "x-amz-security-token": input.credentials.sessionToken }
+            : {}),
+    });
+    const canonicalHeaders = Object.entries(headers)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => `${key}:${value.trim()}\n`)
+        .join("");
+    const signedHeaders = Object.keys(headers).sort().join(";");
+    const canonicalRequest = [
+        input.method,
+        input.url.pathname || "/",
+        canonicalQueryString(input.url.searchParams),
+        canonicalHeaders,
+        signedHeaders,
+        sha256Hex(body),
+    ].join("\n");
+    const credentialScope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        amzDate,
+        credentialScope,
+        sha256Hex(canonicalRequest),
+    ].join("\n");
+    const signingKey = awsSigningKey(input.credentials.secretAccessKey, dateStamp, input.region, input.service);
+    const signature = hmacHex(signingKey, stringToSign);
+    return {
+        headers: {
+            ...headers,
+            authorization: [
+                `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}`,
+                `SignedHeaders=${signedHeaders}`,
+                `Signature=${signature}`,
+            ].join(", "),
+        },
+    };
+}
+function parseAwsS3ListBucketResult(xml) {
+    return [...xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)].map((match) => {
+        const block = match[1] ?? "";
+        return {
+            key: decodeXmlText(xmlText(block, "Key") ?? ""),
+            size: parseOptionalNumber(xmlText(block, "Size")),
+            lastModified: xmlText(block, "LastModified"),
+        };
+    });
+}
+function requireXmlText(xml, tag, reason) {
+    return xmlText(xml, tag) ?? fail(reason);
+}
+function xmlText(xml, tag) {
+    const match = new RegExp(`<${tag}>([\\s\\S]*?)<\\/${tag}>`).exec(xml);
+    return match ? decodeXmlText(match[1]) : null;
+}
+function decodeXmlText(value) {
+    return value
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, "&");
+}
+function toAwsAmzDate(value) {
+    return value.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+function canonicalQueryString(searchParams) {
+    return [...searchParams.entries()]
+        .sort(([leftKey, leftValue], [rightKey, rightValue]) => leftKey === rightKey
+        ? leftValue.localeCompare(rightValue)
+        : leftKey.localeCompare(rightKey))
+        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+        .join("&");
+}
+function awsSigningKey(secretAccessKey, dateStamp, region, service) {
+    const dateKey = hmacBuffer(`AWS4${secretAccessKey}`, dateStamp);
+    const regionKey = hmacBuffer(dateKey, region);
+    const serviceKey = hmacBuffer(regionKey, service);
+    return hmacBuffer(serviceKey, "aws4_request");
+}
+function lowerCaseHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]));
+}
+function hmacBuffer(key, value) {
+    return createHmac("sha256", key).update(value).digest();
+}
+function hmacHex(key, value) {
+    return createHmac("sha256", key).update(value).digest("hex");
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function parseGitHubRepoResource(resource) {
+    const match = /^repo:([^/]+)\/([^/]+)$/.exec(resource);
+    if (!match) {
+        throw new Error(`github_rest_invalid_repo_resource:${resource}`);
+    }
+    return {
+        owner: encodeURIComponent(match[1]),
+        name: encodeURIComponent(match[2]),
+    };
+}
+function encodeGitHubPath(path) {
+    return path
+        .split("/")
+        .map((segment) => encodeURIComponent(segment))
+        .join("/");
+}
+function requireString(value, reason) {
+    const text = getString(value);
+    if (!text) {
+        throw new Error(reason);
+    }
+    return text;
+}
+function issueIdentifier(payload) {
+    return (getString(payload.issueId) ??
+        getString(payload.issueKey) ??
+        fail("linear_graphql_missing_issue_identifier"));
+}
+function fail(reason) {
+    throw new Error(reason);
+}
+function getBoolean(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function getNumber(value) {
+    return typeof value === "number" ? value : null;
+}
+function parseOptionalNumber(value) {
+    if (value === null) {
+        return null;
+    }
+    const number = Number(value);
+    return Number.isFinite(number) ? number : null;
+}
+function getObjectArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => item !== null && typeof item === "object" && !Array.isArray(item));
+}
+function removeUndefined(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined));
+}
+function getString(value) {
+    return typeof value === "string" ? value : null;
+}
+function getStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => typeof item === "string");
+}
+//# sourceMappingURL=index.js.map