@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/Trigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Trigger.js","names":["TriggerRuntime.activate","TriggerRuntime.deactivate","TriggerRuntime.verify","TriggerRuntime.parse","TriggerRuntime.poll"],"sources":["../src/Trigger.ts"],"sourcesContent":["/**\n * Canonical trigger definition builders, runtime contracts, and execution helpers for the Dual SDK.\n *\n * @since 0.0.0\n */\nimport type { Context, Pipeable } from \"effect\";\nimport {\n  Array,\n  Clock,\n  Duration,\n  Effect,\n  Match,\n  Number,\n  Option,\n  Predicate,\n  Record,\n  Result,\n  Schema,\n  String,\n  pipe,\n} from \"effect\";\n\nimport { Base64, Hex } from \"effect/encoding\";\n\nimport type * as AuthMethod from \"./AuthMethod.ts\";\nimport type { ConnectionResolutionContext } from \"./ConnectionResolver.ts\";\nimport type { ContextForMethods } from \"./internal/auth-context.ts\";\nimport { validateIdentifier } from \"./internal/identifier.ts\";\nimport { PipeableProto } from \"./internal/proto.ts\";\nimport * as TriggerRuntime from \"./internal/trigger-runtime.ts\";\n\n/** @since 0.0.0 @category type ids */\nexport const TypeId = \"@dual-os/sdk/Trigger\" as const;\n/** @since 0.0.0 @category type ids */\nexport type TypeId = typeof TypeId;\n\n/** @since 0.0.0 @category models */\nexport type TriggerKind = \"webhook\" | \"polling\";\n/** @since 0.0.0 @category models */\nexport type RuntimePhase = \"activate\" | \"deactivate\" | \"verify\" | \"parse\" | \"poll\";\n\n/** @since 0.0.0 @category models */\nexport interface WebhookRequest {\n  readonly body: unknown;\n  /** Header names are lowercase: the runtime lowercases them before `verify` and `parse`. */\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly rawBody?: string | Uint8Array;\n  readonly method?: string;\n  readonly url?: string;\n  readonly query?: Readonly<Record<string, string | readonly string[]>>;\n}\n\n/** @since 0.0.0 @category models */\nexport interface WebhookResponse {\n  readonly status: number;\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly body?: unknown;\n}\n\ntype MessagePart = string | Uint8Array;\n\nfunction encoded(part: MessagePart): Uint8Array {\n  return Predicate.isString(part) ? new TextEncoder().encode(part) : part;\n}\n\n// Webhook bodies run to megabytes: join the parts in one buffer, never through arrays of numbers.\nfunction bytes(value: MessagePart | readonly MessagePart[]): Uint8Array<ArrayBuffer> {\n  if (Predicate.isString(value)) return new TextEncoder().encode(value);\n  if (value instanceof Uint8Array) return new Uint8Array(value);\n  const parts = Array.map(value, encoded);\n  const joined = new Uint8Array(Number.sumAll(Array.map(parts, part => part.length)));\n  Array.reduce(parts, 0, (offset, part) => {\n    joined.set(part, offset);\n    return offset + part.length;\n  });\n  return joined;\n}\n\n// Constant time: every byte is compared, whichever differs first.\nfunction sameBytes(left: Uint8Array, right: Uint8Array) {\n  return (\n    left.length === right.length && Number.sumAll(Array.zipWith(left, right, (a, b) => a ^ b)) === 0\n  );\n}\n\nconst hmacHashes = { sha1: \"SHA-1\", sha256: \"SHA-256\" } as const;\n\n// A delivery may list many signatures, one per rotated secret: compute the HMAC once, so a\n// forged header full of signatures costs no more than one.\nconst matchesAny = Effect.fnUntraced(function* (\n  algorithm: keyof typeof hmacHashes,\n  secret: MessagePart,\n  message: MessagePart | readonly MessagePart[],\n  signatures: readonly Uint8Array[],\n) {\n  if (secret.length === 0 || signatures.length === 0) return false;\n  const key = yield* Effect.promise(() =>\n    crypto.subtle.importKey(\n      \"raw\",\n      bytes(secret),\n      { hash: hmacHashes[algorithm], name: \"HMAC\" },\n      false,\n      [\"sign\"],\n    ),\n  );\n  const expected = new Uint8Array(\n    yield* Effect.promise(() => crypto.subtle.sign(\"HMAC\", key, bytes(message))),\n  );\n  return Array.contains(\n    Array.map(signatures, signature => sameBytes(signature, expected)),\n    true,\n  );\n});\n\n/**\n * The hex SHA-256 of a delivery's raw body. Use it as the event key when the provider signs the\n * body but not its delivery identifier header, so a replayed delivery keeps one identity.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const bodyDigest = Effect.fn(\"Trigger.bodyDigest\")(function* (rawBody: string | Uint8Array) {\n  const digest = yield* Effect.promise(() => crypto.subtle.digest(\"SHA-256\", bytes(rawBody)));\n  return Hex.encode(new Uint8Array(digest));\n});\n\n/**\n * Whether `signature` is the HMAC-SHA256 of `message` keyed with `secret`, the way most webhook\n * providers sign their deliveries. The comparison runs in constant time.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const verifyHmacSha256 = Effect.fn(\"Trigger.verifyHmacSha256\")(function* (\n  secret: string,\n  message: string | Uint8Array,\n  signature: Uint8Array,\n) {\n  return yield* matchesAny(\"sha256\", secret, message, [signature]);\n});\n\n/**\n * Whether `signature`, written in `encoding`, is the HMAC of `message` keyed with `secret`, given\n * as text or as raw key bytes such as a decoded `whsec_` secret. A message given as parts is signed\n * as their concatenation, such as a timestamp followed by the raw body. Given several signatures,\n * such as one per rotated secret, it verifies when any of them matches and hashes the message once.\n * A missing secret, or signatures none of which is valid `encoding`, never verifies. The comparison\n * runs in constant time.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const verifyHmac = Effect.fn(\"Trigger.verifyHmac\")(function* (options: {\n  readonly algorithm: keyof typeof hmacHashes;\n  readonly encoding: \"hex\" | \"base64\";\n  readonly message: MessagePart | readonly MessagePart[];\n  readonly secret: MessagePart;\n  readonly signature: string | readonly string[];\n}) {\n  const decode = pipe(\n    Match.value(options.encoding),\n    Match.when(\"hex\", () => Hex.decode),\n    Match.when(\"base64\", () => Base64.decode),\n    Match.exhaustive,\n  );\n  return yield* matchesAny(\n    options.algorithm,\n    options.secret,\n    options.message,\n    Array.filterMap(Array.ensure(options.signature), signature => decode(signature)),\n  );\n});\n\n/**\n * Whether a [Standard Webhooks](https://www.standardwebhooks.com) delivery is signed with `secret`:\n * one `v1,<base64>` entry of its `webhook-signature` header (`svix-signature` from Svix) must be the\n * HMAC-SHA256 of `id.timestamp.body` keyed with the bytes of the `whsec_` secret, and its timestamp\n * must be within five minutes of now. Header names are lowercase, as in `WebhookRequest`. Missing\n * headers or secret never verify.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const verifyStandardWebhook = Effect.fn(\"Trigger.verifyStandardWebhook\")(\n  function* (options: {\n    readonly body: MessagePart;\n    readonly headers: Readonly<Record<string, string>>;\n    readonly secret: string;\n  }) {\n    const now = yield* Clock.currentTimeMillis;\n    function header(name: \"id\" | \"signature\" | \"timestamp\") {\n      return Option.orElse(Record.get(options.headers, `webhook-${name}` as const), () =>\n        Record.get(options.headers, `svix-${name}` as const),\n      );\n    }\n    const signed = Option.all({\n      id: header(\"id\"),\n      key: Result.getSuccess(Base64.decode(pipe(options.secret, String.replace(/^whsec_/u, \"\")))),\n      signature: header(\"signature\"),\n      timestamp: Option.filter(header(\"timestamp\"), timestamp =>\n        Option.exists(Number.parse(timestamp), seconds =>\n          Number.between(seconds * 1000, {\n            maximum: now + Duration.toMillis(Duration.minutes(5)),\n            minimum: now - Duration.toMillis(Duration.minutes(5)),\n          }),\n        ),\n      ),\n    });\n    return yield* Option.match(signed, {\n      onNone: () => Effect.succeed(false),\n      onSome: delivery =>\n        verifyHmac({\n          algorithm: \"sha256\",\n          encoding: \"base64\",\n          message: [`${delivery.id}.${delivery.timestamp}.`, options.body],\n          secret: delivery.key,\n          signature: pipe(\n            delivery.signature,\n            String.split(\" \"),\n            Array.filter(String.startsWith(\"v1,\")),\n            Array.map(String.slice(3)),\n          ),\n        }),\n    });\n  },\n);\n\n/**\n * Whether `actual` equals the shared secret `expected`, for providers that send the secret itself\n * back with each delivery. An empty or missing secret never verifies. The comparison runs in\n * constant time.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const verifyToken = Effect.fn(\"Trigger.verifyToken\")(function* (\n  expected: string,\n  actual: string | undefined,\n) {\n  if (expected === \"\" || actual === undefined) return false;\n  const key = yield* Effect.promise(() =>\n    crypto.subtle.importKey(\n      \"raw\",\n      crypto.getRandomValues(new Uint8Array(32)),\n      { hash: \"SHA-256\", name: \"HMAC\" },\n      false,\n      [\"sign\", \"verify\"],\n    ),\n  );\n  const reference = yield* Effect.promise(() => crypto.subtle.sign(\"HMAC\", key, bytes(expected)));\n  return yield* Effect.promise(() => crypto.subtle.verify(\"HMAC\", key, reference, bytes(actual)));\n});\n\nconst p256ScalarLength = 32;\n\nfunction paddedScalar(integer: readonly number[]) {\n  const trimmed = Array.dropWhile(integer, byte => byte === 0);\n  return Option.liftPredicate(\n    Array.appendAll(\n      Array.take(Array.replicate(0, p256ScalarLength), p256ScalarLength - trimmed.length),\n      trimmed,\n    ),\n    scalar => scalar.length === p256ScalarLength,\n  );\n}\n\nfunction derInteger(der: readonly number[], offset: number) {\n  return Option.gen(function* () {\n    yield* Option.liftPredicate(yield* Array.get(der, offset), tag => tag === 0x02);\n    const length = yield* Array.get(der, offset + 1);\n    const value = Array.take(Array.drop(der, offset + 2), length);\n    yield* Option.liftPredicate(value, taken => taken.length === length);\n    return { next: offset + 2 + length, value };\n  });\n}\n\nfunction derToP1363(signature: Uint8Array) {\n  return Option.gen(function* () {\n    const der = Array.fromIterable(signature);\n    yield* Option.liftPredicate(yield* Array.get(der, 0), tag => tag === 0x30);\n    yield* Option.liftPredicate(yield* Array.get(der, 1), length => length === der.length - 2);\n    const r = yield* derInteger(der, 2);\n    const s = yield* derInteger(der, r.next);\n    yield* Option.liftPredicate(s.next, next => next === der.length);\n    return new Uint8Array(\n      Array.appendAll(yield* paddedScalar(r.value), yield* paddedScalar(s.value)),\n    );\n  });\n}\n\n/**\n * Whether `signature`, a base64 DER ECDSA signature, signs `message` with the ECDSA P-256 key\n * `publicKey`, a base64 DER SubjectPublicKeyInfo, hashed with SHA-256. A message given as parts is\n * signed as their concatenation, such as a timestamp followed by the raw body. A missing key or a\n * key or signature that is not valid never verifies.\n *\n * @since 0.0.0\n * @category webhooks\n */\nexport const verifyEcdsaP256 = Effect.fn(\"Trigger.verifyEcdsaP256\")(function* (options: {\n  readonly message: MessagePart | readonly MessagePart[];\n  readonly publicKey: string;\n  readonly signature: string;\n}) {\n  const decoded = Option.all({\n    publicKey: Result.getSuccess(Base64.decode(options.publicKey)),\n    signature: Option.flatMap(Result.getSuccess(Base64.decode(options.signature)), derToP1363),\n  });\n  return yield* Option.match(decoded, {\n    onNone: () => Effect.succeed(false),\n    onSome: Effect.fnUntraced(function* (keys) {\n      return yield* pipe(\n        Effect.tryPromise(async () =>\n          crypto.subtle.verify(\n            { hash: \"SHA-256\", name: \"ECDSA\" },\n            await crypto.subtle.importKey(\n              \"spki\",\n              bytes(keys.publicKey),\n              { name: \"ECDSA\", namedCurve: \"P-256\" },\n              false,\n              [\"verify\"],\n            ),\n            keys.signature,\n            bytes(options.message),\n          ),\n        ),\n        Effect.orElseSucceed(() => false),\n      );\n    }),\n  });\n});\n\n/** @since 0.0.0 @category models */\nexport type RuntimeContext<EffectiveAuthMethods extends readonly AuthMethod.Any[]> =\n  ContextForMethods<EffectiveAuthMethods> & ConnectionResolutionContext;\n\n/** @since 0.0.0 @category type-level */\nexport type StateValue<State extends Schema.Top | undefined> = [State] extends [Schema.Top]\n  ? Schema.Schema.Type<Exclude<State, undefined>> | undefined\n  : undefined;\n\n/** @since 0.0.0 @category models */\nexport interface RuntimeMeta<\n  TriggerId extends string = string,\n  Phase extends RuntimePhase = RuntimePhase,\n> {\n  readonly triggerId: TriggerId;\n  readonly phase: Phase;\n}\n\n/** @since 0.0.0 @category models */\nexport interface ActivateSuccess<TriggerId extends string = string, State = unknown> {\n  readonly state: State;\n  readonly meta: RuntimeMeta<TriggerId, \"activate\">;\n}\n/** @since 0.0.0 @category models */\nexport interface DeactivateSuccess<TriggerId extends string = string> {\n  readonly meta: RuntimeMeta<TriggerId, \"deactivate\">;\n}\n/** @since 0.0.0 @category models */\nexport interface VerifySuccess<TriggerId extends string = string, State = unknown> {\n  readonly verified: true;\n  readonly response?: WebhookResponse;\n  readonly state?: State;\n  readonly meta: RuntimeMeta<TriggerId, \"verify\">;\n}\n/**\n * What `verify` returns when the delivery is more than an authenticated event: the `response` the\n * host sends back to the provider, such as a handshake answer, and the new trigger `state`, such as\n * a secret the handshake delivered.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface VerifyResult<State> {\n  readonly response?: WebhookResponse;\n  readonly state?: State;\n}\n/** @since 0.0.0 @category models */\nexport interface KeyedEvent<Payload = unknown> {\n  readonly key: string;\n  readonly payload: Payload;\n}\n/** @since 0.0.0 @category models */\nexport interface EmittedEventsSuccess<\n  TriggerId extends string = string,\n  Phase extends \"parse\" | \"poll\" = \"parse\" | \"poll\",\n  Output = unknown,\n  State = unknown,\n> {\n  readonly events: readonly KeyedEvent<Output>[];\n  readonly state: State;\n  readonly meta: RuntimeMeta<TriggerId, Phase>;\n}\n\n/** @since 0.0.0 @category models */\nexport interface LifecycleInput<Config, State> {\n  readonly config: Config;\n  readonly state: State;\n}\n/** @since 0.0.0 @category models */\nexport interface WebhookActivationInput<Config, State> extends LifecycleInput<Config, State> {\n  /** The absolute URL the host serves this trigger's deliveries on. */\n  readonly webhookUrl: string;\n}\n/** @since 0.0.0 @category models */\nexport interface WebhookLifecycleInput<Config, State> extends WebhookActivationInput<\n  Config,\n  State\n> {\n  readonly request: WebhookRequest;\n}\n/** @since 0.0.0 @category models */\nexport interface PollingInput<Config, State> extends LifecycleInput<Config, State> {}\n/** @since 0.0.0 @category models */\nexport interface ActivationResult<State> {\n  readonly state: State;\n}\n/** @since 0.0.0 @category models */\nexport interface EmitResult<Output, State> {\n  readonly events: readonly KeyedEvent<Output>[];\n  readonly state: State;\n}\n\n/** @since 0.0.0 @category models */\nexport interface WebhookRuntime<\n  Config extends Schema.Top,\n  Output extends Schema.Top,\n  State extends Schema.Top | undefined,\n  AppError = never,\n  Requirements = never,\n  EffectiveAuthMethods extends readonly AuthMethod.Any[] = readonly AuthMethod.Any[],\n> {\n  readonly activate?: (\n    input: WebhookActivationInput<Schema.Schema.Type<Config>, StateValue<State>>,\n    context: RuntimeContext<EffectiveAuthMethods>,\n  ) => Effect.Effect<ActivationResult<StateValue<State>>, AppError, Requirements>;\n  readonly deactivate?: (\n    input: WebhookActivationInput<Schema.Schema.Type<Config>, StateValue<State>>,\n    context: RuntimeContext<EffectiveAuthMethods>,\n  ) => Effect.Effect<void, AppError, Requirements>;\n  readonly verify?: (\n    input: WebhookLifecycleInput<Schema.Schema.Type<Config>, StateValue<State>>,\n    context: RuntimeContext<EffectiveAuthMethods>,\n  ) => Effect.Effect<void | VerifyResult<StateValue<State>>, AppError, Requirements>;\n  /**\n   * Parses one accepted webhook delivery.\n   *\n   * The Dual runtime may retry `parse` for the same delivery until the delivery\n   * reaches a durable final status. Implementations must be idempotent and\n   * tolerate at-least-once calls for the same request/context.\n   *\n   * @since 0.0.0 @category handlers\n   */\n  readonly parse?: (\n    input: WebhookLifecycleInput<Schema.Schema.Type<Config>, StateValue<State>>,\n    context: RuntimeContext<EffectiveAuthMethods>,\n  ) => Effect.Effect<\n    EmitResult<Schema.Schema.Type<Output>, StateValue<State>>,\n    AppError,\n    Requirements\n  >;\n}\n\n/** @since 0.0.0 @category models */\nexport interface PollingRuntime<\n  Config extends Schema.Top,\n  Output extends Schema.Top,\n  State extends Schema.Top | undefined,\n  AppError = never,\n  Requirements = never,\n  EffectiveAuthMethods extends readonly AuthMethod.Any[] = readonly AuthMethod.Any[],\n> {\n  /**\n   * Polls one scheduled trigger occurrence.\n   *\n   * The Dual runtime may retry `poll` for the same occurrence until its cursor\n   * and emitted events commit. Implementations must be idempotent and tolerate\n   * at-least-once calls for the same occurrence metadata.\n   *\n   * @since 0.0.0 @category handlers\n   */\n  readonly poll?: (\n    input: PollingInput<Schema.Schema.Type<Config>, StateValue<State>>,\n    context: RuntimeContext<EffectiveAuthMethods>,\n  ) => Effect.Effect<\n    EmitResult<Schema.Schema.Type<Output>, StateValue<State>>,\n    AppError,\n    Requirements\n  >;\n}\n\n/** @since 0.0.0 @category models */\nexport type RuntimeContract<\n  Kind extends TriggerKind,\n  Config extends Schema.Top,\n  Output extends Schema.Top,\n  State extends Schema.Top | undefined,\n  AppError = never,\n  Requirements = never,\n  EffectiveAuthMethods extends readonly AuthMethod.Any[] = readonly AuthMethod.Any[],\n> = Kind extends \"webhook\"\n  ? WebhookRuntime<Config, Output, State, AppError, Requirements, EffectiveAuthMethods>\n  : PollingRuntime<Config, Output, State, AppError, Requirements, EffectiveAuthMethods>;\n\n/** @since 0.0.0 @category models */\nexport interface Handler<TriggerId extends string = string> {\n  readonly _: unique symbol;\n  readonly triggerId: TriggerId;\n  readonly context: Context.Context<never>;\n  readonly runtime: RuntimeContract<any, any, any, any, any, any, any>;\n}\n\n/** @since 0.0.0 @category handlers */\nexport const handlerKey = (triggerId: string): string =>\n  `@dual-os/sdk/Trigger/Handler/${triggerId}`;\n\n/** @since 0.0.0 @category type-level */\nexport interface Any extends Pipeable.Pipeable {\n  readonly [TypeId]: TypeId;\n  readonly identifier: string;\n  readonly name: string | undefined;\n  readonly description: string | undefined;\n  readonly kind: TriggerKind;\n  readonly config: Schema.Top;\n  readonly output: Schema.Top;\n  readonly state: Schema.Top | undefined;\n  readonly requireAuth: boolean;\n}\n\n/** @since 0.0.0 @category models */\nexport interface TriggerOptions {\n  readonly name?: string | undefined;\n  readonly description?: string | undefined;\n}\n\n/**\n * Options used to declare a trigger contract.\n *\n * @since 0.6.0\n * @category models\n */\nexport interface ContractOptions<\n  Config extends Schema.Top,\n  Output extends Schema.Top,\n  State extends Schema.Top | undefined,\n  RequireAuth extends boolean,\n> extends TriggerOptions {\n  readonly config: Config;\n  readonly output: Output;\n  readonly state?: State;\n  /** Set to `false` to make a connection optional for this trigger. */\n  readonly requireAuth?: RequireAuth;\n}\n\n/** @since 0.0.0 @category models */\nexport interface Trigger<\n  out Identifier extends string = string,\n  out Kind extends TriggerKind = TriggerKind,\n  out Config extends Schema.Top = Schema.Top,\n  out Output extends Schema.Top = Schema.Top,\n  out State extends Schema.Top | undefined = Schema.Top | undefined,\n  out RequireAuth extends boolean = boolean,\n>\n  extends Pipeable.Pipeable {\n  readonly [TypeId]: TypeId;\n  readonly identifier: Identifier;\n  readonly name: string | undefined;\n  readonly description: string | undefined;\n  readonly kind: Kind;\n  readonly config: Config;\n  readonly output: Output;\n  readonly state: State;\n  readonly requireAuth: RequireAuth;\n}\n\nexport type ConfigSchema<TriggerDef extends Any> = TriggerDef[\"config\"];\n\nexport type OutputSchema<TriggerDef extends Any> = TriggerDef[\"output\"];\n\nexport type StateSchema<TriggerDef extends Any> = TriggerDef[\"state\"];\n\nexport type Config<TriggerDef extends Any> = Schema.Schema.Type<ConfigSchema<TriggerDef>>;\n\nexport type Output<TriggerDef extends Any> = Schema.Schema.Type<OutputSchema<TriggerDef>>;\n\nexport type State<TriggerDef extends Any> = StateValue<StateSchema<TriggerDef>>;\n\n/** @since 0.0.0 @category models */\nexport interface RuntimeTriggerEntry<\n  out TriggerDef extends Any = Any,\n  out AllowedMethods extends readonly AuthMethod.Any[] = readonly AuthMethod.Any[],\n  out TriggerId extends string = string,\n  out ProviderId extends string = string,\n> {\n  readonly providerId: ProviderId;\n  readonly triggerId: TriggerId;\n  readonly pluginVersion: string | undefined;\n  readonly trigger: TriggerDef;\n  readonly authMethods: AllowedMethods;\n}\n\nconst Proto = { ...PipeableProto, [TypeId]: TypeId };\n\n/**\n * Constructor for one trigger kind.\n *\n * @since 0.6.0\n * @category constructors\n */\nexport type Constructor<Kind extends TriggerKind> = <\n  const Identifier extends string,\n  Config extends Schema.Top,\n  Output extends Schema.Top,\n  State extends Schema.Top | undefined = undefined,\n  const RequireAuth extends boolean = true,\n>(\n  identifier: Identifier,\n  options: ContractOptions<Config, Output, State, RequireAuth>,\n) => Trigger<Identifier, Kind, Config, Output, State, RequireAuth>;\n\nconst constructor =\n  <Kind extends TriggerKind>(kind: Kind): Constructor<Kind> =>\n  (identifier, options) => {\n    validateIdentifier(\"trigger\", identifier);\n    return Object.assign(Object.create(Proto), {\n      config: options.config,\n      description: options.description,\n      identifier,\n      kind,\n      name: options.name,\n      output: options.output,\n      requireAuth: options.requireAuth ?? true,\n      state: options.state,\n    });\n  };\n\n/**\n * Provider webhook triggers must own isolated per-trigger/per-deploy-version\n * ingress/subscription state, or no external provider resource at all.\n * Activating or deactivating one Dual trigger must never mutate provider state\n * that another trigger, deploy version, mailbox, account, or app-level\n * subscription depends on. Shared provider watches must be modeled as polling.\n *\n * @since 0.0.0 @category constructors\n */\nexport const webhook: Constructor<\"webhook\"> = constructor(\"webhook\");\n\n/** @since 0.0.0 @category constructors */\nexport const polling: Constructor<\"polling\"> = constructor(\"polling\");\n\n/** @since 0.0.0 @category guards */\nexport const isTrigger = (u: unknown): u is Any => Predicate.hasProperty(u, TypeId);\n\n/** @since 0.0.0 @category errors */\nexport class InvalidTriggerConfigError extends Schema.TaggedError<InvalidTriggerConfigError>()(\n  \"InvalidTriggerConfigError\",\n  { description: Schema.String, triggerId: Schema.String },\n) {}\n\n/** @since 0.0.0 @category errors */\nexport class InvalidTriggerStateError extends Schema.TaggedError<InvalidTriggerStateError>()(\n  \"InvalidTriggerStateError\",\n  {\n    description: Schema.String,\n    location: Schema.Literals([\"input\", \"result\"]),\n    phase: Schema.Literals([\"activate\", \"deactivate\", \"verify\", \"parse\", \"poll\"]),\n    triggerId: Schema.String,\n  },\n) {}\n\n/** @since 0.0.0 @category errors */\nexport class InvalidTriggerOutputError extends Schema.TaggedError<InvalidTriggerOutputError>()(\n  \"InvalidTriggerOutputError\",\n  {\n    description: Schema.String,\n    phase: Schema.Literals([\"parse\", \"poll\"]),\n    triggerId: Schema.String,\n  },\n) {}\n\n/** @since 0.0.0 @category errors */\nexport class UnsupportedTriggerRuntimeError extends Schema.TaggedError<UnsupportedTriggerRuntimeError>()(\n  \"UnsupportedTriggerRuntimeError\",\n  {\n    kind: Schema.Literals([\"webhook\", \"polling\"]),\n    phase: Schema.Literals([\"activate\", \"deactivate\", \"verify\", \"parse\", \"poll\"]),\n    triggerId: Schema.String,\n  },\n) {}\n\n/** @since 0.0.0 @category models */\nexport interface LifecycleRequest {\n  readonly config: unknown;\n  readonly state?: unknown;\n  readonly connectionId?: string;\n  readonly context?: ConnectionResolutionContext;\n}\n\n/** @since 0.0.0 @category models */\nexport interface WebhookActivationRequest extends LifecycleRequest {\n  readonly webhookUrl: string;\n}\n\n/** @since 0.0.0 @category models */\nexport interface WebhookExecutionRequest extends WebhookActivationRequest {\n  readonly request: WebhookRequest;\n}\n\n/** @since 0.0.0 @category models */\nexport interface PollExecutionRequest extends LifecycleRequest {}\n\n/** @since 0.0.0 @category execution */\nexport const activate = TriggerRuntime.activate;\n/** @since 0.0.0 @category execution */\nexport const deactivate = TriggerRuntime.deactivate;\n/** @since 0.0.0 @category execution */\nexport const verify = TriggerRuntime.verify;\n/** @since 0.0.0 @category execution */\nexport const parse = TriggerRuntime.parse;\n/** @since 0.0.0 @category execution */\nexport const poll = TriggerRuntime.poll;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAa,SAAS;AA6BtB,SAAS,QAAQ,MAA+B;CAC9C,OAAO,UAAU,SAAS,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,IAAI;AACrE;AAGA,SAAS,MAAM,OAAsE;CACnF,IAAI,UAAU,SAAS,KAAK,GAAG,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK;CACpE,IAAI,iBAAiB,YAAY,OAAO,IAAI,WAAW,KAAK;CAC5D,MAAM,QAAQ,MAAM,IAAI,OAAO,OAAO;CACtC,MAAM,SAAS,IAAI,WAAW,OAAO,OAAO,MAAM,IAAI,QAAO,SAAQ,KAAK,MAAM,CAAC,CAAC;CAClF,MAAM,OAAO,OAAO,IAAI,QAAQ,SAAS;EACvC,OAAO,IAAI,MAAM,MAAM;EACvB,OAAO,SAAS,KAAK;CACvB,CAAC;CACD,OAAO;AACT;AAGA,SAAS,UAAU,MAAkB,OAAmB;CACtD,OACE,KAAK,WAAW,MAAM,UAAU,OAAO,OAAO,MAAM,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,MAAM;AAEnG;AAEA,MAAM,aAAa;CAAE,MAAM;CAAS,QAAQ;AAAU;AAItD,MAAM,aAAa,OAAO,WAAW,WACnC,WACA,QACA,SACA,YACA;CACA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG,OAAO;CAC3D,MAAM,MAAM,OAAO,OAAO,cACxB,OAAO,OAAO,UACZ,OACA,MAAM,MAAM,GACZ;EAAE,MAAM,WAAW;EAAY,MAAM;CAAO,GAC5C,OACA,CAAC,MAAM,CACT,CACF;CACA,MAAM,WAAW,IAAI,WACnB,OAAO,OAAO,cAAc,OAAO,OAAO,KAAK,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,CAC7E;CACA,OAAO,MAAM,SACX,MAAM,IAAI,aAAY,cAAa,UAAU,WAAW,QAAQ,CAAC,GACjE,IACF;AACF,CAAC;;;;;;;;AASD,MAAa,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,SAA8B;CACjG,MAAM,SAAS,OAAO,OAAO,cAAc,OAAO,OAAO,OAAO,WAAW,MAAM,OAAO,CAAC,CAAC;CAC1F,OAAO,IAAI,OAAO,IAAI,WAAW,MAAM,CAAC;AAC1C,CAAC;;;;;;;;AASD,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,QACA,SACA,WACA;CACA,OAAO,OAAO,WAAW,UAAU,QAAQ,SAAS,CAAC,SAAS,CAAC;AACjE,CAAC;;;;;;;;;;;;AAaD,MAAa,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,SAMlE;CACD,MAAM,SAAS,KACb,MAAM,MAAM,QAAQ,QAAQ,GAC5B,MAAM,KAAK,aAAa,IAAI,MAAM,GAClC,MAAM,KAAK,gBAAgB,OAAO,MAAM,GACxC,MAAM,UACR;CACA,OAAO,OAAO,WACZ,QAAQ,WACR,QAAQ,QACR,QAAQ,SACR,MAAM,UAAU,MAAM,OAAO,QAAQ,SAAS,IAAG,cAAa,OAAO,SAAS,CAAC,CACjF;AACF,CAAC;;;;;;;;;;;AAYD,MAAa,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAC7E,WAAW,SAIR;CACD,MAAM,MAAM,OAAO,MAAM;CACzB,SAAS,OAAO,MAAwC;EACtD,OAAO,OAAO,OAAO,OAAO,IAAI,QAAQ,SAAS,WAAW,MAAe,SACzE,OAAO,IAAI,QAAQ,SAAS,QAAQ,MAAe,CACrD;CACF;CACA,MAAM,SAAS,OAAO,IAAI;EACxB,IAAI,OAAO,IAAI;EACf,KAAK,OAAO,WAAW,OAAO,OAAO,KAAK,QAAQ,QAAQ,OAAO,QAAQ,YAAY,EAAE,CAAC,CAAC,CAAC;EAC1F,WAAW,OAAO,WAAW;EAC7B,WAAW,OAAO,OAAO,OAAO,WAAW,IAAG,cAC5C,OAAO,OAAO,OAAO,MAAM,SAAS,IAAG,YACrC,OAAO,QAAQ,UAAU,KAAM;GAC7B,SAAS,MAAM,SAAS,SAAS,SAAS,QAAQ,CAAC,CAAC;GACpD,SAAS,MAAM,SAAS,SAAS,SAAS,QAAQ,CAAC,CAAC;EACtD,CAAC,CACH,CACF;CACF,CAAC;CACD,OAAO,OAAO,OAAO,MAAM,QAAQ;EACjC,cAAc,OAAO,QAAQ,KAAK;EAClC,SAAQ,aACN,WAAW;GACT,WAAW;GACX,UAAU;GACV,SAAS,CAAC,GAAG,SAAS,GAAG,GAAG,SAAS,UAAU,IAAI,QAAQ,IAAI;GAC/D,QAAQ,SAAS;GACjB,WAAW,KACT,SAAS,WACT,OAAO,MAAM,GAAG,GAChB,MAAM,OAAO,OAAO,WAAW,KAAK,CAAC,GACrC,MAAM,IAAI,OAAO,MAAM,CAAC,CAAC,CAC3B;EACF,CAAC;CACL,CAAC;AACH,CACF;;;;;;;;;AAUA,MAAa,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC1D,UACA,QACA;CACA,IAAI,aAAa,MAAM,WAAW,KAAA,GAAW,OAAO;CACpD,MAAM,MAAM,OAAO,OAAO,cACxB,OAAO,OAAO,UACZ,OACA,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,GACzC;EAAE,MAAM;EAAW,MAAM;CAAO,GAChC,OACA,CAAC,QAAQ,QAAQ,CACnB,CACF;CACA,MAAM,YAAY,OAAO,OAAO,cAAc,OAAO,OAAO,KAAK,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC;CAC9F,OAAO,OAAO,OAAO,cAAc,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,MAAM,MAAM,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,mBAAmB;AAEzB,SAAS,aAAa,SAA4B;CAChD,MAAM,UAAU,MAAM,UAAU,UAAS,SAAQ,SAAS,CAAC;CAC3D,OAAO,OAAO,cACZ,MAAM,UACJ,MAAM,KAAK,MAAM,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,QAAQ,MAAM,GAClF,OACF,IACA,WAAU,OAAO,WAAW,gBAC9B;AACF;AAEA,SAAS,WAAW,KAAwB,QAAgB;CAC1D,OAAO,OAAO,IAAI,aAAa;EAC7B,OAAO,OAAO,cAAc,OAAO,MAAM,IAAI,KAAK,MAAM,IAAG,QAAO,QAAQ,CAAI;EAC9E,MAAM,SAAS,OAAO,MAAM,IAAI,KAAK,SAAS,CAAC;EAC/C,MAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,SAAS,CAAC,GAAG,MAAM;EAC5D,OAAO,OAAO,cAAc,QAAO,UAAS,MAAM,WAAW,MAAM;EACnE,OAAO;GAAE,MAAM,SAAS,IAAI;GAAQ;EAAM;CAC5C,CAAC;AACH;AAEA,SAAS,WAAW,WAAuB;CACzC,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,MAAM,MAAM,aAAa,SAAS;EACxC,OAAO,OAAO,cAAc,OAAO,MAAM,IAAI,KAAK,CAAC,IAAG,QAAO,QAAQ,EAAI;EACzE,OAAO,OAAO,cAAc,OAAO,MAAM,IAAI,KAAK,CAAC,IAAG,WAAU,WAAW,IAAI,SAAS,CAAC;EACzF,MAAM,IAAI,OAAO,WAAW,KAAK,CAAC;EAClC,MAAM,IAAI,OAAO,WAAW,KAAK,EAAE,IAAI;EACvC,OAAO,OAAO,cAAc,EAAE,OAAM,SAAQ,SAAS,IAAI,MAAM;EAC/D,OAAO,IAAI,WACT,MAAM,UAAU,OAAO,aAAa,EAAE,KAAK,GAAG,OAAO,aAAa,EAAE,KAAK,CAAC,CAC5E;CACF,CAAC;AACH;;;;;;;;;;AAWA,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,SAI5E;CACD,MAAM,UAAU,OAAO,IAAI;EACzB,WAAW,OAAO,WAAW,OAAO,OAAO,QAAQ,SAAS,CAAC;EAC7D,WAAW,OAAO,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,SAAS,CAAC,GAAG,UAAU;CAC3F,CAAC;CACD,OAAO,OAAO,OAAO,MAAM,SAAS;EAClC,cAAc,OAAO,QAAQ,KAAK;EAClC,QAAQ,OAAO,WAAW,WAAW,MAAM;GACzC,OAAO,OAAO,KACZ,OAAO,WAAW,YAChB,OAAO,OAAO,OACZ;IAAE,MAAM;IAAW,MAAM;GAAQ,GACjC,MAAM,OAAO,OAAO,UAClB,QACA,MAAM,KAAK,SAAS,GACpB;IAAE,MAAM;IAAS,YAAY;GAAQ,GACrC,OACA,CAAC,QAAQ,CACX,GACA,KAAK,WACL,MAAM,QAAQ,OAAO,CACvB,CACF,GACA,OAAO,oBAAoB,KAAK,CAClC;EACF,CAAC;CACH,CAAC;AACH,CAAC;;AAwLD,MAAa,cAAc,cACzB,gCAAgC;AAuFlC,MAAM,QAAQ;CAAE,GAAG;EAAgB,SAAS;AAAO;AAmBnD,MAAM,eACuB,UAC1B,YAAY,YAAY;CACvB,mBAAmB,WAAW,UAAU;CACxC,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG;EACzC,QAAQ,QAAQ;EAChB,aAAa,QAAQ;EACrB;EACA;EACA,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,aAAa,QAAQ,eAAe;EACpC,OAAO,QAAQ;CACjB,CAAC;AACH;;;;;;;;;;AAWF,MAAa,UAAkC,YAAY,SAAS;;AAGpE,MAAa,UAAkC,YAAY,SAAS;;AAGpE,MAAa,aAAa,MAAyB,UAAU,YAAY,GAAG,MAAM;;AAGlF,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CAAE,aAAa,OAAO;CAAQ,WAAW,OAAO;AAAO,CACzD,CAAC,CAAC,CAAC;;AAGH,IAAa,2BAAb,cAA8C,OAAO,YAAsC,CAAC,CAC1F,4BACA;CACE,aAAa,OAAO;CACpB,UAAU,OAAO,SAAS,CAAC,SAAS,QAAQ,CAAC;CAC7C,OAAO,OAAO,SAAS;EAAC;EAAY;EAAc;EAAU;EAAS;CAAM,CAAC;CAC5E,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CACE,aAAa,OAAO;CACpB,OAAO,OAAO,SAAS,CAAC,SAAS,MAAM,CAAC;CACxC,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA;CACE,MAAM,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;CAC5C,OAAO,OAAO,SAAS;EAAC;EAAY;EAAc;EAAU;EAAS;CAAM,CAAC;CAC5E,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;AAwBH,MAAa,WAAWA;;AAExB,MAAa,aAAaC;;AAE1B,MAAa,SAASC;;AAEtB,MAAa,QAAQC;;AAErB,MAAa,OAAOC"}

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll };

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import { OAuth2TokenRefresher_d_exports } from "./OAuth2TokenRefresher.js";
+import { AuthMethodBinding_d_exports } from "./AuthMethodBinding.js";
+import { AuthMethodExecution_d_exports } from "./AuthMethodExecution.js";
+import { AuthMethod_d_exports } from "./AuthMethod.js";
+import { Action_d_exports } from "./Action.js";
+import { AgentChannel_d_exports } from "./AgentChannel.js";
+import { ConnectionResolver_d_exports } from "./ConnectionResolver.js";
+import { Trigger_d_exports } from "./Trigger.js";
+import { Group_d_exports } from "./Group.js";
+import { DefinitionError_d_exports } from "./DefinitionError.js";
+import { Plugin_d_exports } from "./Plugin.js";
+import { AgentChannelRuntime_d_exports } from "./AgentChannelRuntime.js";
+import { AiProvider_d_exports } from "./AiProvider.js";
+import { DualRuntime_d_exports } from "./DualRuntime.js";
+import { AgentChannelConformance_d_exports } from "./AgentChannelConformance.js";
+import { DualRegistry_d_exports } from "./DualRegistry.js";
+import { Files_d_exports } from "./Files.js";
+import { Http_d_exports } from "./Http.js";
+import { Mcp_d_exports } from "./Mcp.js";
+import { OAuthFlow_d_exports } from "./OAuthFlow.js";
+import { PluginRuntime_d_exports } from "./PluginRuntime.js";
+import { ToolFile_d_exports } from "./ToolFile.js";
+import { remote_runtime_d_exports } from "./remote-runtime.js";
+export { Action_d_exports as Action, AgentChannel_d_exports as AgentChannel, AgentChannelConformance_d_exports as AgentChannelConformance, AgentChannelRuntime_d_exports as AgentChannelRuntime, AiProvider_d_exports as AiProvider, AuthMethod_d_exports as AuthMethod, AuthMethodBinding_d_exports as AuthMethodBinding, AuthMethodExecution_d_exports as AuthMethodExecution, ConnectionResolver_d_exports as ConnectionResolver, DefinitionError_d_exports as DefinitionError, DualRegistry_d_exports as DualRegistry, DualRuntime_d_exports as DualRuntime, Files_d_exports as Files, Group_d_exports as Group, Http_d_exports as Http, Mcp_d_exports as Mcp, OAuth2TokenRefresher_d_exports as OAuth2TokenRefresher, OAuthFlow_d_exports as OAuthFlow, Plugin_d_exports as Plugin, PluginRuntime_d_exports as PluginRuntime, remote_runtime_d_exports as RemoteRuntime, ToolFile_d_exports as ToolFile, Trigger_d_exports as Trigger };

package/dist/index.js

@@ -0,0 +1,24 @@
+import { DefinitionError_exports } from "./DefinitionError.js";
+import { Action_exports } from "./Action.js";
+import { AuthMethodBinding_exports } from "./AuthMethodBinding.js";
+import { OAuth2TokenRefresher_exports } from "./OAuth2TokenRefresher.js";
+import { AuthMethodExecution_exports } from "./AuthMethodExecution.js";
+import { AuthMethod_exports } from "./AuthMethod.js";
+import { ToolFile_exports } from "./ToolFile.js";
+import { AgentChannel_exports } from "./AgentChannel.js";
+import { ConnectionResolver_exports } from "./ConnectionResolver.js";
+import { AgentChannelRuntime_exports } from "./AgentChannelRuntime.js";
+import { AiProvider_exports } from "./AiProvider.js";
+import { DualRegistry_exports } from "./DualRegistry.js";
+import { Trigger_exports } from "./Trigger.js";
+import { DualRuntime_exports } from "./DualRuntime.js";
+import { AgentChannelConformance_exports } from "./AgentChannelConformance.js";
+import { Files_exports } from "./Files.js";
+import { Group_exports } from "./Group.js";
+import { Mcp_exports } from "./Mcp.js";
+import { Http_exports } from "./Http.js";
+import { OAuthFlow_exports } from "./OAuthFlow.js";
+import { Plugin_exports } from "./Plugin.js";
+import { remote_runtime_exports } from "./remote-runtime.js";
+import { PluginRuntime_exports } from "./PluginRuntime.js";
+export { Action_exports as Action, AgentChannel_exports as AgentChannel, AgentChannelConformance_exports as AgentChannelConformance, AgentChannelRuntime_exports as AgentChannelRuntime, AiProvider_exports as AiProvider, AuthMethod_exports as AuthMethod, AuthMethodBinding_exports as AuthMethodBinding, AuthMethodExecution_exports as AuthMethodExecution, ConnectionResolver_exports as ConnectionResolver, DefinitionError_exports as DefinitionError, DualRegistry_exports as DualRegistry, DualRuntime_exports as DualRuntime, Files_exports as Files, Group_exports as Group, Http_exports as Http, Mcp_exports as Mcp, OAuth2TokenRefresher_exports as OAuth2TokenRefresher, OAuthFlow_exports as OAuthFlow, Plugin_exports as Plugin, PluginRuntime_exports as PluginRuntime, remote_runtime_exports as RemoteRuntime, ToolFile_exports as ToolFile, Trigger_exports as Trigger };

package/dist/internal/auth-context.d.ts

@@ -0,0 +1,23 @@
+import { Context } from "../AuthMethodBinding.js";
+import { Any } from "../AuthMethod.js";
+//#region src/internal/auth-context.d.ts
+/**
+ * Runtime handler context for a known effective provider auth-method set.
+ *
+ * Empty method sets erase auth. Concrete non-empty tuples require auth. Widened
+ * arrays remain optional because their emptiness is not statically known.
+ */
+export type ContextForMethods<Methods extends readonly Any[]> = Methods extends readonly [] ? {} : number extends Methods["length"] ? {
+  readonly auth?: Context<Methods>;
+} : {
+  readonly auth: Context<Methods>;
+};
+/**
+ * Handler context for one contract. Auth is required only when the contract
+ * requires it for certain; `requireAuth: false` or an unknown flag keeps it optional.
+ */
+export type ContextForContract<Methods extends readonly Any[], RequireAuth> = [RequireAuth] extends [true] ? ContextForMethods<Methods> : Methods extends readonly [] ? {} : {
+  readonly auth?: Context<Methods>;
+};
+//#endregion
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/internal/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","names":["AuthMethod.Any","AuthMethodBinding.Context"],"sources":["../../src/internal/auth-context.ts"],"mappings":";;;;;;;;;YASY,kBAAkB,yBAAyBA,SACrD,kDAEmB;WACF,OAAOC,QAA0B;;WACjC,MAAMA,QAA0B;;;;;;YAMvC,mBAAmB,yBAAyBD,OAAkB,gBACxE,8BAEE,kBAAkB,WAClB;WAEa,OAAOC,QAA0B"}

package/dist/internal/auth-context.js

@@ -0,0 +1 @@
+export {};

package/dist/internal/auth-execution.d.ts

@@ -0,0 +1,27 @@
+import { BindingFor, Context as Context$1 } from "../AuthMethodBinding.js";
+import { Any, MaterialSchema, Requirements, SetupSchema, ValueSchema } from "../AuthMethod.js";
+import { ConnectionIdNotAllowedError, ConnectionReauthorizationRequiredError, ConnectionRequiredError, ConnectionResolutionContext, ConnectionResolverStoreError, ConnectionSelectionRequiredError, ConnectionTargetKind, InvalidConnectionIdError, InvalidResolvedConnectionError, Service } from "../ConnectionResolver.js";
+import { Effect, Schema } from "effect";
+//#region src/internal/auth-execution.d.ts
+export type NonEmptyReadonlyArray<A> = readonly [A, ...A[]];
+export type AuthSchemaRequirements<Methods extends readonly Any[]> = Methods[number] extends (infer Method) ? Method extends Any ? Schema.Codec.DecodingServices<ValueSchema<Method>> : never : never;
+/**
+ * Everything connection resolution may touch for one of the allowed methods:
+ * setup/material/value decoding plus the method's hook requirements.
+ *
+ * Hook dependencies are app-defined services a host cannot know about (a
+ * plugin's API client, a token issuer); surfacing them here keeps them in the
+ * requirement algebra so they are either discharged at the plugin/app
+ * definition via `provide` or demanded generically from whoever invokes.
+ */
+export type AuthResolutionRequirements<Methods extends readonly Any[]> = Methods[number] extends (infer Method) ? Method extends Any ? (SetupSchema<Method> extends Schema.Top ? Schema.Codec.DecodingServices<SetupSchema<Method>> : never) | Schema.Codec.DecodingServices<MaterialSchema<Method>> | Schema.Codec.DecodingServices<ValueSchema<Method>> | Requirements<Method> : never : never;
+export type RuntimeConnectionErrorsFor<Methods extends readonly Any[]> = ConnectionIdNotAllowedError | ([Methods[number]] extends [never] ? never : ConnectionRequiredError | ConnectionSelectionRequiredError | InvalidConnectionIdError | InvalidResolvedConnectionError | ConnectionReauthorizationRequiredError | ConnectionResolverStoreError);
+export declare const noAuthRuntimeContext: () => Record<never, never>;
+export declare const authRuntimeContext: <Methods extends readonly Any[]>(binding: BindingFor<Methods>) => {
+  readonly auth: Context$1<Methods>;
+};
+export declare const toNonEmptyArray: <A>(values: readonly A[]) => NonEmptyReadonlyArray<A> | undefined;
+export declare const failConnectionIdNotAllowed: (targetKind: ConnectionTargetKind, targetId: string, phase: string | undefined, providerId: string, connectionId: string) => Effect.Effect<never, ConnectionIdNotAllowedError>;
+export declare const resolveRuntimeConnection: <Methods extends NonEmptyReadonlyArray<Any>>(targetKind: ConnectionTargetKind, targetId: string, phase: string | undefined, providerId: string, methods: Methods, connectionId: string | undefined, context: ConnectionResolutionContext | undefined) => Effect.Effect<BindingFor<Methods>, ConnectionRequiredError | ConnectionSelectionRequiredError | InvalidConnectionIdError | InvalidResolvedConnectionError | ConnectionReauthorizationRequiredError | ConnectionResolverStoreError, Service | AuthSchemaRequirements<Methods> | AuthResolutionRequirements<Methods>>;
+//#endregion
+//# sourceMappingURL=auth-execution.d.ts.map

package/dist/internal/auth-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-execution.d.ts","names":["AuthMethod.Any","AuthMethod.ValueSchema","AuthMethod.SetupSchema","AuthMethod.MaterialSchema","AuthMethod.Requirements","AuthMethodBinding.BindingFor","AuthMethodBinding.Context","ConnectionResolver.Service"],"sources":["../../src/internal/auth-execution.ts"],"mappings":";;;;;YAqBY,sBAAsB,eAAe,MAAM;YAE3C,uBAAuB,yBAAyBA,SAC1D,+BAA8B,UAC1B,eAAeA,MACb,OAAO,MAAM,iBAAiBC,YAAuB;;;;;;;;;;YAajD,2BAA2B,yBAAyBD,SAC9D,+BAA8B,UAC1B,eAAeA,OAERE,YAAuB,gBAAgB,OAAO,MAC3C,OAAO,MAAM,iBAAiBA,YAAuB,oBAEzD,OAAO,MAAM,iBAAiBC,eAA0B,WACxD,OAAO,MAAM,iBAAiBF,YAAuB,WACrDG,aAAwB;YAIxB,2BAA2B,yBAAyBJ,SAC5D,gCACE,2CAGM,0BACA,mCACA,2BACA,iCACA,yCACA;qBA0DC,4BAA2B;qBAE3B,qBAAsB,yBAAyBA,OAAgB,SACjEK,WAA6B;WAC1B,MAAMC,UAA0B;;qBAEjC,kBAAmB,GAAC,iBAAmB,QAAM,sBAAsB;qBAGnE,6BAA0B,YACzB,sBAAoB,kBAChB,2BACS,oBACP,yBAEjB,OAAO,cAAc;qBAKX,2BAA2B,gBAAgB,sBAAsBN,MAC5E,YAAY,sBACZ,kBACA,2BACA,oBACA,SAAS,SACT,kCACA,SAAS,4CACN,OAAO,OACVK,WAA6B,UAC3B,0BACA,mCACA,2BACA,iCACA,yCACA,8BACFE,UAA6B,uBAAuB,WAAW,2BAA2B"}

package/dist/internal/auth-execution.js

@@ -0,0 +1,66 @@
+import { isBindingForMethod, makeBinding } from "../AuthMethodBinding.js";
+import { decodeSetup, resolveDecoded, resolveUnknown } from "../AuthMethodExecution.js";
+import { ConnectionIdNotAllowedError, InvalidResolvedConnectionError, Service } from "../ConnectionResolver.js";
+import { decodeJson } from "./schema-runtime.js";
+import { Effect } from "effect";
+//#region src/internal/auth-execution.ts
+const knownAuthMethodIds = (methods) => methods.map((method) => method.identifier);
+const fullAuthMethodId = (providerId, method) => `${providerId}/${method.identifier}`;
+const findMethod = (providerId, methods, methodId) => methods.find((method) => method.identifier === methodId || fullAuthMethodId(providerId, method) === methodId);
+const invalidResolvedAuth = (targetKind, targetId, phase, providerId, methodId, description) => new InvalidResolvedConnectionError({
+	description,
+	methodId,
+	phase,
+	providerId,
+	targetId,
+	targetKind
+});
+const makeAuthContext = (binding) => {
+	const context = {
+		current: binding,
+		is(methodOrBinding, maybeMethod) {
+			return maybeMethod === void 0 ? isBindingForMethod(context.current, methodOrBinding) : isBindingForMethod(methodOrBinding, maybeMethod);
+		},
+		match(cases) {
+			return cases[context.current.methodId](context.current);
+		}
+	};
+	return context;
+};
+const noAuthRuntimeContext = () => ({});
+const authRuntimeContext = (binding) => ({ auth: makeAuthContext(binding) });
+const toNonEmptyArray = (values) => values.length === 0 ? void 0 : [values[0], ...values.slice(1)];
+const failConnectionIdNotAllowed = (targetKind, targetId, phase, providerId, connectionId) => Effect.fail(new ConnectionIdNotAllowedError({
+	connectionId,
+	phase,
+	providerId,
+	targetId,
+	targetKind
+}));
+const resolveRuntimeConnection = (targetKind, targetId, phase, providerId, methods, connectionId, context) => Effect.gen(function* () {
+	const resolved = yield* (yield* Service).resolve({
+		target: {
+			providerId,
+			targetId,
+			targetKind,
+			...phase === void 0 ? {} : { phase }
+		},
+		...connectionId === void 0 ? {} : { connectionId },
+		...context === void 0 ? {} : { context }
+	});
+	if (resolved.providerId !== providerId) return yield* invalidResolvedAuth(targetKind, targetId, phase, providerId, resolved.methodId, `expected provider "${providerId}", got "${resolved.providerId}"`);
+	const method = findMethod(providerId, methods, resolved.methodId);
+	if (method === void 0) return yield* invalidResolvedAuth(targetKind, targetId, phase, providerId, resolved.methodId, `method "${resolved.methodId}" is not registered for provider "${providerId}"; known methods: ${knownAuthMethodIds(methods).join(", ")}`);
+	const setup = yield* (resolved.encoding === "json" && method.setup !== void 0 ? decodeJson(method.setup, resolved.setup) : decodeSetup(method, resolved.setup)).pipe(Effect.mapError((error) => invalidResolvedAuth(targetKind, targetId, phase, providerId, method.identifier, error.message)));
+	const value = yield* (resolved.encoding === "json" ? decodeJson(method.material, resolved.material).pipe(Effect.flatMap((material) => resolveDecoded(method, material, { setup }))) : resolveUnknown(method, resolved.material, { setup })).pipe(Effect.mapError((error) => invalidResolvedAuth(targetKind, targetId, phase, providerId, method.identifier, error instanceof Error ? error.message : String(error))));
+	return makeBinding({
+		connectionId: resolved.connectionId,
+		method,
+		providerId,
+		value
+	});
+});
+//#endregion
+export { authRuntimeContext, failConnectionIdNotAllowed, noAuthRuntimeContext, resolveRuntimeConnection, toNonEmptyArray };
+
+//# sourceMappingURL=auth-execution.js.map

package/dist/internal/auth-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-execution.js","names":["AuthMethodBinding.isBindingForMethod","ConnectionResolver.Service","AuthMethodExecution.decodeSetup","AuthMethodExecution.resolveDecoded","AuthMethodExecution.resolveUnknown","AuthMethodBinding.makeBinding"],"sources":["../../src/internal/auth-execution.ts"],"sourcesContent":["import type { Schema } from \"effect\";\nimport { Effect } from \"effect\";\n\nimport type * as AuthMethod from \"../AuthMethod.ts\";\nimport * as AuthMethodBinding from \"../AuthMethodBinding.ts\";\nimport * as AuthMethodExecution from \"../AuthMethodExecution.ts\";\nimport {\n  type ConnectionReauthorizationRequiredError,\n  type ConnectionRequiredError,\n  type ConnectionSelectionRequiredError,\n  type ConnectionResolverStoreError,\n  type InvalidConnectionIdError,\n  ConnectionIdNotAllowedError,\n  ConnectionResolver,\n  type ConnectionResolutionContext,\n  type ConnectionTargetKind,\n  InvalidResolvedConnectionError,\n} from \"../ConnectionResolver.ts\";\n\nimport { decodeJson } from \"./schema-runtime.ts\";\n\nexport type NonEmptyReadonlyArray<A> = readonly [A, ...A[]];\n\nexport type AuthSchemaRequirements<Methods extends readonly AuthMethod.Any[]> =\n  Methods[number] extends infer Method\n    ? Method extends AuthMethod.Any\n      ? Schema.Codec.DecodingServices<AuthMethod.ValueSchema<Method>>\n      : never\n    : never;\n\n/**\n * Everything connection resolution may touch for one of the allowed methods:\n * setup/material/value decoding plus the method's hook requirements.\n *\n * Hook dependencies are app-defined services a host cannot know about (a\n * plugin's API client, a token issuer); surfacing them here keeps them in the\n * requirement algebra so they are either discharged at the plugin/app\n * definition via `provide` or demanded generically from whoever invokes.\n */\nexport type AuthResolutionRequirements<Methods extends readonly AuthMethod.Any[]> =\n  Methods[number] extends infer Method\n    ? Method extends AuthMethod.Any\n      ?\n          | (AuthMethod.SetupSchema<Method> extends Schema.Top\n              ? Schema.Codec.DecodingServices<AuthMethod.SetupSchema<Method>>\n              : never)\n          | Schema.Codec.DecodingServices<AuthMethod.MaterialSchema<Method>>\n          | Schema.Codec.DecodingServices<AuthMethod.ValueSchema<Method>>\n          | AuthMethod.Requirements<Method>\n      : never\n    : never;\n\nexport type RuntimeConnectionErrorsFor<Methods extends readonly AuthMethod.Any[]> =\n  | ConnectionIdNotAllowedError\n  | ([Methods[number]] extends [never]\n      ? never\n      :\n          | ConnectionRequiredError\n          | ConnectionSelectionRequiredError\n          | InvalidConnectionIdError\n          | InvalidResolvedConnectionError\n          | ConnectionReauthorizationRequiredError\n          | ConnectionResolverStoreError);\n\nconst knownAuthMethodIds = (methods: readonly AuthMethod.Any[]) =>\n  methods.map(method => method.identifier);\n\nconst fullAuthMethodId = (providerId: string, method: AuthMethod.Any): string =>\n  `${providerId}/${method.identifier}`;\n\nconst findMethod = (\n  providerId: string,\n  methods: readonly AuthMethod.Any[],\n  methodId: string,\n): AuthMethod.Any | undefined =>\n  methods.find(\n    method => method.identifier === methodId || fullAuthMethodId(providerId, method) === methodId,\n  );\n\nconst invalidResolvedAuth = (\n  targetKind: ConnectionTargetKind,\n  targetId: string,\n  phase: string | undefined,\n  providerId: string,\n  methodId: string,\n  description: string,\n): InvalidResolvedConnectionError =>\n  new InvalidResolvedConnectionError({\n    description,\n    methodId,\n    phase,\n    providerId,\n    targetId,\n    targetKind,\n  });\n\nconst makeAuthContext: <Methods extends readonly AuthMethod.Any[]>(\n  binding: AuthMethodBinding.BindingFor<Methods>,\n) => AuthMethodBinding.Context<Methods> = (binding: AuthMethodBinding.Binding) => {\n  const context = {\n    current: binding,\n    is(\n      methodOrBinding: AuthMethod.Any | AuthMethodBinding.Binding,\n      maybeMethod?: AuthMethod.Any,\n    ): boolean {\n      return maybeMethod === undefined\n        ? AuthMethodBinding.isBindingForMethod(context.current, methodOrBinding as AuthMethod.Any)\n        : AuthMethodBinding.isBindingForMethod(\n            methodOrBinding as AuthMethodBinding.Binding,\n            maybeMethod,\n          );\n    },\n    match(cases: Record<string, (binding: AuthMethodBinding.Binding) => unknown>) {\n      return cases[context.current.methodId]!(context.current);\n    },\n  };\n\n  return context as never;\n};\n\nexport const noAuthRuntimeContext = (): Record<never, never> => ({});\n\nexport const authRuntimeContext = <Methods extends readonly AuthMethod.Any[]>(\n  binding: AuthMethodBinding.BindingFor<Methods>,\n): { readonly auth: AuthMethodBinding.Context<Methods> } => ({ auth: makeAuthContext(binding) });\n\nexport const toNonEmptyArray = <A>(values: readonly A[]): NonEmptyReadonlyArray<A> | undefined =>\n  values.length === 0 ? undefined : [values[0]!, ...values.slice(1)];\n\nexport const failConnectionIdNotAllowed = (\n  targetKind: ConnectionTargetKind,\n  targetId: string,\n  phase: string | undefined,\n  providerId: string,\n  connectionId: string,\n): Effect.Effect<never, ConnectionIdNotAllowedError> =>\n  Effect.fail(\n    new ConnectionIdNotAllowedError({ connectionId, phase, providerId, targetId, targetKind }),\n  );\n\nexport const resolveRuntimeConnection: <Methods extends NonEmptyReadonlyArray<AuthMethod.Any>>(\n  targetKind: ConnectionTargetKind,\n  targetId: string,\n  phase: string | undefined,\n  providerId: string,\n  methods: Methods,\n  connectionId: string | undefined,\n  context: ConnectionResolutionContext | undefined,\n) => Effect.Effect<\n  AuthMethodBinding.BindingFor<Methods>,\n  | ConnectionRequiredError\n  | ConnectionSelectionRequiredError\n  | InvalidConnectionIdError\n  | InvalidResolvedConnectionError\n  | ConnectionReauthorizationRequiredError\n  | ConnectionResolverStoreError,\n  ConnectionResolver.Service | AuthSchemaRequirements<Methods> | AuthResolutionRequirements<Methods>\n> = (\n  targetKind: ConnectionTargetKind,\n  targetId: string,\n  phase: string | undefined,\n  providerId: string,\n  methods: NonEmptyReadonlyArray<AuthMethod.Any>,\n  connectionId: string | undefined,\n  context: ConnectionResolutionContext | undefined,\n) =>\n  Effect.gen(function* () {\n    const resolver = yield* ConnectionResolver.Service;\n    const resolved = yield* resolver.resolve({\n      target: { providerId, targetId, targetKind, ...(phase === undefined ? {} : { phase }) },\n      ...(connectionId === undefined ? {} : { connectionId }),\n      ...(context === undefined ? {} : { context }),\n    });\n\n    if (resolved.providerId !== providerId) {\n      return yield* invalidResolvedAuth(\n        targetKind,\n        targetId,\n        phase,\n        providerId,\n        resolved.methodId,\n        `expected provider \"${providerId}\", got \"${resolved.providerId}\"`,\n      );\n    }\n\n    const method = findMethod(providerId, methods, resolved.methodId);\n    if (method === undefined) {\n      return yield* invalidResolvedAuth(\n        targetKind,\n        targetId,\n        phase,\n        providerId,\n        resolved.methodId,\n        `method \"${resolved.methodId}\" is not registered for provider \"${providerId}\"; known methods: ${knownAuthMethodIds(methods).join(\", \")}`,\n      );\n    }\n\n    const setup = yield* (\n      resolved.encoding === \"json\" && method.setup !== undefined\n        ? decodeJson(method.setup, resolved.setup)\n        : AuthMethodExecution.decodeSetup(method, resolved.setup)\n    ).pipe(\n      Effect.mapError(error =>\n        invalidResolvedAuth(\n          targetKind,\n          targetId,\n          phase,\n          providerId,\n          method.identifier,\n          error.message,\n        ),\n      ),\n    );\n    const value = yield* (\n      resolved.encoding === \"json\"\n        ? decodeJson(method.material, resolved.material).pipe(\n            Effect.flatMap(material =>\n              AuthMethodExecution.resolveDecoded(method, material, { setup }),\n            ),\n          )\n        : AuthMethodExecution.resolveUnknown(method, resolved.material, { setup })\n    ).pipe(\n      Effect.mapError(error =>\n        invalidResolvedAuth(\n          targetKind,\n          targetId,\n          phase,\n          providerId,\n          method.identifier,\n          error instanceof Error ? error.message : String(error),\n        ),\n      ),\n    );\n\n    return AuthMethodBinding.makeBinding({\n      connectionId: resolved.connectionId,\n      method,\n      providerId,\n      value,\n    });\n  }) as never;\n"],"mappings":";;;;;;AAgEA,MAAM,sBAAsB,YAC1B,QAAQ,KAAI,WAAU,OAAO,UAAU;AAEzC,MAAM,oBAAoB,YAAoB,WAC5C,GAAG,WAAW,GAAG,OAAO;AAE1B,MAAM,cACJ,YACA,SACA,aAEA,QAAQ,MACN,WAAU,OAAO,eAAe,YAAY,iBAAiB,YAAY,MAAM,MAAM,QACvF;AAEF,MAAM,uBACJ,YACA,UACA,OACA,YACA,UACA,gBAEA,IAAI,+BAA+B;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAEH,MAAM,mBAEqC,YAAuC;CAChF,MAAM,UAAU;EACd,SAAS;EACT,GACE,iBACA,aACS;GACT,OAAO,gBAAgB,KAAA,IACnBA,mBAAqC,QAAQ,SAAS,eAAiC,IACvFA,mBACE,iBACA,WACF;EACN;EACA,MAAM,OAAwE;GAC5E,OAAO,MAAM,QAAQ,QAAQ,SAAS,CAAE,QAAQ,OAAO;EACzD;CACF;CAEA,OAAO;AACT;AAEA,MAAa,8BAAoD,CAAC;AAElE,MAAa,sBACX,aAC2D,EAAE,MAAM,gBAAgB,OAAO,EAAE;AAE9F,MAAa,mBAAsB,WACjC,OAAO,WAAW,IAAI,KAAA,IAAY,CAAC,OAAO,IAAK,GAAG,OAAO,MAAM,CAAC,CAAC;AAEnE,MAAa,8BACX,YACA,UACA,OACA,YACA,iBAEA,OAAO,KACL,IAAI,4BAA4B;CAAE;CAAc;CAAO;CAAY;CAAU;AAAW,CAAC,CAC3F;AAEF,MAAa,4BAkBX,YACA,UACA,OACA,YACA,SACA,cACA,YAEA,OAAO,IAAI,aAAa;CAEtB,MAAM,WAAW,QAAO,OADAC,QAAAA,CACS,QAAQ;EACvC,QAAQ;GAAE;GAAY;GAAU;GAAY,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;EACtF,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACrD,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;CAC7C,CAAC;CAED,IAAI,SAAS,eAAe,YAC1B,OAAO,OAAO,oBACZ,YACA,UACA,OACA,YACA,SAAS,UACT,sBAAsB,WAAW,UAAU,SAAS,WAAW,EACjE;CAGF,MAAM,SAAS,WAAW,YAAY,SAAS,SAAS,QAAQ;CAChE,IAAI,WAAW,KAAA,GACb,OAAO,OAAO,oBACZ,YACA,UACA,OACA,YACA,SAAS,UACT,WAAW,SAAS,SAAS,oCAAoC,WAAW,oBAAoB,mBAAmB,OAAO,CAAC,CAAC,KAAK,IAAI,GACvI;CAGF,MAAM,QAAQ,QACZ,SAAS,aAAa,UAAU,OAAO,UAAU,KAAA,IAC7C,WAAW,OAAO,OAAO,SAAS,KAAK,IACvCC,YAAgC,QAAQ,SAAS,KAAK,EAAA,CAC1D,KACA,OAAO,UAAS,UACd,oBACE,YACA,UACA,OACA,YACA,OAAO,YACP,MAAM,OACR,CACF,CACF;CACA,MAAM,QAAQ,QACZ,SAAS,aAAa,SAClB,WAAW,OAAO,UAAU,SAAS,QAAQ,CAAC,CAAC,KAC7C,OAAO,SAAQ,aACbC,eAAmC,QAAQ,UAAU,EAAE,MAAM,CAAC,CAChE,CACF,IACAC,eAAmC,QAAQ,SAAS,UAAU,EAAE,MAAM,CAAC,EAAA,CAC3E,KACA,OAAO,UAAS,UACd,oBACE,YACA,UACA,OACA,YACA,OAAO,YACP,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD,CACF,CACF;CAEA,OAAOC,YAA8B;EACnC,cAAc,SAAS;EACvB;EACA;EACA;CACF,CAAC;AACH,CAAC"}

package/dist/internal/auth-runtime.d.ts

@@ -0,0 +1,5 @@
+import { Any } from "../AuthMethod.js";
+//#region src/internal/auth-runtime.d.ts
+export declare const assertNoDuplicateAuthMethodIdentifiers: (providerIdentifier: string, methods: readonly Any[]) => void;
+//#endregion
+//# sourceMappingURL=auth-runtime.d.ts.map

package/dist/internal/auth-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.d.ts","names":["AuthMethod.Any"],"sources":["../../src/internal/auth-runtime.ts"],"mappings":";;qBAGa,yCAAsC,4BACvB,kBACRA"}

package/dist/internal/auth-runtime.js

@@ -0,0 +1,16 @@
+import { DuplicateAuthMethodIdentifierError } from "../DefinitionError.js";
+//#region src/internal/auth-runtime.ts
+const assertNoDuplicateAuthMethodIdentifiers = (providerIdentifier, methods) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const method of methods) {
+		if (seen.has(method.identifier)) throw new DuplicateAuthMethodIdentifierError({
+			identifier: method.identifier,
+			providerIdentifier
+		});
+		seen.add(method.identifier);
+	}
+};
+//#endregion
+export { assertNoDuplicateAuthMethodIdentifiers };
+
+//# sourceMappingURL=auth-runtime.js.map

package/dist/internal/auth-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.js","names":[],"sources":["../../src/internal/auth-runtime.ts"],"sourcesContent":["import type * as AuthMethod from \"../AuthMethod.ts\";\nimport { DuplicateAuthMethodIdentifierError } from \"../DefinitionError.ts\";\n\nexport const assertNoDuplicateAuthMethodIdentifiers = (\n  providerIdentifier: string,\n  methods: readonly AuthMethod.Any[],\n): void => {\n  const seen = new Set<string>();\n\n  for (const method of methods) {\n    if (seen.has(method.identifier)) {\n      throw new DuplicateAuthMethodIdentifierError({\n        identifier: method.identifier,\n        providerIdentifier,\n      });\n    }\n\n    seen.add(method.identifier);\n  }\n};\n"],"mappings":";;AAGA,MAAa,0CACX,oBACA,YACS;CACT,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,KAAK,IAAI,OAAO,UAAU,GAC5B,MAAM,IAAI,mCAAmC;GAC3C,YAAY,OAAO;GACnB;EACF,CAAC;EAGH,KAAK,IAAI,OAAO,UAAU;CAC5B;AACF"}

package/dist/internal/capabilities.d.ts

@@ -0,0 +1,24 @@
+import { Any } from "../Action.js";
+import { Any as Any$1 } from "../Trigger.js";
+import { Any as Any$2 } from "../Group.js";
+//#region src/internal/capabilities.d.ts
+type StructuralOwner = {
+  readonly groups: readonly Any$2[];
+  readonly actions: readonly Any[];
+  readonly triggers: readonly Any$1[];
+};
+export type WalkedCapability<Node> = {
+  /** Machine id relative to the provider (group path included). */
+  readonly localId: string;
+  /** Machine id including the provider prefix. */
+  readonly canonicalId: string;
+  readonly node: Node;
+};
+export declare const walkCapabilities: <Node extends {
+  readonly identifier: string;
+}>(provider: StructuralOwner & {
+  readonly identifier: string;
+}, select: (owner: StructuralOwner) => readonly Node[]) => readonly WalkedCapability<Node>[];
+//#endregion
+export {};
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/internal/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","names":["Group.Any","Action.Any","Trigger.Any"],"sources":["../../src/internal/capabilities.ts"],"mappings":";;;;KAaK;WACM,iBAAiBA;WACjB,kBAAkBC;WAClB,mBAAmBC;;YAGlB,iBAAiB;;WAElB;;WAEA;WACA,MAAM;;qBAGJ,mBAAoB;WAAwB;GAAoB,UACjE;WAA6B;GAAoB,SAClD,OAAO,6BAA6B,oBACnC,iBAAiB"}

package/dist/internal/capabilities.js

@@ -0,0 +1,22 @@
+import "./identifier.js";
+//#region src/internal/capabilities.ts
+const walkCapabilities = (provider, select) => {
+	const entries = [];
+	const visit = (owner, prefix) => {
+		for (const node of select(owner)) {
+			const localId = prefix === "" ? node.identifier : `${prefix}/${node.identifier}`;
+			entries.push({
+				canonicalId: `${provider.identifier}/${localId}`,
+				localId,
+				node
+			});
+		}
+		for (const group of owner.groups) visit(group, prefix === "" ? group.identifier : `${prefix}/${group.identifier}`);
+	};
+	visit(provider, "");
+	return entries;
+};
+//#endregion
+export { walkCapabilities };
+
+//# sourceMappingURL=capabilities.js.map

package/dist/internal/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","names":[],"sources":["../../src/internal/capabilities.ts"],"sourcesContent":["/**\n * Shared provider-tree traversal for capability nodes.\n *\n * Actions and triggers live in the same structural tree (provider -> nested\n * groups) and need identical machine-id derivation, so the recursive walk\n * lives here once and callers pick the node kind via `select`.\n */\nimport type * as Action from \"../Action.ts\";\nimport type * as Group from \"../Group.ts\";\nimport type * as Trigger from \"../Trigger.ts\";\n\nimport { MachineIdSeparator } from \"./identifier.ts\";\n\ntype StructuralOwner = {\n  readonly groups: readonly Group.Any[];\n  readonly actions: readonly Action.Any[];\n  readonly triggers: readonly Trigger.Any[];\n};\n\nexport type WalkedCapability<Node> = {\n  /** Machine id relative to the provider (group path included). */\n  readonly localId: string;\n  /** Machine id including the provider prefix. */\n  readonly canonicalId: string;\n  readonly node: Node;\n};\n\nexport const walkCapabilities = <Node extends { readonly identifier: string }>(\n  provider: StructuralOwner & { readonly identifier: string },\n  select: (owner: StructuralOwner) => readonly Node[],\n): readonly WalkedCapability<Node>[] => {\n  const entries: WalkedCapability<Node>[] = [];\n\n  const visit = (owner: StructuralOwner, prefix: string): void => {\n    for (const node of select(owner)) {\n      const localId =\n        prefix === \"\" ? node.identifier : `${prefix}${MachineIdSeparator}${node.identifier}`;\n      entries.push({\n        canonicalId: `${provider.identifier}${MachineIdSeparator}${localId}`,\n        localId,\n        node,\n      });\n    }\n\n    for (const group of owner.groups) {\n      visit(\n        group,\n        prefix === \"\" ? group.identifier : `${prefix}${MachineIdSeparator}${group.identifier}`,\n      );\n    }\n  };\n\n  visit(provider, \"\");\n  return entries;\n};\n"],"mappings":";;AA2BA,MAAa,oBACX,UACA,WACsC;CACtC,MAAM,UAAoC,CAAC;CAE3C,MAAM,SAAS,OAAwB,WAAyB;EAC9D,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG;GAChC,MAAM,UACJ,WAAW,KAAK,KAAK,aAAa,GAAG,UAA8B,KAAK;GAC1E,QAAQ,KAAK;IACX,aAAa,GAAG,SAAS,cAAkC;IAC3D;IACA;GACF,CAAC;EACH;EAEA,KAAK,MAAM,SAAS,MAAM,QACxB,MACE,OACA,WAAW,KAAK,MAAM,aAAa,GAAG,UAA8B,MAAM,YAC5E;CAEJ;CAEA,MAAM,UAAU,EAAE;CAClB,OAAO;AACT"}

package/dist/internal/children.d.ts

@@ -0,0 +1,34 @@
+import { Any } from "../Action.js";
+import { Any as Any$1 } from "../Trigger.js";
+import { Any as Any$2 } from "../Group.js";
+//#region src/internal/children.d.ts
+export type StructuralChild = Any$2 | Any | Any$1;
+export type StructuralChildKind = "group" | "action" | "trigger" | "agent-channel";
+/**
+ * Keep the children assignable to `Target`, preserving tuple order.
+ */
+export type FilterChildren<Children extends readonly StructuralChild[], Target> = Children extends readonly [infer Head, ...infer Tail extends readonly StructuralChild[]] ? Head extends Target ? readonly [Head, ...FilterChildren<Tail, Target>] : FilterChildren<Tail, Target> : readonly [];
+export type PartitionedChildren = {
+  readonly groups: readonly Any$2[];
+  readonly actions: readonly Any[];
+  readonly triggers: readonly Any$1[];
+};
+export declare const partitionChildren: (children: readonly StructuralChild[]) => PartitionedChildren;
+type IdentifiedChild = {
+  readonly identifier: string;
+};
+type ExistingChildren = {
+  readonly groups: readonly IdentifiedChild[];
+  readonly actions: readonly IdentifiedChild[];
+  readonly triggers: readonly IdentifiedChild[];
+  readonly agentChannels?: readonly IdentifiedChild[];
+};
+export declare const assertUniqueStructuralChildIdentifiers: (ownerKind: "group" | "plugin", ownerIdentifier: string, existing: ExistingChildren, additions: readonly IdentifiedChild[], childKind: StructuralChildKind) => void;
+/**
+ * Mixed-kind variant used by `add`: additions are checked in declaration order
+ * so a collision between two added children of different kinds is still caught.
+ */
+export declare const assertUniqueMixedChildIdentifiers: (ownerKind: "group" | "plugin", ownerIdentifier: string, existing: ExistingChildren, additions: readonly StructuralChild[]) => void;
+//#endregion
+export {};
+//# sourceMappingURL=children.d.ts.map

package/dist/internal/children.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"children.d.ts","names":["Group.Any","Action.Any","Trigger.Any"],"sources":["../../src/internal/children.ts"],"mappings":";;;;YAYY,kBAAkBA,QAAYC,MAAaC;YAE3C;;;;YAKA,eACV,0BAA0B,mBAC1B,UACE,iCAAiC,eAAe,sBAAsB,qBACtE,aAAa,mBACD,SAAS,eAAe,MAAM,WACxC,eAAe,MAAM;YAGf;WACD,iBAAiBF;WACjB,kBAAkBC;WAClB,mBAAmBC;;qBAGjB,oBAAiB,mBAAuB,sBAAoB;KASpE;WAA6B;;KAE7B;WACM,iBAAiB;WACjB,kBAAkB;WAClB,mBAAmB;WACnB,yBAAyB;;qBA6CvB,yCAAsC,+BACpB,yBACN,UACb,kBAAgB,oBACN,mBAAiB,WAC1B;;;;;qBAcA,oCAAiC,+BACf,yBACN,UACb,kBAAgB,oBACN"}

package/dist/internal/children.js

@@ -0,0 +1,53 @@
+import { BuilderCollisionError } from "../DefinitionError.js";
+import { isAction } from "../Action.js";
+import { isTrigger } from "../Trigger.js";
+import { isGroup } from "../Group.js";
+//#region src/internal/children.ts
+/**
+* Shared structural-children machinery for Group and Plugin builders.
+*
+* Both owners accept the same mixed child set (groups, actions, triggers) and
+* need identical type-level partitioning, runtime partitioning, and collision
+* checks, so the logic lives here once.
+*/
+const partitionChildren = (children) => ({
+	actions: children.filter(isAction),
+	groups: children.filter(isGroup),
+	triggers: children.filter(isTrigger)
+});
+const childKind = (child) => isGroup(child) ? "group" : isAction(child) ? "action" : "trigger";
+const seenChildren = (existing) => {
+	const seen = /* @__PURE__ */ new Map();
+	for (const group of existing.groups) seen.set(group.identifier, "group");
+	for (const action of existing.actions) seen.set(action.identifier, "action");
+	for (const trigger of existing.triggers) seen.set(trigger.identifier, "trigger");
+	for (const channel of existing.agentChannels ?? []) seen.set(channel.identifier, "agent-channel");
+	return seen;
+};
+const assertAdditions = (ownerKind, ownerIdentifier, seen, additions) => {
+	for (const [addition, kind] of additions) {
+		const existingChildKind = seen.get(addition.identifier);
+		if (existingChildKind !== void 0) throw new BuilderCollisionError({
+			childKind: kind,
+			existingChildKind,
+			identifier: addition.identifier,
+			ownerIdentifier,
+			ownerKind
+		});
+		seen.set(addition.identifier, kind);
+	}
+};
+const assertUniqueStructuralChildIdentifiers = (ownerKind, ownerIdentifier, existing, additions, childKind) => {
+	assertAdditions(ownerKind, ownerIdentifier, seenChildren(existing), additions.map((addition) => [addition, childKind]));
+};
+/**
+* Mixed-kind variant used by `add`: additions are checked in declaration order
+* so a collision between two added children of different kinds is still caught.
+*/
+const assertUniqueMixedChildIdentifiers = (ownerKind, ownerIdentifier, existing, additions) => {
+	assertAdditions(ownerKind, ownerIdentifier, seenChildren(existing), additions.map((addition) => [addition, childKind(addition)]));
+};
+//#endregion
+export { assertUniqueMixedChildIdentifiers, assertUniqueStructuralChildIdentifiers, partitionChildren };
+
+//# sourceMappingURL=children.js.map

package/dist/internal/children.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"children.js","names":["Action.isAction","Group.isGroup","Trigger.isTrigger"],"sources":["../../src/internal/children.ts"],"sourcesContent":["/**\n * Shared structural-children machinery for Group and Plugin builders.\n *\n * Both owners accept the same mixed child set (groups, actions, triggers) and\n * need identical type-level partitioning, runtime partitioning, and collision\n * checks, so the logic lives here once.\n */\nimport * as Action from \"../Action.ts\";\nimport { BuilderCollisionError } from \"../DefinitionError.ts\";\nimport * as Group from \"../Group.ts\";\nimport * as Trigger from \"../Trigger.ts\";\n\nexport type StructuralChild = Group.Any | Action.Any | Trigger.Any;\n\nexport type StructuralChildKind = \"group\" | \"action\" | \"trigger\" | \"agent-channel\";\n\n/**\n * Keep the children assignable to `Target`, preserving tuple order.\n */\nexport type FilterChildren<\n  Children extends readonly StructuralChild[],\n  Target,\n> = Children extends readonly [infer Head, ...infer Tail extends readonly StructuralChild[]]\n  ? Head extends Target\n    ? readonly [Head, ...FilterChildren<Tail, Target>]\n    : FilterChildren<Tail, Target>\n  : readonly [];\n\nexport type PartitionedChildren = {\n  readonly groups: readonly Group.Any[];\n  readonly actions: readonly Action.Any[];\n  readonly triggers: readonly Trigger.Any[];\n};\n\nexport const partitionChildren = (children: readonly StructuralChild[]): PartitionedChildren => ({\n  actions: children.filter(Action.isAction),\n  groups: children.filter(Group.isGroup),\n  triggers: children.filter(Trigger.isTrigger),\n});\n\nconst childKind = (child: StructuralChild): StructuralChildKind =>\n  Group.isGroup(child) ? \"group\" : Action.isAction(child) ? \"action\" : \"trigger\";\n\ntype IdentifiedChild = { readonly identifier: string };\n\ntype ExistingChildren = {\n  readonly groups: readonly IdentifiedChild[];\n  readonly actions: readonly IdentifiedChild[];\n  readonly triggers: readonly IdentifiedChild[];\n  readonly agentChannels?: readonly IdentifiedChild[];\n};\n\nconst seenChildren = (existing: ExistingChildren): Map<string, StructuralChildKind> => {\n  const seen = new Map<string, StructuralChildKind>();\n\n  for (const group of existing.groups) {\n    seen.set(group.identifier, \"group\");\n  }\n\n  for (const action of existing.actions) {\n    seen.set(action.identifier, \"action\");\n  }\n\n  for (const trigger of existing.triggers) {\n    seen.set(trigger.identifier, \"trigger\");\n  }\n\n  for (const channel of existing.agentChannels ?? []) seen.set(channel.identifier, \"agent-channel\");\n  return seen;\n};\n\nconst assertAdditions = (\n  ownerKind: \"group\" | \"plugin\",\n  ownerIdentifier: string,\n  seen: Map<string, StructuralChildKind>,\n  additions: readonly (readonly [IdentifiedChild, StructuralChildKind])[],\n): void => {\n  for (const [addition, kind] of additions) {\n    const existingChildKind = seen.get(addition.identifier);\n\n    if (existingChildKind !== undefined) {\n      throw new BuilderCollisionError({\n        childKind: kind,\n        existingChildKind,\n        identifier: addition.identifier,\n        ownerIdentifier,\n        ownerKind,\n      });\n    }\n\n    seen.set(addition.identifier, kind);\n  }\n};\n\nexport const assertUniqueStructuralChildIdentifiers = (\n  ownerKind: \"group\" | \"plugin\",\n  ownerIdentifier: string,\n  existing: ExistingChildren,\n  additions: readonly IdentifiedChild[],\n  childKind: StructuralChildKind,\n): void => {\n  assertAdditions(\n    ownerKind,\n    ownerIdentifier,\n    seenChildren(existing),\n    additions.map(addition => [addition, childKind] as const),\n  );\n};\n\n/**\n * Mixed-kind variant used by `add`: additions are checked in declaration order\n * so a collision between two added children of different kinds is still caught.\n */\nexport const assertUniqueMixedChildIdentifiers = (\n  ownerKind: \"group\" | \"plugin\",\n  ownerIdentifier: string,\n  existing: ExistingChildren,\n  additions: readonly StructuralChild[],\n): void => {\n  assertAdditions(\n    ownerKind,\n    ownerIdentifier,\n    seenChildren(existing),\n    additions.map(addition => [addition, childKind(addition)] as const),\n  );\n};\n"],"mappings":";;;;;;;;;;;;AAkCA,MAAa,qBAAqB,cAA+D;CAC/F,SAAS,SAAS,OAAOA,QAAe;CACxC,QAAQ,SAAS,OAAOC,OAAa;CACrC,UAAU,SAAS,OAAOC,SAAiB;AAC7C;AAEA,MAAM,aAAa,UACjBD,QAAc,KAAK,IAAI,UAAUD,SAAgB,KAAK,IAAI,WAAW;AAWvE,MAAM,gBAAgB,aAAiE;CACrF,MAAM,uBAAO,IAAI,IAAiC;CAElD,KAAK,MAAM,SAAS,SAAS,QAC3B,KAAK,IAAI,MAAM,YAAY,OAAO;CAGpC,KAAK,MAAM,UAAU,SAAS,SAC5B,KAAK,IAAI,OAAO,YAAY,QAAQ;CAGtC,KAAK,MAAM,WAAW,SAAS,UAC7B,KAAK,IAAI,QAAQ,YAAY,SAAS;CAGxC,KAAK,MAAM,WAAW,SAAS,iBAAiB,CAAC,GAAG,KAAK,IAAI,QAAQ,YAAY,eAAe;CAChG,OAAO;AACT;AAEA,MAAM,mBACJ,WACA,iBACA,MACA,cACS;CACT,KAAK,MAAM,CAAC,UAAU,SAAS,WAAW;EACxC,MAAM,oBAAoB,KAAK,IAAI,SAAS,UAAU;EAEtD,IAAI,sBAAsB,KAAA,GACxB,MAAM,IAAI,sBAAsB;GAC9B,WAAW;GACX;GACA,YAAY,SAAS;GACrB;GACA;EACF,CAAC;EAGH,KAAK,IAAI,SAAS,YAAY,IAAI;CACpC;AACF;AAEA,MAAa,0CACX,WACA,iBACA,UACA,WACA,cACS;CACT,gBACE,WACA,iBACA,aAAa,QAAQ,GACrB,UAAU,KAAI,aAAY,CAAC,UAAU,SAAS,CAAU,CAC1D;AACF;;;;;AAMA,MAAa,qCACX,WACA,iBACA,UACA,cACS;CACT,gBACE,WACA,iBACA,aAAa,QAAQ,GACrB,UAAU,KAAI,aAAY,CAAC,UAAU,UAAU,QAAQ,CAAC,CAAU,CACpE;AACF"}

package/dist/internal/collection-utils.d.ts

@@ -0,0 +1,4 @@
+//#region src/internal/collection-utils.d.ts
+export declare const appendElements: <Existing extends readonly unknown[], Added extends readonly unknown[]>(existing: Existing, additions: Added) => readonly [...Existing, ...Added];
+//#endregion
+//# sourceMappingURL=collection-utils.d.ts.map

package/dist/internal/collection-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-utils.d.ts","names":[],"sources":["../../src/internal/collection-utils.ts"],"mappings":";qBAAa,iBACX,qCACA,kCAAgC,UAEtB,UAAQ,WACP,uBACG,aAAa"}

package/dist/internal/collection-utils.js

@@ -0,0 +1,6 @@
+//#region src/internal/collection-utils.ts
+const appendElements = (existing, additions) => [...existing, ...additions];
+//#endregion
+export { appendElements };
+
+//# sourceMappingURL=collection-utils.js.map

package/dist/internal/collection-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-utils.js","names":[],"sources":["../../src/internal/collection-utils.ts"],"sourcesContent":["export const appendElements = <\n  Existing extends readonly unknown[],\n  Added extends readonly unknown[],\n>(\n  existing: Existing,\n  additions: Added,\n): readonly [...Existing, ...Added] =>\n  [...existing, ...additions] as readonly [...Existing, ...Added];\n"],"mappings":";AAAA,MAAa,kBAIX,UACA,cAEA,CAAC,GAAG,UAAU,GAAG,SAAS"}

package/dist/internal/dual/actions.d.ts

@@ -0,0 +1,33 @@
+import { Any } from "../../AuthMethod.js";
+import { Any as Any$1 } from "../../Action.js";
+import { Any as Any$2 } from "../../Group.js";
+import { MachineIdSeparator } from "../identifier.js";
+import { IsAny, IsGenericArray } from "../types.js";
+import { Any as Any$3 } from "../../Plugin.js";
+import { PluginInstallation } from "../../DualRuntime.js";
+//#region src/internal/dual/actions.d.ts
+interface ActionEntry<Id extends string = string, ActionDef extends Any$1 = Any$1> {
+  readonly actionId: Id;
+  readonly action: ActionDef;
+}
+type ActionEntriesFromActions<Actions extends readonly Any$1[], Prefix extends string> = IsGenericArray<Actions> extends true ? ActionEntry : Actions[number] extends (infer ActionDef) ? ActionDef extends Any$1 ? ActionEntry<`${Prefix}${typeof MachineIdSeparator}${ActionDef["identifier"]}`, ActionDef> : never : never;
+type ActionEntriesFromGroups<Groups extends readonly Any$2[], Prefix extends string> = IsGenericArray<Groups> extends true ? ActionEntry : Groups[number] extends (infer GroupDef) ? GroupDef extends Any$2 ? GroupActionEntries<GroupDef, `${Prefix}${typeof MachineIdSeparator}${GroupDef["identifier"]}`> : never : never;
+type GroupActionEntries<GroupDef extends Any$2, Prefix extends string> = ActionEntriesFromActions<GroupDef["actions"], Prefix> | ActionEntriesFromGroups<GroupDef["groups"], Prefix>;
+export type PluginActionEntries<P extends Any$3> = ActionEntriesFromActions<P["actions"], P["identifier"]> | ActionEntriesFromGroups<P["groups"], P["identifier"]>;
+export type AllActionEntries<Plugins extends readonly Any$3[]> = IsAny<Plugins> extends true ? ActionEntry : IsGenericArray<Plugins> extends true ? ActionEntry : Plugins[number] extends (infer P) ? P extends Any$3 ? PluginActionEntries<P> : never : never;
+type GroupActions<Groups extends readonly Any$2[]> = IsGenericArray<Groups> extends true ? Any$1 : Groups[number] extends (infer GroupDef) ? GroupDef extends Any$2 ? GroupDef["actions"][number] | GroupActions<GroupDef["groups"]> : never : never;
+export type PluginActions<P extends Any$3> = P["actions"][number] | GroupActions<P["groups"]>;
+export interface RuntimeActionEntry<out ActionId extends string = string, out ProviderId extends string = string, out ActionDef extends Any$1 = Any$1, out AllowedMethods extends readonly Any[] = readonly Any[]> {
+  readonly actionId: ActionId;
+  readonly providerId: ProviderId;
+  readonly localId: string;
+  readonly pluginVersion: string;
+  readonly action: ActionDef;
+  readonly authMethods: AllowedMethods;
+}
+export declare const collectActionEntries: (installations: readonly PluginInstallation[]) => readonly RuntimeActionEntry[];
+/** An action of the installed releases, or of the exact `version` when the caller pins one. */
+export declare const resolveAction: (installations: readonly PluginInstallation[], actionId: string, version?: string) => RuntimeActionEntry | undefined;
+//#endregion
+export {};
+//# sourceMappingURL=actions.d.ts.map

package/dist/internal/dual/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","names":["Action.Any","Group.Any","Plugin.Any","AuthMethod.Any"],"sources":["../../../src/internal/dual/actions.ts"],"mappings":";;;;;;;;UASU,YAAY,4BAA4B,kBAAkBA,QAAaA;WACtE,UAAU;WACV,QAAQ;;KAGd,yBAAyB,yBAAyBA,SAAc,yBACnE,eAAe,wBACX,cACA,+BAA8B,aAC5B,kBAAkBA,QAChB,eAAe,gBAAgB,qBAAqB,2BAA2B;KAIpF,wBAAwB,wBAAwBC,SAAa,yBAChE,eAAe,uBACX,cACA,8BAA6B,YAC3B,iBAAiBA,QACf,mBACE,aACG,gBAAgB,qBAAqB;KAK/C,mBAAmB,iBAAiBA,OAAW,yBAChD,yBAAyB,qBAAqB,UAC9C,wBAAwB,oBAAoB;YAEpC,oBAAoB,UAAUC,SACtC,yBAAyB,cAAc,mBACvC,wBAAwB,aAAa;YAE7B,iBAAiB,yBAAyBA,WACpD,MAAM,wBACF,cACA,eAAe,wBACb,cACA,+BAA8B,KAC5B,UAAUA,QACR,oBAAoB;KAI3B,aAAa,wBAAwBD,WACxC,eAAe,uBACXD,QACA,8BAA6B,YAC3B,iBAAiBC,QACf,8BAA8B,aAAa;YAIzC,cAAc,UAAUC,SAAc,uBAAuB,aAAa;iBAErE,uBACX,sCACA,wCACA,kBAAkBF,QAAaA,WAC/B,gCAAgCG,iBAA4BA;WAEvD,UAAU;WACV,YAAY;WACZ;WACA;WACA,QAAQ;WACR,aAAa;;qBAeX,uBAAoB,wBACP,kCACd;;qBAQC,gBAAa,wBACA,sBAAoB,kBAC5B,qBAEf"}

package/dist/internal/dual/actions.js

@@ -0,0 +1,26 @@
+import { walkCapabilities } from "../capabilities.js";
+//#region src/internal/dual/actions.ts
+const entriesOf = (installation) => walkCapabilities(installation.plugin, (owner) => owner.actions).map(({ localId, canonicalId, node }) => ({
+	action: node,
+	actionId: canonicalId,
+	authMethods: installation.plugin.authMethods,
+	localId,
+	pluginVersion: installation.version,
+	providerId: installation.plugin.identifier
+}));
+const collectActionEntries = (installations) => installations.flatMap(entriesOf);
+const actionIndex = /* @__PURE__ */ new WeakMap();
+/** An action of the installed releases, or of the exact `version` when the caller pins one. */
+const resolveAction = (installations, actionId, version) => {
+	let index = actionIndex.get(installations);
+	if (index === void 0) {
+		index = new Map(collectActionEntries(installations).map((entry) => [entry.actionId, entry]));
+		actionIndex.set(installations, index);
+	}
+	const entry = index.get(actionId);
+	return entry === void 0 || version !== void 0 && entry.pluginVersion !== version ? void 0 : entry;
+};
+//#endregion
+export { collectActionEntries, resolveAction };
+
+//# sourceMappingURL=actions.js.map