@lonca/baron-providers 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,20 @@
+# @lonca/baron-providers
+
+Baron provider registry: builds the live ports a policy binds, plus the native escape hatch.
+
+Part of **[Baron](https://github.com/loncadev/baron)** — a platform-agnostic work-orchestration layer for AI coding agents:
+one pane of glass (issues, scm, ci, deploy, notify) across providers, via MCP + CLI.
+
+## Install
+
+```bash
+npm install @lonca/baron-providers
+```
+
+## Documentation
+
+See the [Baron documentation](https://github.com/loncadev/baron#readme). Source: [`packages/providers`](https://github.com/loncadev/baron/tree/main/packages/providers).
+
+## License
+
+[Apache-2.0](./LICENSE) © Baron contributors.

package/dist/index.d.ts

@@ -0,0 +1,158 @@
+import { IssuesPort, ScmPort, CiPort, NotifyPort, DeployPort, CapabilityManifest, LinkMap, IssuesTransport, Introspector, ScmManifest, ScmTransport, CiManifest, CiStatusMaps, CiTransport, NotifyManifest, NotifyTransport, DeployManifest, DeployStatusMaps, DeployTransport, GapPolicy, Logger, IssuesProviderConfig, BaronPolicyFile } from '@lonca/baron-core';
+
+/** A read-only view of process environment (mirrors {@link Env}; kept local to avoid a cycle). */
+type Env$1 = Record<string, string | undefined>;
+/**
+ * The provider-native ESCAPE HATCH (decision #18). A clearly-labeled, last-resort, NON-PORTABLE
+ * authenticated REST passthrough so a solopreneur is never blocked by a capability Baron has not yet
+ * normalized into a port. The agent supplies the raw provider request; Baron only attaches the
+ * provider's base URL + auth and returns the (size-capped) response. This is deliberately outside the
+ * normalized port model — using it is an explicit, non-portable choice.
+ */
+interface NativeRequest {
+    /** HTTP method (GET/POST/PATCH/…). */
+    readonly method: string;
+    /** Provider-relative path, e.g. '/beekod/_apis/wit/workitems/1?api-version=7.1'. */
+    readonly path: string;
+    readonly query?: Readonly<Record<string, string>>;
+    readonly body?: unknown;
+}
+interface NativeResponse {
+    readonly status: number;
+    readonly ok: boolean;
+    /** Parsed JSON when possible, else raw text. Capped — see `truncated`. */
+    readonly body: unknown;
+    readonly truncated: boolean;
+}
+/** How a provider exposes raw authenticated HTTP for the escape hatch. */
+interface NativeHttp {
+    baseUrl(env: Env$1): string;
+    authHeader(env: Env$1): string;
+}
+/** Azure DevOps PATs authenticate as HTTP Basic with an empty username. */
+declare function azureBasicAuth(token: string): string;
+/** Pure request plan (URL + method + headers + body) — unit-testable without the network. */
+declare function nativeRequestPlan(http: NativeHttp, env: Env$1, req: NativeRequest): {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+};
+/** Execute a native request via global fetch. The response body is parsed as JSON when possible and
+ * capped to keep a large payload from overflowing the caller's context (`truncated` flags it). */
+declare function runNativeRequest(http: NativeHttp, env: Env$1, req: NativeRequest): Promise<NativeResponse>;
+
+/**
+ * The committed `.baron` config layout, shared by every entrypoint that reads it (the CLI's
+ * `doctor` and the MCP server both load `policy.json`). Kept here in shared infrastructure so those
+ * entrypoints depend on this, not on each other. POSIX-joined; the Node fs layer accepts these on
+ * every platform.
+ */
+declare const BARON_DIR = ".baron";
+declare function policyPath(root: string): string;
+/** Directory the default local-markdown knowledge loop persists into. */
+declare function knowledgeDir(root: string): string;
+/** The gitignored credentials file (KEY=VALUE) overlaid onto the environment at run time. */
+declare function credentialsPath(root: string): string;
+
+/**
+ * Parse a `.baron/credentials` file (dotenv-style `KEY=VALUE` lines; `#` comments and blanks
+ * ignored; surrounding quotes stripped). This file is gitignored and holds secrets — the committed
+ * `policy.json` never does.
+ */
+declare function parseCredentials(text: string): Record<string, string>;
+/**
+ * Overlay a `.baron/credentials` file onto the process environment. A real environment variable
+ * wins over the file (so CI secrets override a local file); the file fills the gaps. Returns the
+ * base env unchanged when no file is present.
+ */
+declare function mergeCredentials(baseEnv: Env, fileText: string | undefined): Env;
+
+/** A read-only view of process environment (credentials live here, never in committed policy). */
+type Env = Record<string, string | undefined>;
+/**
+ * Everything Baron's entrypoints (CLI, MCP server) need to bind a provider id to live behavior: its
+ * capability manifest, the env keys carrying its credentials (scaffolded into
+ * `.baron/credentials.example`, never committed), and factories for the live transport + introspector.
+ * This is shared infrastructure deliberately kept out of any single entrypoint so the CLI and the
+ * MCP server depend on it rather than on each other.
+ */
+interface ProviderDescriptor {
+    readonly id: string;
+    readonly manifest?: CapabilityManifest;
+    readonly credentialEnvKeys?: readonly string[];
+    /** Fixed abstract→native link types (provider knowledge, not policy); see {@link buildIssuesPort}. */
+    readonly linkMap?: LinkMap;
+    createTransport?(env: Env): IssuesTransport;
+    createIntrospector?(env: Env): Introspector;
+    readonly scmManifest?: ScmManifest;
+    /** Env keys for the scm transport (Azure adds AZURE_DEVOPS_REPO over the issues keys). */
+    readonly scmCredentialEnvKeys?: readonly string[];
+    createScmTransport?(env: Env): ScmTransport;
+    readonly ciManifest?: CiManifest;
+    readonly ciStatusMaps?: CiStatusMaps;
+    readonly ciCredentialEnvKeys?: readonly string[];
+    createCiTransport?(env: Env): CiTransport;
+    readonly notifyManifest?: NotifyManifest;
+    readonly notifyCredentialEnvKeys?: readonly string[];
+    createNotifyTransport?(env: Env): NotifyTransport;
+    readonly deployManifest?: DeployManifest;
+    readonly deployStatusMaps?: DeployStatusMaps;
+    readonly deployCredentialEnvKeys?: readonly string[];
+    createDeployTransport?(env: Env): DeployTransport;
+    readonly nativeHttp?: NativeHttp;
+}
+declare const KNOWN_PROVIDERS: string[];
+declare function getProviderDescriptor(id: string): ProviderDescriptor;
+/**
+ * Build a live {@link IssuesPort} from a resolved policy config plus environment credentials: looks
+ * up the provider, creates its live transport, and wraps it in the shared {@link BaseIssuesAdapter}
+ * (which carries all role/native translation — invariant #4). This is the one call the MCP server
+ * needs to turn a `policy.json` into a working issues port.
+ */
+declare function buildIssuesPort(config: IssuesProviderConfig, env: Env, logger?: Logger): IssuesPort;
+/**
+ * Build a live {@link ScmPort} for a provider from environment credentials. The scm port has no
+ * role/type map to resolve from policy, so it binds directly from the provider id + env + an
+ * optional gap policy.
+ */
+declare function buildScmPort(provider: string, env: Env, gapPolicy?: GapPolicy, logger?: Logger): ScmPort;
+/**
+ * Build a live {@link CiPort} for a provider from environment credentials. Like scm, the ci port has
+ * no user-configured map to resolve from policy (CI statuses are vendor-fixed and normalized by the
+ * adapter), so it binds from the provider id + env + an optional gap policy.
+ */
+declare function buildCiPort(provider: string, env: Env, gapPolicy?: GapPolicy, logger?: Logger): CiPort;
+/**
+ * Build a live {@link NotifyPort} for a provider from environment credentials. Like scm/ci, notify
+ * has no user-configured map in policy, so it binds from the provider id + env + an optional gap policy.
+ */
+declare function buildNotifyPort(provider: string, env: Env, gapPolicy?: GapPolicy, logger?: Logger): NotifyPort;
+/**
+ * Execute a provider-native escape-hatch request (decision #18). Looks up the provider's raw-HTTP
+ * descriptor and runs the request with its base URL + auth; throws NATIVE_UNSUPPORTED if the provider
+ * exposes no escape hatch. This is the last-resort, non-portable path — callers (e.g. the MCP server)
+ * should restrict it to providers the active policy actually binds.
+ */
+declare function executeNativeRequest(provider: string, env: Env, request: NativeRequest): Promise<NativeResponse>;
+/**
+ * Build a live {@link DeployPort} for a provider from environment credentials. Like ci/notify, the
+ * deploy port has no user-configured map in policy (deploy statuses are vendor-fixed), so it binds
+ * from the provider id + env + an optional gap policy.
+ */
+declare function buildDeployPort(provider: string, env: Env, gapPolicy?: GapPolicy, logger?: Logger): DeployPort;
+interface BoundPorts {
+    issues?: IssuesPort;
+    scm?: ScmPort;
+    ci?: CiPort;
+    notify?: NotifyPort;
+    deploy?: DeployPort;
+}
+/**
+ * Build every port a parsed policy binds (issues and/or scm), from environment credentials. Shared
+ * by the MCP server and the CLI's `run` so both turn a `policy.json` into live ports identically;
+ * neither port is built unless `providers` binds it.
+ */
+declare function buildPorts(policy: BaronPolicyFile, env: Env, logger?: Logger): BoundPorts;
+
+export { BARON_DIR, type BoundPorts, type Env, KNOWN_PROVIDERS, type NativeHttp, type NativeRequest, type NativeResponse, type ProviderDescriptor, azureBasicAuth, buildCiPort, buildDeployPort, buildIssuesPort, buildNotifyPort, buildPorts, buildScmPort, credentialsPath, executeNativeRequest, getProviderDescriptor, knowledgeDir, mergeCredentials, nativeRequestPlan, parseCredentials, policyPath, runNativeRequest };

package/dist/index.js

@@ -0,0 +1,396 @@
+// src/index.ts
+import {
+  AZURE_DEVOPS_PROVIDER,
+  azureDevOpsCiManifest,
+  azureDevOpsCiStatusMaps,
+  azureDevOpsDeployManifest,
+  azureDevOpsDeployStatusMaps,
+  azureDevOpsManifest,
+  azureDevOpsScmManifest,
+  createAzureDevOpsCiTransport,
+  createAzureDevOpsDeployTransport,
+  createAzureDevOpsIntrospector,
+  createAzureDevOpsScmTransport,
+  createAzureDevOpsTransport,
+  exampleAzureDevOpsLinkMap
+} from "@lonca/baron-adapter-azure-devops";
+import {
+  GITHUB_PROVIDER,
+  createGithubCiTransport,
+  createGithubDeployTransport,
+  createGithubIntrospector,
+  createGithubScmTransport,
+  createGithubTransport,
+  exampleGithubLinkMap,
+  githubCiManifest,
+  githubCiStatusMaps,
+  githubDeployManifest,
+  githubDeployStatusMaps,
+  githubManifest,
+  githubScmManifest
+} from "@lonca/baron-adapter-github";
+import {
+  SLACK_PROVIDER,
+  createSlackNotifyTransport,
+  slackNotifyManifest
+} from "@lonca/baron-adapter-slack";
+import {
+  BaronError,
+  BaseCiAdapter,
+  BaseDeployAdapter,
+  BaseIssuesAdapter,
+  BaseNotifyAdapter,
+  BaseScmAdapter,
+  parseGapPolicy,
+  resolveIssuesConfig
+} from "@lonca/baron-core";
+
+// src/native.ts
+import { Buffer } from "buffer";
+function azureBasicAuth(token) {
+  return `Basic ${Buffer.from(`:${token}`).toString("base64")}`;
+}
+var MAX_BODY_CHARS = 2e4;
+function nativeRequestPlan(http, env, req) {
+  const base = http.baseUrl(env).replace(/\/+$/, "");
+  const path = req.path.startsWith("/") ? req.path : `/${req.path}`;
+  const qs = req.query !== void 0 && Object.keys(req.query).length > 0 ? `${path.includes("?") ? "&" : "?"}${new URLSearchParams(req.query).toString()}` : "";
+  const headers = { authorization: http.authHeader(env) };
+  let body;
+  if (req.body !== void 0) {
+    headers["content-type"] = "application/json";
+    body = JSON.stringify(req.body);
+  }
+  return {
+    url: `${base}${path}${qs}`,
+    method: req.method.toUpperCase(),
+    headers,
+    ...body !== void 0 ? { body } : {}
+  };
+}
+async function runNativeRequest(http, env, req) {
+  const plan = nativeRequestPlan(http, env, req);
+  const response = await fetch(plan.url, {
+    method: plan.method,
+    headers: plan.headers,
+    ...plan.body !== void 0 ? { body: plan.body } : {}
+  });
+  const text = await response.text();
+  const truncated = text.length > MAX_BODY_CHARS;
+  const slice = truncated ? text.slice(0, MAX_BODY_CHARS) : text;
+  let parsed = slice;
+  try {
+    parsed = JSON.parse(slice);
+  } catch {
+  }
+  return { status: response.status, ok: response.ok, body: parsed, truncated };
+}
+
+// src/paths.ts
+var BARON_DIR = ".baron";
+function policyPath(root) {
+  return `${root}/${BARON_DIR}/policy.json`;
+}
+function knowledgeDir(root) {
+  return `${root}/${BARON_DIR}/knowledge`;
+}
+function credentialsPath(root) {
+  return `${root}/${BARON_DIR}/credentials`;
+}
+
+// src/credentials.ts
+function parseCredentials(text) {
+  const out = {};
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    if (key.length > 0) out[key] = value;
+  }
+  return out;
+}
+function mergeCredentials(baseEnv, fileText) {
+  if (fileText === void 0) return baseEnv;
+  return { ...parseCredentials(fileText), ...baseEnv };
+}
+
+// src/index.ts
+var DESCRIPTORS = {
+  [AZURE_DEVOPS_PROVIDER]: {
+    id: AZURE_DEVOPS_PROVIDER,
+    manifest: azureDevOpsManifest,
+    credentialEnvKeys: ["AZURE_DEVOPS_ORG", "AZURE_DEVOPS_PROJECT", "AZURE_DEVOPS_TOKEN"],
+    linkMap: exampleAzureDevOpsLinkMap,
+    createTransport(env) {
+      return createAzureDevOpsTransport({
+        organization: env.AZURE_DEVOPS_ORG ?? "",
+        project: env.AZURE_DEVOPS_PROJECT ?? "",
+        token: env.AZURE_DEVOPS_TOKEN ?? ""
+      });
+    },
+    createIntrospector(env) {
+      return createAzureDevOpsIntrospector({
+        organization: env.AZURE_DEVOPS_ORG ?? "",
+        project: env.AZURE_DEVOPS_PROJECT ?? "",
+        token: env.AZURE_DEVOPS_TOKEN ?? ""
+      });
+    },
+    scmManifest: azureDevOpsScmManifest,
+    scmCredentialEnvKeys: [
+      "AZURE_DEVOPS_ORG",
+      "AZURE_DEVOPS_PROJECT",
+      "AZURE_DEVOPS_REPO",
+      "AZURE_DEVOPS_TOKEN"
+    ],
+    createScmTransport(env) {
+      return createAzureDevOpsScmTransport({
+        organization: env.AZURE_DEVOPS_ORG ?? "",
+        project: env.AZURE_DEVOPS_PROJECT ?? "",
+        repository: env.AZURE_DEVOPS_REPO ?? "",
+        token: env.AZURE_DEVOPS_TOKEN ?? ""
+      });
+    },
+    ciManifest: azureDevOpsCiManifest,
+    ciStatusMaps: azureDevOpsCiStatusMaps,
+    ciCredentialEnvKeys: ["AZURE_DEVOPS_ORG", "AZURE_DEVOPS_PROJECT", "AZURE_DEVOPS_TOKEN"],
+    createCiTransport(env) {
+      return createAzureDevOpsCiTransport({
+        organization: env.AZURE_DEVOPS_ORG ?? "",
+        project: env.AZURE_DEVOPS_PROJECT ?? "",
+        token: env.AZURE_DEVOPS_TOKEN ?? ""
+      });
+    },
+    deployManifest: azureDevOpsDeployManifest,
+    deployStatusMaps: azureDevOpsDeployStatusMaps,
+    deployCredentialEnvKeys: ["AZURE_DEVOPS_ORG", "AZURE_DEVOPS_PROJECT", "AZURE_DEVOPS_TOKEN"],
+    createDeployTransport(env) {
+      return createAzureDevOpsDeployTransport({
+        organization: env.AZURE_DEVOPS_ORG ?? "",
+        project: env.AZURE_DEVOPS_PROJECT ?? "",
+        token: env.AZURE_DEVOPS_TOKEN ?? ""
+      });
+    },
+    nativeHttp: {
+      baseUrl: (env) => `https://dev.azure.com/${env.AZURE_DEVOPS_ORG ?? ""}`,
+      authHeader: (env) => azureBasicAuth(env.AZURE_DEVOPS_TOKEN ?? "")
+    }
+  },
+  [GITHUB_PROVIDER]: {
+    id: GITHUB_PROVIDER,
+    manifest: githubManifest,
+    credentialEnvKeys: ["GITHUB_OWNER", "GITHUB_REPO", "GITHUB_TOKEN"],
+    linkMap: exampleGithubLinkMap,
+    createTransport(env) {
+      return createGithubTransport({
+        owner: env.GITHUB_OWNER ?? "",
+        repo: env.GITHUB_REPO ?? "",
+        token: env.GITHUB_TOKEN ?? ""
+      });
+    },
+    createIntrospector(env) {
+      return createGithubIntrospector({
+        owner: env.GITHUB_OWNER ?? "",
+        repo: env.GITHUB_REPO ?? "",
+        token: env.GITHUB_TOKEN ?? ""
+      });
+    },
+    scmManifest: githubScmManifest,
+    scmCredentialEnvKeys: ["GITHUB_OWNER", "GITHUB_REPO", "GITHUB_TOKEN"],
+    createScmTransport(env) {
+      return createGithubScmTransport({
+        owner: env.GITHUB_OWNER ?? "",
+        repo: env.GITHUB_REPO ?? "",
+        token: env.GITHUB_TOKEN ?? ""
+      });
+    },
+    ciManifest: githubCiManifest,
+    ciStatusMaps: githubCiStatusMaps,
+    ciCredentialEnvKeys: ["GITHUB_OWNER", "GITHUB_REPO", "GITHUB_TOKEN"],
+    createCiTransport(env) {
+      return createGithubCiTransport({
+        owner: env.GITHUB_OWNER ?? "",
+        repo: env.GITHUB_REPO ?? "",
+        token: env.GITHUB_TOKEN ?? ""
+      });
+    },
+    deployManifest: githubDeployManifest,
+    deployStatusMaps: githubDeployStatusMaps,
+    deployCredentialEnvKeys: ["GITHUB_OWNER", "GITHUB_REPO", "GITHUB_TOKEN"],
+    createDeployTransport(env) {
+      return createGithubDeployTransport({
+        owner: env.GITHUB_OWNER ?? "",
+        repo: env.GITHUB_REPO ?? "",
+        token: env.GITHUB_TOKEN ?? ""
+      });
+    },
+    nativeHttp: {
+      baseUrl: () => "https://api.github.com",
+      authHeader: (env) => `Bearer ${env.GITHUB_TOKEN ?? ""}`
+    }
+  },
+  [SLACK_PROVIDER]: {
+    id: SLACK_PROVIDER,
+    // Slack is notify-only: no issues/scm/ci groups.
+    notifyManifest: slackNotifyManifest,
+    notifyCredentialEnvKeys: ["SLACK_BOT_TOKEN", "SLACK_CHANNEL"],
+    createNotifyTransport(env) {
+      return createSlackNotifyTransport({
+        token: env.SLACK_BOT_TOKEN ?? "",
+        ...env.SLACK_CHANNEL !== void 0 ? { defaultChannel: env.SLACK_CHANNEL } : {}
+      });
+    },
+    nativeHttp: {
+      baseUrl: () => "https://slack.com/api",
+      authHeader: (env) => `Bearer ${env.SLACK_BOT_TOKEN ?? ""}`
+    }
+  }
+};
+var KNOWN_PROVIDERS = Object.keys(DESCRIPTORS);
+function getProviderDescriptor(id) {
+  const descriptor = DESCRIPTORS[id];
+  if (descriptor === void 0) {
+    throw new BaronError(
+      `Unknown provider '${id}'. Known providers: ${KNOWN_PROVIDERS.join(", ")}.`,
+      "UNKNOWN_PROVIDER"
+    );
+  }
+  return descriptor;
+}
+function buildIssuesPort(config, env, logger) {
+  const descriptor = getProviderDescriptor(config.provider);
+  if (descriptor.manifest === void 0 || descriptor.createTransport === void 0) {
+    throw new BaronError(
+      `Provider '${config.provider}' has no issues adapter.`,
+      "ISSUES_UNSUPPORTED"
+    );
+  }
+  const resolved = {
+    ...config,
+    linkMap: config.linkMap ?? descriptor.linkMap ?? {}
+  };
+  return new BaseIssuesAdapter(
+    descriptor.manifest,
+    resolved,
+    descriptor.createTransport(env),
+    logger
+  );
+}
+function buildScmPort(provider, env, gapPolicy, logger) {
+  const descriptor = getProviderDescriptor(provider);
+  if (descriptor.scmManifest === void 0 || descriptor.createScmTransport === void 0) {
+    throw new BaronError(`Provider '${provider}' has no scm adapter.`, "SCM_UNSUPPORTED");
+  }
+  return new BaseScmAdapter(
+    descriptor.scmManifest,
+    descriptor.createScmTransport(env),
+    gapPolicy,
+    logger
+  );
+}
+function buildCiPort(provider, env, gapPolicy, logger) {
+  const descriptor = getProviderDescriptor(provider);
+  if (descriptor.ciManifest === void 0 || descriptor.ciStatusMaps === void 0 || descriptor.createCiTransport === void 0) {
+    throw new BaronError(`Provider '${provider}' has no ci adapter.`, "CI_UNSUPPORTED");
+  }
+  return new BaseCiAdapter(
+    descriptor.ciManifest,
+    descriptor.ciStatusMaps,
+    descriptor.createCiTransport(env),
+    gapPolicy,
+    logger
+  );
+}
+function buildNotifyPort(provider, env, gapPolicy, logger) {
+  const descriptor = getProviderDescriptor(provider);
+  if (descriptor.notifyManifest === void 0 || descriptor.createNotifyTransport === void 0) {
+    throw new BaronError(`Provider '${provider}' has no notify adapter.`, "NOTIFY_UNSUPPORTED");
+  }
+  return new BaseNotifyAdapter(
+    descriptor.notifyManifest,
+    descriptor.createNotifyTransport(env),
+    gapPolicy,
+    logger
+  );
+}
+function executeNativeRequest(provider, env, request) {
+  const descriptor = getProviderDescriptor(provider);
+  if (descriptor.nativeHttp === void 0) {
+    throw new BaronError(
+      `Provider '${provider}' has no native escape hatch.`,
+      "NATIVE_UNSUPPORTED"
+    );
+  }
+  return runNativeRequest(descriptor.nativeHttp, env, request);
+}
+function buildDeployPort(provider, env, gapPolicy, logger) {
+  const descriptor = getProviderDescriptor(provider);
+  if (descriptor.deployManifest === void 0 || descriptor.deployStatusMaps === void 0 || descriptor.createDeployTransport === void 0) {
+    throw new BaronError(`Provider '${provider}' has no deploy adapter.`, "DEPLOY_UNSUPPORTED");
+  }
+  return new BaseDeployAdapter(
+    descriptor.deployManifest,
+    descriptor.deployStatusMaps,
+    descriptor.createDeployTransport(env),
+    gapPolicy,
+    logger
+  );
+}
+function buildPorts(policy, env, logger) {
+  const ports = {};
+  if (policy.providers.issues !== void 0) {
+    ports.issues = buildIssuesPort(resolveIssuesConfig(policy), env, logger);
+  }
+  const scmProvider = policy.providers.scm;
+  if (scmProvider !== void 0) {
+    const gapPolicy = parseGapPolicy(policy.gapPolicy?.[scmProvider] ?? {});
+    ports.scm = buildScmPort(scmProvider, env, gapPolicy, logger);
+  }
+  const ciProvider = policy.providers.ci;
+  if (ciProvider !== void 0) {
+    const gapPolicy = parseGapPolicy(policy.gapPolicy?.[ciProvider] ?? {});
+    ports.ci = buildCiPort(ciProvider, env, gapPolicy, logger);
+  }
+  const notifyProvider = policy.providers.notify;
+  if (notifyProvider !== void 0) {
+    const gapPolicy = parseGapPolicy(policy.gapPolicy?.[notifyProvider] ?? {});
+    ports.notify = buildNotifyPort(notifyProvider, env, gapPolicy, logger);
+  }
+  const deployProvider = policy.providers.deploy;
+  if (deployProvider !== void 0) {
+    const gapPolicy = parseGapPolicy(policy.gapPolicy?.[deployProvider] ?? {});
+    ports.deploy = buildDeployPort(deployProvider, env, gapPolicy, logger);
+  }
+  if (policy.providers.docs !== void 0) {
+    throw new BaronError(
+      "The 'docs' port is declared but not implemented yet (planned for a future release); remove it from policy.providers.",
+      "DOCS_UNSUPPORTED"
+    );
+  }
+  return ports;
+}
+export {
+  BARON_DIR,
+  KNOWN_PROVIDERS,
+  azureBasicAuth,
+  buildCiPort,
+  buildDeployPort,
+  buildIssuesPort,
+  buildNotifyPort,
+  buildPorts,
+  buildScmPort,
+  credentialsPath,
+  executeNativeRequest,
+  getProviderDescriptor,
+  knowledgeDir,
+  mergeCredentials,
+  nativeRequestPlan,
+  parseCredentials,
+  policyPath,
+  runNativeRequest
+};

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@lonca/baron-providers",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@lonca/baron-core": "0.1.0",
+    "@lonca/baron-adapter-slack": "0.1.0",
+    "@lonca/baron-adapter-azure-devops": "0.1.0",
+    "@lonca/baron-adapter-github": "0.1.0"
+  },
+  "description": "Baron provider registry: builds the live ports a policy binds, plus the native escape hatch.",
+  "keywords": [
+    "baron",
+    "ai-agents",
+    "mcp",
+    "work-orchestration",
+    "devops",
+    "providers",
+    "policy"
+  ],
+  "author": "Baron contributors",
+  "homepage": "https://github.com/loncadev/baron#readme",
+  "bugs": {
+    "url": "https://github.com/loncadev/baron/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/loncadev/baron.git",
+    "directory": "packages/providers"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts --clean",
+    "typecheck": "tsc --noEmit"
+  }
+}