@slates/provider-handler 1.0.0-rc.3 → 1.0.0-rc.32

package/dist/index.module.js

@@ -1,2 +1,1452 @@
-import{ServiceError as t,validationError as e,badRequestError as n,notFoundError as r,preconditionFailedError as o}from"@lowerdeck/error";import{createSlatesProviderProtoHandler as i}from"@slates/proto";import{SlateDefaultPollingIntervalSeconds as a,SlateLogger as u,SlateContext as s}from"@slates/provider";import c from"zod";function l(t,e){if(!{}.hasOwnProperty.call(t,e))throw new TypeError("attempted to use private field on non-instance");return t}var h=0;function p(t){return"__private_"+h+++"_"+t}function f(){return f=Object.assign?Object.assign.bind():function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var r in n)({}).hasOwnProperty.call(n,r)&&(t[r]=n[r])}return t},f.apply(null,arguments)}function d(t){var e=function(t){if("object"!=typeof t||!t)return t;var e=t[Symbol.toPrimitive];if(void 0!==e){var n=e.call(t,"string");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(t)}(t);return"symbol"==typeof e?e:e+""}var m=function(n,r,o,i){var a=n.safeParse(r);if(!a.success)throw new t(function(t,n,r){return e({message:n,entity:t,errors:r.issues.map(function(t){return f({},t,{path:t.path.map(function(t){return String(t)})})})})}(o,i,a.error));return a.data},v=function(t){return t.toJSONSchema({unrepresentable:"any",override:function(t){var e=t.zodSchema._zod.def;"date"===e.type&&(t.jsonSchema.type="string",t.jsonSchema.format="date-time"),"bigint"===e.type&&(t.jsonSchema.type="number")}})},g=function(e,r){var o=e.spec.auth.authStack.find(function(t){return t.key==r});if(!o)throw new t(n({message:"Invalid authentication method ID: "+r}));return o},P=function(t,e){var n;return{id:e.key,name:e.name,type:e.type,scopes:"scopes"in e?e.scopes.map(function(t){return{id:t.scope,title:t.title,description:t.description}}):void 0,inputSchema:v(null!=(n=e.inputSchema)?n:c.object({})),outputSchema:v(t.spec.auth.outputSchema),capabilities:{getDefaultInput:{enabled:!(!("getDefaultInput"in e)||!e.getDefaultInput)},handleTokenRefresh:{enabled:!(!("handleTokenRefresh"in e)||!e.handleTokenRefresh)},handleChangedInput:{enabled:!!e.onInputChanged},getProfile:{enabled:!!e.getProfile}}}},y=function(e,n){var o=e.actions.find(function(t){return t.key==n});if(!o)throw new t(r("action",n));return o},w=function(e,r,o){var i=y(e,o);if(i.type!=r)throw new t(n({message:"Action with ID "+o+" is not of type "+r}));return i},I=function(t,e){var n;return f({},{id:e.key,name:e.name,description:e.description,instructions:e.instructions,constraints:e.constraints,tags:e.tags,metadata:e.metadata,inputSchema:v(e.inputSchema),outputSchema:v(e.outputSchema)},"tool"==e.type?{type:"action.tool",capabilities:{}}:{type:"action.trigger",capabilities:{},invocation:"polling"==e.source?{type:"polling",intervalSeconds:null!=(n=e.polling.intervalInSeconds)?n:a}:{type:"webhook",autoRegistration:!!e.autoRegisterWebhook,autoUnregistration:!!e.autoUnregisterWebhook}})},b=/*#__PURE__*/p("value"),k=/*#__PURE__*/function(){function t(t){Object.defineProperty(this,b,{writable:!0,value:void 0}),l(this,b)[b]=t}var e,n,r=t.prototype;return r.get=function(){return l(this,b)[b]},r.set=function(t){l(this,b)[b]=t},e=t,(n=[{key:"value",get:function(){return l(this,b)[b]}}])&&function(t,e){for(var n=0;n<e.length;n++){var r=e[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,d(r.key),r)}}(e.prototype,n),Object.defineProperty(e,"prototype",{writable:!1}),e}(),S=function(e,r){return i(function(i){try{var a=new k(null),c=new k(null),l=new k(null),h=new k(null),p=new k(null),d=new u(r),b=function(){var e=a.get(),n=c.get();if(!e||!n)throw new t(o({message:"Connection context has not been initialized"}));return{protocol:e,participants:n}},S=function(){var n=b(),r=h.get(),i=p.get(),a=l.get();if(!r||!i||!a&&e.spec.auth.authStack.length>0)throw new t(o({message:"Session context has not been initialized"}));return f({},n,{config:r.value,session:i,auth:a})};return i.onNotification("slates/hello",function(t){var e=t.params;try{return a.set(e.protocol),Promise.resolve()}catch(t){return Promise.reject(t)}}),i.onNotification("slates/participant.set",function(e){var n=e.params;try{if(!a.get())throw new t(o({message:"Connection protocol has not been initialized"}));return c.set(n.participants),Promise.resolve()}catch(t){return Promise.reject(t)}}),i.onNotification("slates/auth.set",function(t){var n=t.params;try{b(),g(e,n.authenticationMethodId);var r=m(e.spec.authSchema,n.output,"auth","Invalid authentication output for method ID: "+n.authenticationMethodId);return l.set({authenticationMethodId:n.authenticationMethodId,output:r}),Promise.resolve()}catch(t){return Promise.reject(t)}}),i.onNotification("slates/config.set",function(t){var n=t.params;try{b();var r=m(e.spec.configSchema,n.config,"config","Invalid configuration");return h.set({value:r}),Promise.resolve()}catch(t){return Promise.reject(t)}}),i.onNotification("slates/session.start",function(t){var e=t.params;try{return b(),p.set({id:e.sessionId,state:e.state}),Promise.resolve()}catch(t){return Promise.reject(t)}}),i.onRequest("slates/config.changed",function(t){var n=t.params;try{b();var r=m(e.spec.config.configSchema,n.newConfig,"config","Invalid configuration"),o=e.spec.config.handlers.configChanged;return o?Promise.resolve(o({previousConfig:n.previousConfig,newConfig:r})).then(function(t){var e;return{success:!0,config:null!=(e=null==t?void 0:t.config)?e:r}}):Promise.resolve({success:!0,config:r})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/config.get_default",function(t){try{b();var n=e.spec.config.handlers.getDefaultConfig;return n?Promise.resolve(n()).then(function(t){return{config:t}}):Promise.resolve({config:null})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/config.schema.get",function(t){try{return b(),Promise.resolve({schema:v(e.spec.configSchema)})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/provider.identify",function(t){try{return b(),Promise.resolve({protocol:"slates@2026-01-01",provider:{type:"provider",id:e.spec.key,name:e.spec.name,description:e.spec.description,metadata:e.spec.parameters.metadata}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.methods.list",function(t){try{return b(),Promise.resolve({authenticationMethods:e.spec.auth.authStack.map(function(t){return P(e,t)})})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.method.get",function(t){var n=t.params;try{b();var r=g(e,n.authenticationMethodId);return Promise.resolve({authenticationMethod:P(e,r)})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.input.get_default",function(t){var n=t.params;try{b();var r=g(e,n.authenticationMethodId);return r.getDefaultInput?Promise.resolve(r.getDefaultInput()).then(function(t){return{input:t}}):Promise.resolve({input:null})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.input.changed",function(t){var n=t.params;try{b();var r=g(e,n.authenticationMethodId);return r.onInputChanged?Promise.resolve(r.onInputChanged({previousInput:n.previousInput,newInput:n.newInput})).then(function(t){var e;return{success:!0,input:null!=(e=null==t?void 0:t.input)?e:n.newInput}}):Promise.resolve({success:!0,input:n.newInput})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.output.get",function(t){var n=t.params;try{var r,o=function(t){return r?t:{output:a}};b();var i=g(e,n.authenticationMethodId),a=n.input;i.inputSchema&&(a=m(i.inputSchema,a,"auth","Invalid authentication input for method ID: "+n.authenticationMethodId));var u=function(){if("getOutput"in i)return Promise.resolve(i.getOutput({input:a})).then(function(t){return r=1,{output:t.output}})}();return Promise.resolve(u&&u.then?u.then(o):o(u))}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.authorization_callback.handle",function(n){var r=n.params;try{var i,a=function(e){if(i)return e;throw new t(o({message:"Authentication method does not support authorization callback handling: "+r.authenticationMethodId}))};b();var u=g(e,r.authenticationMethodId),s=function(){if("handleCallback"in u)return Promise.resolve(u.handleCallback({code:r.code,state:r.state,redirectUri:r.redirectUri,input:r.input,clientId:r.clientId,clientSecret:r.clientSecret,scopes:r.scopes})).then(function(t){return i=1,{output:t.output,input:t.input}})}();return Promise.resolve(s&&s.then?s.then(a):a(s))}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.authorization_url.get",function(n){var r=n.params;try{var i,a=function(e){if(i)return e;throw new t(o({message:"Authentication method does not support authorization URL retrieval: "+r.authenticationMethodId}))};b();var u=g(e,r.authenticationMethodId),s=function(){if("getAuthorizationUrl"in u)return Promise.resolve(u.getAuthorizationUrl({redirectUri:r.redirectUri,state:r.state,input:r.input,clientId:r.clientId,clientSecret:r.clientSecret,scopes:r.scopes})).then(function(t){return i=1,{authorizationUrl:t.url,input:t.input}})}();return Promise.resolve(s&&s.then?s.then(a):a(s))}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.profile.get",function(n){var r=n.params;try{var i,a=function(e){if(i)return e;throw new t(o({message:"Authentication method does not support profile retrieval: "+r.authenticationMethodId}))};b();var u=g(e,r.authenticationMethodId),s=function(){if(u.getProfile)return Promise.resolve(u.getProfile({output:r.output,input:r.input,scopes:r.scopes})).then(function(t){return i=1,{profile:t.profile}})}();return Promise.resolve(s&&s.then?s.then(a):a(s))}catch(t){return Promise.reject(t)}}),i.onRequest("slates/auth.token_refresh.handle",function(n){var r=n.params;try{var i,a=function(e){if(i)return e;throw new t(o({message:"Authentication method does not support token refresh handling: "+r.authenticationMethodId}))};b();var u=g(e,r.authenticationMethodId),s=function(){if("handleTokenRefresh"in u&&u.handleTokenRefresh)return Promise.resolve(u.handleTokenRefresh({output:r.output,input:r.input,clientId:r.clientId,clientSecret:r.clientSecret,scopes:r.scopes})).then(function(t){return i=1,{output:t.output,input:t.input}})}();return Promise.resolve(s&&s.then?s.then(a):a(s))}catch(t){return Promise.reject(t)}}),i.onRequest("slates/actions.list",function(t){try{return b(),Promise.resolve({actions:e.actions.map(function(t){return I(0,t)})})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.get",function(t){var n=t.params;try{b();var r=y(e,n.actionId);return Promise.resolve({action:I(0,r)})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.tool.invoke",function(t){var n=t.params;try{var r,o=S(),i=w(e,"tool",n.actionId),a=m(i.inputSchema,n.input,"input","Invalid input for tool ID: "+n.actionId);return Promise.resolve(i.handleInvocation(new s(o.config,a,null==(r=o.auth)?void 0:r.output,e.spec,d))).then(function(t){return{output:t.output,message:t.message}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.trigger.map_event",function(t){var n=t.params;try{var r,o=S(),i=w(e,"trigger",n.actionId),a=m(i.inputSchema,n.input,"input","Invalid event for trigger ID: "+n.actionId);return Promise.resolve(i.handleEvent(new s(o.config,a,null==(r=o.auth)?void 0:r.output,e.spec,d))).then(function(t){return{id:t.id,type:t.type,output:t.output}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.trigger.poll_events",function(r){var o=r.params;try{var i,a=S(),u=w(e,"trigger",o.actionId);if(!u.pollEvents)throw new t(n({message:"Trigger action does not support polling: "+o.actionId}));return Promise.resolve(u.pollEvents(new s(a.config,{state:o.state},null==(i=a.auth)?void 0:i.output,e.spec,d))).then(function(t){return{inputs:t.inputs,updatedState:t.updatedState}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.trigger.webhook_handle",function(r){var o=r.params;try{var i,a=S(),u=w(e,"trigger",o.actionId);if(!u.handleRequest)throw new t(n({message:"Trigger action does not support webhook requests: "+o.actionId}));var c=new Request(o.url,{method:o.method,headers:o.headers,body:o.body?Uint8Array.from(atob(o.body.content),function(t){return t.charCodeAt(0)}):null});return Promise.resolve(u.handleRequest(new s(a.config,{request:c,state:o.state},null==(i=a.auth)?void 0:i.output,e.spec,d))).then(function(t){return{inputs:t.inputs,updatedState:t.updatedState}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.trigger.webhook_register",function(r){var o=r.params;try{var i,a=S(),u=w(e,"trigger",o.actionId);if(!u.autoRegisterWebhook)throw new t(n({message:"Trigger action does not support webhook auto-registration: "+o.actionId}));return Promise.resolve(u.autoRegisterWebhook(new s(a.config,{webhookBaseUrl:o.webhookBaseUrl},null==(i=a.auth)?void 0:i.output,e.spec,d))).then(function(t){return{registrationDetails:t.registrationDetails,state:t.state}})}catch(t){return Promise.reject(t)}}),i.onRequest("slates/action.trigger.webhook_unregister",function(r){var o=r.params;try{var i,a=S(),u=w(e,"trigger",o.actionId);if(!u.autoUnregisterWebhook)throw new t(n({message:"Trigger action does not support webhook auto-unregistration: "+o.actionId}));return Promise.resolve(u.autoUnregisterWebhook(new s(a.config,{webhookBaseUrl:o.webhookBaseUrl,registrationDetails:o.registrationDetails,state:o.state},null==(i=a.auth)?void 0:i.output,e.spec,d))).then(function(){return{}})}catch(t){return Promise.reject(t)}}),Promise.resolve()}catch(t){return Promise.reject(t)}})};export{S as createProviderHandler};
-//# sourceMappingURL=index.module.js.map
+// src/index.ts
+import { badRequestError as badRequestError3, preconditionFailedError, ServiceError as ServiceError4 } from "@lowerdeck/error";
+import {
+  createSlatesProviderProtoHandler,
+  SLATES_PROTOCOL_VERSION
+} from "@slates/proto";
+import {
+  redactUrlAttachmentSecrets,
+  runWithContext,
+  SlateContext,
+  SlateLogger,
+  SlatePublicContext,
+  uploadAttachmentDirect
+} from "@slates/provider";
+
+// src/pQueue.ts
+import PQueueImport from "p-queue";
+var resolveDefaultExport = (value) => {
+  let current = value;
+  for (let i = 0; i < 4; i++) {
+    if (typeof current === "function") return current;
+    if (current && typeof current === "object" && "default" in current) {
+      current = current.default;
+      continue;
+    }
+    break;
+  }
+  throw new TypeError("Module export is not a constructor");
+};
+var PQueue = resolveDefaultExport(PQueueImport);
+
+// src/spec.ts
+import { badRequestError, notFoundError, ServiceError as ServiceError2 } from "@lowerdeck/error";
+import {
+  SlateDefaultPollingIntervalSeconds
+} from "@slates/provider";
+import z from "zod";
+
+// src/validation.ts
+import { ServiceError, validationError } from "@lowerdeck/error";
+var zodToValidationError = (entity, message, e) => {
+  return validationError({
+    message,
+    entity,
+    errors: e.issues.map((i) => ({
+      ...i,
+      path: i.path.map((p) => String(p))
+    }))
+  });
+};
+var validate = (schema, data, entity, message) => {
+  let result = schema.safeParse(data);
+  if (!result.success) {
+    throw new ServiceError(zodToValidationError(entity, message, result.error));
+  }
+  return result.data;
+};
+var toJsonSchema = (schema) => schema.toJSONSchema({
+  unrepresentable: "any",
+  override: (ctx) => {
+    let def = ctx.zodSchema._zod.def;
+    if (def.type === "date") {
+      ctx.jsonSchema.type = "string";
+      ctx.jsonSchema.format = "date-time";
+    }
+    if (def.type === "bigint") {
+      ctx.jsonSchema.type = "number";
+    }
+  }
+});
+
+// src/spec.ts
+var getAuthMethod = (slate, authenticationMethodId) => {
+  let authMethod = slate.spec.auth.authStack.find((m) => m.key === authenticationMethodId);
+  if (!authMethod) {
+    throw new ServiceError2(
+      badRequestError({
+        message: `Invalid authentication method ID: ${authenticationMethodId}`
+      })
+    );
+  }
+  return authMethod;
+};
+var mapAuthMethod = (slate, m) => ({
+  id: m.key,
+  name: m.name,
+  type: m.type,
+  scopes: "scopes" in m ? m.scopes.map((s) => ({
+    id: s.scope,
+    title: s.title,
+    description: s.description
+  })) : void 0,
+  inputSchema: toJsonSchema(m.inputSchema ?? z.object({})),
+  outputSchema: toJsonSchema(slate.spec.auth.outputSchema),
+  capabilities: {
+    getDefaultInput: { enabled: !!("getDefaultInput" in m && m.getDefaultInput) },
+    handleTokenRefresh: {
+      enabled: !!("handleTokenRefresh" in m && m.handleTokenRefresh)
+    },
+    handleChangedInput: {
+      enabled: !!m.onInputChanged
+    },
+    getProfile: { enabled: !!m.getProfile }
+  },
+  docs: m.docs ?? []
+});
+var getAction = (slate, actionId) => {
+  let action = slate.actions.find((m) => m.key === actionId);
+  if (!action) {
+    throw new ServiceError2(notFoundError(`action`, actionId));
+  }
+  return action;
+};
+var getAdapter = (slate, adapterId) => {
+  let adapter = slate.adapters.find((m) => m.id === adapterId);
+  if (!adapter) {
+    throw new ServiceError2(notFoundError(`adapter`, adapterId));
+  }
+  return adapter;
+};
+var mapAdapter = (adapter) => ({
+  id: adapter.id,
+  name: adapter.name,
+  capabilities: adapter.capabilities
+});
+var getActionWithType = (slate, type, actionId) => {
+  let action = getAction(slate, actionId);
+  if (action.type !== type) {
+    throw new ServiceError2(
+      badRequestError({
+        message: `Action with ID ${actionId} is not of type ${type}`
+      })
+    );
+  }
+  return action;
+};
+var mapAction = (_slate, a) => {
+  let base = {
+    id: a.key,
+    name: a.name,
+    description: a.description,
+    instructions: a.instructions,
+    constraints: a.constraints,
+    tags: a.tags,
+    metadata: a.metadata,
+    scopes: a.scopes,
+    authMethods: a.authMethods,
+    docs: a.docs ?? [],
+    ...a.adapter ? { adapter: a.adapter } : {},
+    inputSchema: toJsonSchema(a.inputSchema),
+    outputSchema: toJsonSchema(a.outputSchema)
+  };
+  if (a.type === "tool") {
+    return {
+      ...base,
+      type: "action.tool",
+      capabilities: {},
+      isPublic: a.isPublic
+    };
+  }
+  return {
+    ...base,
+    type: "action.trigger",
+    capabilities: {},
+    triggerGroupId: a.triggerGroup.key
+  };
+};
+var isMappableTrigger = (action) => action.type !== "trigger" || !!action.triggerGroup;
+var getMappableAction = (slate, actionId) => {
+  let action = getAction(slate, actionId);
+  if (!isMappableTrigger(action)) {
+    throw new ServiceError2(notFoundError(`action`, actionId));
+  }
+  return action;
+};
+var getTriggerGroup = (slate, triggerGroupId) => {
+  let group = slate.triggerGroups.find((g) => g.key === triggerGroupId);
+  if (!group) {
+    throw new ServiceError2(notFoundError(`trigger_group`, triggerGroupId));
+  }
+  return group;
+};
+var getTriggersForGroup = (slate, triggerGroupId) => slate.actions.filter(
+  (action) => action.type === "trigger" && action.triggerGroup?.key === triggerGroupId
+);
+var evaluateTriggerMatches = (slate, triggerGroupId, payload) => getTriggersForGroup(slate, triggerGroupId).filter((trigger) => trigger.matches(payload)).map((trigger) => trigger.key);
+var getWebhookAutoRegistration = (group) => {
+  if (group.source !== "webhook" || !group.webhook?.autoRegistration) {
+    throw new ServiceError2(
+      badRequestError({
+        message: `Trigger group does not support webhook auto-registration: ${group.key}`
+      })
+    );
+  }
+  return group.webhook.autoRegistration;
+};
+var getWebhookManualRegistration = (group) => {
+  if (group.source !== "webhook" || !group.webhook?.manualRegistration) {
+    throw new ServiceError2(
+      badRequestError({
+        message: `Trigger group does not support manual webhook registration: ${group.key}`
+      })
+    );
+  }
+  return group.webhook.manualRegistration;
+};
+var mapTriggerGroup = (group) => ({
+  id: group.key,
+  name: group.name,
+  description: group.description,
+  metadata: group.metadata,
+  invocation: group.source === "polling" ? {
+    type: "polling",
+    intervalSeconds: group.polling?.intervalSeconds ?? SlateDefaultPollingIntervalSeconds
+  } : {
+    type: "webhook",
+    registration: group.webhook?.manualRegistration ? {
+      mode: "manual",
+      userConfigSchema: toJsonSchema(
+        group.webhook.manualRegistration.userConfigSchema
+      ),
+      fullConfigSchema: toJsonSchema(
+        group.webhook.manualRegistration.fullConfigSchema
+      )
+    } : { mode: "auto" }
+  }
+});
+
+// src/state.ts
+var State = class {
+  #value;
+  get value() {
+    return this.#value;
+  }
+  get() {
+    return this.#value;
+  }
+  set(value) {
+    this.#value = value;
+  }
+  constructor(initialValue) {
+    this.#value = initialValue;
+  }
+};
+
+// src/webhook.ts
+import { badRequestError as badRequestError2, ServiceError as ServiceError3 } from "@lowerdeck/error";
+var SLATE_WEBHOOK_RESPONSE_MAX_BODY_BYTES = 1024 * 1024;
+var serializeBody = (body) => {
+  if (body === null) return null;
+  if (body.byteLength > SLATE_WEBHOOK_RESPONSE_MAX_BODY_BYTES) {
+    throw new ServiceError3(
+      badRequestError2({
+        message: `Webhook response body exceeds the ${SLATE_WEBHOOK_RESPONSE_MAX_BODY_BYTES}-byte limit`
+      })
+    );
+  }
+  return {
+    encoding: "base64",
+    content: Buffer.from(body).toString("base64")
+  };
+};
+var headersToObject = (headers) => {
+  let result = {};
+  headers.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
+};
+var validateStatus = (status) => {
+  if (!Number.isInteger(status) || status < 100 || status > 599) {
+    throw new ServiceError3(
+      badRequestError2({
+        message: "Webhook response status must be an integer between 100 and 599"
+      })
+    );
+  }
+};
+var serializeWebhookHttpResponse = async (response) => {
+  if (response instanceof Response) {
+    validateStatus(response.status);
+    return {
+      status: response.status,
+      headers: headersToObject(response.headers),
+      body: serializeBody(
+        response.body === null ? null : new Uint8Array(await response.arrayBuffer())
+      )
+    };
+  }
+  let status = response.status ?? 200;
+  validateStatus(status);
+  let body = typeof response.body === "string" ? new TextEncoder().encode(response.body) : response.body ?? null;
+  return {
+    status,
+    headers: response.headers ?? {},
+    body: serializeBody(body)
+  };
+};
+
+// src/index.ts
+var DEFAULT_MAX_ATTACHMENT_SIZE_BYTES = 1e8;
+var routeAttachmentsThroughDirectUpload = async (attachments, live) => {
+  if (!attachments || attachments.length === 0 || !live) return attachments;
+  let contentEntries = attachments.map((attachment, index) => ({ attachment, index })).filter((entry) => entry.attachment.content.type === "content");
+  if (contentEntries.length === 0) return attachments;
+  let queue = new PQueue({ concurrency: 10 });
+  let replacements = /* @__PURE__ */ new Map();
+  await Promise.all(
+    contentEntries.map(
+      (entry) => queue.add(async () => {
+        try {
+          let body = entry.attachment.content.type === "content" ? entry.attachment.content.encoding === "base64" ? Buffer.from(entry.attachment.content.content, "base64") : Buffer.from(entry.attachment.content.content, "utf-8") : Buffer.alloc(0);
+          replacements.set(
+            entry.index,
+            await uploadAttachmentDirect({
+              live,
+              mimeType: entry.attachment.mimeType,
+              body
+            })
+          );
+        } catch {
+          replacements.set(entry.index, null);
+        }
+      })
+    )
+  );
+  return attachments.map(
+    (attachment, index) => replacements.has(index) ? replacements.get(index) : attachment
+  ).filter((a) => a != null);
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var getObjectKeyCount = (value) => isRecord(value) ? Object.keys(value).length : void 0;
+var DOWNLOAD_ATTACHMENT_URL_KEYS = /* @__PURE__ */ new Set([
+  "downloadUrl",
+  "fileUrl",
+  "temporaryDownloadUrl",
+  "webContentLink"
+]);
+var isAttachmentUrl = (value) => /^[a-z][a-z0-9+.-]*:\/\//i.test(value);
+var collectOutputUrlAttachments = (value, seen = /* @__PURE__ */ new Set()) => {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => collectOutputUrlAttachments(item, seen));
+  }
+  if (!isRecord(value)) {
+    return [];
+  }
+  let attachments = [];
+  for (let [key, nestedValue] of Object.entries(value)) {
+    if (DOWNLOAD_ATTACHMENT_URL_KEYS.has(key) && typeof nestedValue === "string" && nestedValue.length > 0 && isAttachmentUrl(nestedValue) && !seen.has(nestedValue)) {
+      seen.add(nestedValue);
+      attachments.push({
+        content: {
+          type: "url",
+          url: nestedValue
+        }
+      });
+      continue;
+    }
+    attachments.push(...collectOutputUrlAttachments(nestedValue, seen));
+  }
+  return attachments;
+};
+var mergeAttachments = (explicitAttachments, output) => {
+  let attachments = [...explicitAttachments ?? []];
+  let seen = new Set(attachments.map((attachment) => JSON.stringify(attachment)));
+  for (let attachment of collectOutputUrlAttachments(output)) {
+    let key = JSON.stringify(attachment);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    attachments.push(attachment);
+  }
+  return attachments.length > 0 ? attachments : void 0;
+};
+var toErrorMetadata = (error) => {
+  if (error instanceof Error) {
+    return {
+      errorName: error.name,
+      errorMessage: error.message,
+      errorStack: error.stack
+    };
+  }
+  return {
+    errorValue: String(error)
+  };
+};
+var formatEntityLabel = (name, key) => `"${name}" (${key})`;
+var resolveTraceMessage = (message, result) => typeof message === "function" ? message(result) : message;
+var createProviderHandler = (slate, listeners) => createSlatesProviderProtoHandler(async (manager) => {
+  let protocol = new State(null);
+  let participants = new State(null);
+  let auth = new State(null);
+  let config = new State(null);
+  let session = new State(null);
+  let hubCapabilities = new State(null);
+  let liveInvocation = new State(
+    null
+  );
+  let getLiveInvocation = () => {
+    let directUpload = hubCapabilities.get()?.attachments?.directUpload;
+    let live = liveInvocation.get();
+    if (!directUpload?.enabled || !live) return null;
+    return {
+      ...live,
+      maxAttachmentSizeBytes: directUpload.maxAttachmentSizeBytes ?? DEFAULT_MAX_ATTACHMENT_SIZE_BYTES
+    };
+  };
+  let supportsTriggerGroups = () => !!hubCapabilities.get()?.triggers;
+  let logger = new SlateLogger(listeners);
+  let providerTrace = {
+    providerId: slate.spec.key,
+    providerName: slate.spec.name
+  };
+  let traceProviderCall = async (trace, handler) => {
+    let startedAt = Date.now();
+    logger.info({
+      ...providerTrace,
+      ...trace.metadata,
+      component: trace.component,
+      functionName: trace.functionName,
+      phase: "start",
+      message: trace.message
+    });
+    try {
+      let result = await handler();
+      let successMessage = resolveTraceMessage(trace.successMessage, result);
+      logger.info({
+        ...providerTrace,
+        ...trace.metadata,
+        ...trace.onSuccess?.(result) ?? {},
+        component: trace.component,
+        functionName: trace.functionName,
+        phase: "success",
+        durationMs: Date.now() - startedAt,
+        message: successMessage
+      });
+      return result;
+    } catch (error) {
+      logger.error({
+        ...providerTrace,
+        ...trace.metadata,
+        ...toErrorMetadata(error),
+        component: trace.component,
+        functionName: trace.functionName,
+        phase: "error",
+        durationMs: Date.now() - startedAt,
+        message: trace.errorMessage ?? `${typeof trace.successMessage === "string" ? trace.successMessage : trace.message} failed`
+      });
+      throw error;
+    }
+  };
+  let getContextBasic = () => {
+    let currentProtocol = protocol.get();
+    let currentParticipants = participants.get();
+    if (!currentProtocol || !currentParticipants) {
+      throw new ServiceError4(
+        preconditionFailedError({
+          message: "Connection context has not been initialized"
+        })
+      );
+    }
+    return {
+      protocol: currentProtocol,
+      participants: currentParticipants
+    };
+  };
+  let getContextFull = () => {
+    let basic = getContextBasic();
+    let currentConfig = config.get();
+    let currentSession = session.get();
+    let currentAuth = auth.get();
+    if (!currentConfig || !currentSession || !currentAuth && slate.spec.auth.authStack.length > 0) {
+      throw new ServiceError4(
+        preconditionFailedError({
+          message: "Session context has not been initialized"
+        })
+      );
+    }
+    return {
+      ...basic,
+      config: currentConfig.value,
+      session: currentSession,
+      auth: currentAuth
+    };
+  };
+  let getAuthConfig = () => config.get()?.value ?? {};
+  let getEmptyContext = () => new SlateContext({}, {}, {}, slate.spec, logger);
+  let getAuthContext = () => new SlateContext(getAuthConfig(), {}, {}, slate.spec, logger);
+  let withRequestTraces = (context, result) => {
+    let requestTraces = context.getHttpTraces();
+    return requestTraces.length > 0 ? { ...result, requestTraces } : result;
+  };
+  manager.onNotification("slates/hello", async ({ params }) => {
+    protocol.set(params.protocol);
+  });
+  manager.onNotification("slates/participant.set", async ({ params }) => {
+    if (!protocol.get()) {
+      throw new ServiceError4(
+        preconditionFailedError({ message: "Connection protocol has not been initialized" })
+      );
+    }
+    participants.set(params.participants);
+  });
+  manager.onNotification("slates/auth.set", async ({ params }) => {
+    getContextBasic();
+    getAuthMethod(slate, params.authenticationMethodId);
+    let valRes = validate(
+      slate.spec.authSchema,
+      params.output,
+      "auth",
+      `Invalid authentication output for method ID: ${params.authenticationMethodId}`
+    );
+    auth.set({
+      authenticationMethodId: params.authenticationMethodId,
+      output: valRes
+    });
+  });
+  manager.onNotification("slates/config.set", async ({ params }) => {
+    getContextBasic();
+    let value = validate(
+      slate.spec.configSchema,
+      params.config,
+      "config",
+      "Invalid configuration"
+    );
+    config.set({ value });
+  });
+  manager.onNotification("slates/session.start", async ({ params }) => {
+    getContextBasic();
+    session.set({
+      id: params.sessionId,
+      state: params.state
+    });
+  });
+  manager.onNotification("slates/hub.capabilities.set", async ({ params }) => {
+    hubCapabilities.set(params.capabilities);
+  });
+  manager.onNotification("slates/hub.live_invocation.set", async ({ params }) => {
+    liveInvocation.set({
+      token: params.token,
+      baseUrl: params.baseUrl
+    });
+  });
+  manager.onRequest("slates/provider.capabilities.get", async () => ({
+    capabilities: {
+      hub: {
+        capabilitiesNotification: true,
+        liveInvocation: true
+      },
+      provider: {
+        triggerGroups: (slate.triggerGroups?.length ?? 0) > 0 && (slate.actions ?? []).every(isMappableTrigger)
+      }
+    }
+  }));
+  manager.onRequest("slates/config.changed", async ({ params }) => {
+    getContextBasic();
+    let newConfig = validate(
+      slate.spec.config.configSchema,
+      params.newConfig,
+      "config",
+      "Invalid configuration"
+    );
+    let configChanged = slate.spec.config.handlers.configChanged;
+    if (!configChanged) {
+      return { success: true, config: newConfig };
+    }
+    let context = getEmptyContext();
+    let updatedConfig = await traceProviderCall(
+      {
+        component: "config",
+        functionName: "configChanged",
+        message: "Running config change handler",
+        successMessage: "Config change handler completed",
+        metadata: {
+          hasPreviousConfig: params.previousConfig !== null,
+          newConfigKeyCount: getObjectKeyCount(newConfig)
+        },
+        onSuccess: (result) => ({
+          returnedConfig: !!result?.config
+        })
+      },
+      () => runWithContext(
+        context,
+        async () => configChanged({
+          previousConfig: params.previousConfig,
+          newConfig
+        })
+      )
+    );
+    return withRequestTraces(context, {
+      success: true,
+      config: updatedConfig?.config ?? newConfig
+    });
+  });
+  manager.onRequest("slates/config.get_default", async () => {
+    getContextBasic();
+    let getDefaultConfig = slate.spec.config.handlers.getDefaultConfig;
+    if (!getDefaultConfig) {
+      return { config: null };
+    }
+    let context = getEmptyContext();
+    let defaultConfig = await traceProviderCall(
+      {
+        component: "config",
+        functionName: "getDefaultConfig",
+        message: "Getting default config",
+        successMessage: "Default config retrieved",
+        onSuccess: (result) => ({
+          configKeyCount: getObjectKeyCount(result)
+        })
+      },
+      () => runWithContext(context, async () => getDefaultConfig())
+    );
+    return withRequestTraces(context, {
+      config: defaultConfig ?? null
+    });
+  });
+  manager.onRequest("slates/config.schema.get", async () => {
+    getContextBasic();
+    return {
+      schema: toJsonSchema(slate.spec.configSchema),
+      docs: slate.spec.config.docsReferences ?? []
+    };
+  });
+  manager.onRequest("slates/provider.identify", async () => {
+    getContextBasic();
+    return {
+      protocol: SLATES_PROTOCOL_VERSION,
+      provider: {
+        type: "provider",
+        id: slate.spec.key,
+        name: slate.spec.name,
+        description: slate.spec.description,
+        metadata: slate.spec.parameters.metadata
+      },
+      docs: slate.spec.docs ?? []
+    };
+  });
+  manager.onRequest("slates/auth.methods.list", async () => {
+    getContextBasic();
+    return {
+      authenticationMethods: slate.spec.auth.authStack.map((m) => mapAuthMethod(slate, m))
+    };
+  });
+  manager.onRequest("slates/auth.method.get", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    return {
+      authenticationMethod: mapAuthMethod(slate, authMethod)
+    };
+  });
+  manager.onRequest("slates/auth.input.get_default", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if (!authMethod.getDefaultInput) {
+      return { input: null };
+    }
+    let context = getEmptyContext();
+    let input = await traceProviderCall(
+      {
+        component: "auth",
+        functionName: "getDefaultInput",
+        message: "Getting default authentication input",
+        successMessage: "Default authentication input retrieved",
+        metadata: {
+          authenticationMethodId: params.authenticationMethodId,
+          authenticationMethodName: authMethod.name
+        },
+        onSuccess: (result) => ({
+          inputKeyCount: getObjectKeyCount(result)
+        })
+      },
+      () => runWithContext(context, () => authMethod.getDefaultInput())
+    );
+    return withRequestTraces(context, { input });
+  });
+  manager.onRequest("slates/auth.input.changed", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if (!authMethod.onInputChanged) {
+      return { success: true, input: params.newInput };
+    }
+    let context = getEmptyContext();
+    let updatedInput = await traceProviderCall(
+      {
+        component: "auth",
+        functionName: "onInputChanged",
+        message: "Running authentication input change handler",
+        successMessage: "Authentication input change handler completed",
+        metadata: {
+          authenticationMethodId: params.authenticationMethodId,
+          authenticationMethodName: authMethod.name,
+          hasPreviousInput: params.previousInput !== null,
+          newInputKeyCount: getObjectKeyCount(params.newInput)
+        },
+        onSuccess: (result) => ({
+          returnedInput: !!result?.input
+        })
+      },
+      () => runWithContext(
+        context,
+        () => authMethod.onInputChanged({
+          previousInput: params.previousInput,
+          newInput: params.newInput
+        })
+      )
+    );
+    return withRequestTraces(context, {
+      success: true,
+      input: updatedInput?.input ?? params.newInput
+    });
+  });
+  manager.onRequest("slates/auth.output.get", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    let input = params.input;
+    if (authMethod.inputSchema) {
+      input = validate(
+        authMethod.inputSchema,
+        input,
+        "auth",
+        `Invalid authentication input for method ID: ${params.authenticationMethodId}`
+      );
+    }
+    if ("getOutput" in authMethod) {
+      let context = getAuthContext();
+      let outputRes = await traceProviderCall(
+        {
+          component: "auth",
+          functionName: "getOutput",
+          message: "Getting authentication output",
+          successMessage: "Authentication output retrieved",
+          metadata: {
+            authenticationMethodId: params.authenticationMethodId,
+            authenticationMethodName: authMethod.name,
+            inputKeyCount: getObjectKeyCount(input)
+          },
+          onSuccess: (result) => ({
+            outputKeyCount: getObjectKeyCount(result.output),
+            scopeCount: result.scopes?.length ?? 0
+          })
+        },
+        () => runWithContext(
+          context,
+          () => authMethod.getOutput({
+            input,
+            config: getAuthConfig()
+          })
+        )
+      );
+      return withRequestTraces(context, {
+        output: outputRes.output,
+        scopes: outputRes.scopes
+      });
+    }
+    return { output: input };
+  });
+  manager.onRequest("slates/auth.authorization_callback.handle", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if ("handleCallback" in authMethod) {
+      let context = getEmptyContext();
+      let callbackRes = await traceProviderCall(
+        {
+          component: "auth",
+          functionName: "handleCallback",
+          message: "Handling authentication callback",
+          successMessage: "Authentication callback handled",
+          metadata: {
+            authenticationMethodId: params.authenticationMethodId,
+            authenticationMethodName: authMethod.name,
+            scopeCount: params.scopes.length,
+            hasCallbackState: !!params.callbackState
+          },
+          onSuccess: (result) => ({
+            outputKeyCount: getObjectKeyCount(result.output),
+            returnedInput: !!result.input,
+            returnedScopeCount: result.scopes?.length
+          })
+        },
+        () => runWithContext(
+          context,
+          () => authMethod.handleCallback({
+            code: params.code,
+            state: params.state,
+            redirectUri: params.redirectUri,
+            input: params.input,
+            clientId: params.clientId,
+            clientSecret: params.clientSecret,
+            scopes: params.scopes,
+            callbackParams: params.callbackParams || {},
+            callbackState: params.callbackState || {},
+            config: getAuthConfig()
+          })
+        )
+      );
+      return withRequestTraces(context, {
+        output: callbackRes.output,
+        input: callbackRes.input,
+        scopes: callbackRes.scopes
+      });
+    }
+    throw new ServiceError4(
+      preconditionFailedError({
+        message: `Authentication method does not support authorization callback handling: ${params.authenticationMethodId}`
+      })
+    );
+  });
+  manager.onRequest("slates/auth.authorization_url.get", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if ("getAuthorizationUrl" in authMethod) {
+      let context = getEmptyContext();
+      let urlRes = await traceProviderCall(
+        {
+          component: "auth",
+          functionName: "getAuthorizationUrl",
+          message: "Getting authentication authorization URL",
+          successMessage: "Authentication authorization URL retrieved",
+          metadata: {
+            authenticationMethodId: params.authenticationMethodId,
+            authenticationMethodName: authMethod.name,
+            scopeCount: params.scopes.length,
+            inputKeyCount: getObjectKeyCount(params.input)
+          },
+          onSuccess: (result) => ({
+            returnedInput: !!result.input,
+            hasCallbackState: !!result.callbackState
+          })
+        },
+        () => runWithContext(
+          context,
+          () => authMethod.getAuthorizationUrl({
+            redirectUri: params.redirectUri,
+            state: params.state,
+            input: params.input,
+            clientId: params.clientId,
+            clientSecret: params.clientSecret,
+            scopes: params.scopes,
+            config: getAuthConfig()
+          })
+        )
+      );
+      return withRequestTraces(context, {
+        authorizationUrl: urlRes.url,
+        input: urlRes.input,
+        callbackState: urlRes.callbackState
+      });
+    }
+    throw new ServiceError4(
+      preconditionFailedError({
+        message: `Authentication method does not support authorization URL retrieval: ${params.authenticationMethodId}`
+      })
+    );
+  });
+  manager.onRequest("slates/auth.profile.get", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if (authMethod.getProfile) {
+      let context = getAuthContext();
+      let profileRes = await traceProviderCall(
+        {
+          component: "auth",
+          functionName: "getProfile",
+          message: "Getting authentication profile",
+          successMessage: "Authentication profile retrieved",
+          metadata: {
+            authenticationMethodId: params.authenticationMethodId,
+            authenticationMethodName: authMethod.name,
+            scopeCount: params.scopes.length,
+            inputKeyCount: getObjectKeyCount(params.input),
+            outputKeyCount: getObjectKeyCount(params.output)
+          },
+          onSuccess: (result) => ({
+            profileKeyCount: getObjectKeyCount(result.profile)
+          })
+        },
+        () => runWithContext(context, () => {
+          if (authMethod.type === "auth.oauth") {
+            return authMethod.getProfile({
+              output: params.output,
+              input: params.input,
+              scopes: params.scopes,
+              config: getAuthConfig()
+            });
+          }
+          return authMethod.getProfile({
+            output: params.output,
+            input: params.input,
+            scopes: params.scopes,
+            config: getAuthConfig()
+          });
+        })
+      );
+      return withRequestTraces(context, {
+        profile: profileRes.profile
+      });
+    }
+    throw new ServiceError4(
+      preconditionFailedError({
+        message: `Authentication method does not support profile retrieval: ${params.authenticationMethodId}`
+      })
+    );
+  });
+  manager.onRequest("slates/auth.token_refresh.handle", async ({ params }) => {
+    getContextBasic();
+    let authMethod = getAuthMethod(slate, params.authenticationMethodId);
+    if ("handleTokenRefresh" in authMethod && authMethod.handleTokenRefresh) {
+      let context = getAuthContext();
+      let refreshRes = await traceProviderCall(
+        {
+          component: "auth",
+          functionName: "handleTokenRefresh",
+          message: "Refreshing authentication token",
+          successMessage: "Authentication token refreshed",
+          metadata: {
+            authenticationMethodId: params.authenticationMethodId,
+            authenticationMethodName: authMethod.name,
+            scopeCount: params.scopes.length,
+            inputKeyCount: getObjectKeyCount(params.input),
+            outputKeyCount: getObjectKeyCount(params.output)
+          },
+          onSuccess: (result) => ({
+            refreshedOutputKeyCount: getObjectKeyCount(result.output),
+            returnedInput: !!result.input
+          })
+        },
+        () => runWithContext(context, () => {
+          if (authMethod.type === "auth.oauth") {
+            return authMethod.handleTokenRefresh({
+              output: params.output,
+              input: params.input,
+              clientId: params.clientId,
+              clientSecret: params.clientSecret,
+              scopes: params.scopes,
+              config: getAuthConfig()
+            });
+          }
+          return authMethod.handleTokenRefresh({
+            output: params.output,
+            input: params.input,
+            clientId: params.clientId,
+            clientSecret: params.clientSecret,
+            scopes: params.scopes,
+            config: getAuthConfig()
+          });
+        })
+      );
+      return withRequestTraces(context, {
+        output: refreshRes.output,
+        input: refreshRes.input
+      });
+    }
+    throw new ServiceError4(
+      preconditionFailedError({
+        message: `Authentication method does not support token refresh handling: ${params.authenticationMethodId}`
+      })
+    );
+  });
+  manager.onRequest("slates/actions.list", async ({ params }) => {
+    getContextBasic();
+    let actions = params.includeAdapterActions ? slate.actions : slate.actions.filter((action) => !action.adapter);
+    actions = actions.filter(isMappableTrigger);
+    if (!supportsTriggerGroups()) {
+      actions = actions.filter((action) => action.type !== "trigger");
+    }
+    return {
+      actions: actions.map((a) => mapAction(slate, a))
+    };
+  });
+  manager.onRequest("slates/adapters.list", async () => {
+    getContextBasic();
+    return {
+      adapters: slate.adapters.map(mapAdapter)
+    };
+  });
+  manager.onRequest("slates/adapter.get", async ({ params }) => {
+    getContextBasic();
+    let adapter = getAdapter(slate, params.adapterId);
+    return {
+      adapter: mapAdapter(adapter)
+    };
+  });
+  manager.onRequest("slates/action.get", async ({ params }) => {
+    getContextBasic();
+    let action = getMappableAction(slate, params.actionId);
+    return {
+      action: mapAction(slate, action)
+    };
+  });
+  manager.onRequest("slates/trigger_groups.list", async () => {
+    getContextBasic();
+    return {
+      triggerGroups: slate.triggerGroups.map(mapTriggerGroup)
+    };
+  });
+  manager.onRequest("slates/trigger_group.get", async ({ params }) => {
+    getContextBasic();
+    let triggerGroup = getTriggerGroup(slate, params.triggerGroupId);
+    return {
+      triggerGroup: mapTriggerGroup(triggerGroup)
+    };
+  });
+  manager.onRequest("slates/action.tool.invoke", async ({ params }) => {
+    let action = getActionWithType(slate, "tool", params.actionId);
+    let input = validate(
+      action.inputSchema,
+      params.input,
+      "input",
+      `Invalid input for tool ID: ${params.actionId}`
+    );
+    let invoke = async (context) => {
+      let res = await traceProviderCall(
+        {
+          component: "action",
+          functionName: "handleInvocation",
+          message: `Starting tool ${formatEntityLabel(action.name, action.key)}`,
+          successMessage: `Completed tool ${formatEntityLabel(action.name, action.key)}`,
+          errorMessage: `Tool ${formatEntityLabel(action.name, action.key)} failed`,
+          metadata: {
+            actionId: action.key,
+            actionName: action.name,
+            actionType: action.type,
+            isPublic: action.isPublic,
+            inputKeyCount: getObjectKeyCount(input)
+          },
+          onSuccess: (result) => ({
+            hasMessage: !!result.message,
+            actionResultMessage: result.message,
+            outputKeyCount: getObjectKeyCount(result.output),
+            attachmentCount: result.attachments?.length
+          })
+        },
+        () => runWithContext(context, () => action.handleInvocation(context))
+      );
+      let contextAttachments = await context._finalizeAttachments();
+      let merged = mergeAttachments(
+        [...res.attachments ?? [], ...contextAttachments],
+        res.output
+      );
+      let redacted = redactUrlAttachmentSecrets(
+        merged,
+        context._getAuthConfigForRedaction()
+      );
+      let finalAttachments = await routeAttachmentsThroughDirectUpload(
+        redacted,
+        getLiveInvocation()
+      );
+      return withRequestTraces(context, {
+        output: res.output,
+        message: res.message,
+        attachments: finalAttachments
+      });
+    };
+    if (action.isPublic) {
+      getContextBasic();
+      return invoke(new SlatePublicContext(input, slate.spec, logger, getLiveInvocation()));
+    }
+    let ctx = getContextFull();
+    return invoke(
+      new SlateContext(
+        ctx.config,
+        input,
+        ctx.auth?.output,
+        slate.spec,
+        logger,
+        getLiveInvocation()
+      )
+    );
+  });
+  manager.onRequest("slates/action.trigger.map_event", async ({ params }) => {
+    let ctx = getContextFull();
+    let action = getActionWithType(slate, "trigger", params.actionId);
+    let input = validate(
+      action.inputSchema,
+      params.input,
+      "input",
+      `Invalid event for trigger ID: ${params.actionId}`
+    );
+    let context = new SlateContext(ctx.config, input, ctx.auth?.output, slate.spec, logger);
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "handleEvent",
+        message: `Mapping event for trigger ${formatEntityLabel(action.name, action.key)}`,
+        successMessage: (result) => `Mapped trigger event "${result.type}" for ${formatEntityLabel(action.name, action.key)}`,
+        errorMessage: `Trigger ${formatEntityLabel(action.name, action.key)} failed while mapping an event`,
+        metadata: {
+          actionId: action.key,
+          actionName: action.name,
+          actionType: action.type,
+          inputKeyCount: getObjectKeyCount(input)
+        },
+        onSuccess: (result) => ({
+          eventType: result.type,
+          hasEventId: !!result.id,
+          outputKeyCount: getObjectKeyCount(result.output)
+        })
+      },
+      () => runWithContext(context, () => action.map(context))
+    );
+    return withRequestTraces(context, { id: res.id, type: res.type, output: res.output });
+  });
+  manager.onRequest("slates/action.trigger.poll_events", async ({ params }) => {
+    getContextBasic();
+    if (supportsTriggerGroups()) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Legacy trigger polling is disabled once trigger_group support is announced: ${params.actionId}`
+        })
+      );
+    }
+    return { inputs: [], updatedState: params.state };
+  });
+  manager.onRequest("slates/action.trigger.webhook_handle", async ({ params }) => {
+    getContextBasic();
+    if (supportsTriggerGroups()) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Legacy trigger webhook handling is disabled once trigger_group support is announced: ${params.actionId}`
+        })
+      );
+    }
+    return { inputs: [], updatedState: params.state, response: null };
+  });
+  manager.onRequest("slates/action.trigger.webhook_register", async ({ params }) => {
+    getContextBasic();
+    if (supportsTriggerGroups()) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Legacy trigger webhook registration is disabled once trigger_group support is announced: ${params.actionId}`
+        })
+      );
+    }
+    return { registrationDetails: null };
+  });
+  manager.onRequest("slates/action.trigger.webhook_unregister", async ({ params }) => {
+    getContextBasic();
+    if (supportsTriggerGroups()) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Legacy trigger webhook unregistration is disabled once trigger_group support is announced: ${params.actionId}`
+        })
+      );
+    }
+    return {};
+  });
+  manager.onRequest("slates/trigger_group.webhook.targets_list", async ({ params }) => {
+    let ctx = getContextFull();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let autoRegistration = getWebhookAutoRegistration(group);
+    let context = new SlateContext(
+      ctx.config,
+      { pageToken: params.pageToken ?? null },
+      ctx.auth?.output,
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookTargetList",
+        message: `Listing webhook targets for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: (result) => `Listed ${result.targets.length} webhook target(s) for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while listing webhook targets`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name
+        },
+        onSuccess: (result) => ({
+          targetCount: result.targets.length,
+          hasNextPageToken: result.nextPageToken !== null
+        })
+      },
+      () => runWithContext(context, () => autoRegistration.webhookTargetList(context))
+    );
+    return withRequestTraces(context, {
+      targets: res.targets,
+      nextPageToken: res.nextPageToken ?? null
+    });
+  });
+  manager.onRequest("slates/trigger_group.webhook.register", async ({ params }) => {
+    let ctx = getContextFull();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let autoRegistration = getWebhookAutoRegistration(group);
+    let context = new SlateContext(
+      ctx.config,
+      {
+        webhookTargetIdentifier: params.webhookTargetIdentifier,
+        webhookTargetPayload: params.webhookTargetPayload,
+        webhookUrl: params.webhookUrl
+      },
+      ctx.auth?.output,
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookRegister",
+        message: `Registering webhook for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: `Registered webhook for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while registering a webhook`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name,
+          webhookTargetIdentifier: params.webhookTargetIdentifier
+        }
+      },
+      () => runWithContext(context, () => autoRegistration.webhookRegister(context))
+    );
+    return withRequestTraces(context, {
+      webhookRegistrationIdentifier: res.webhookRegistrationIdentifier,
+      webhookRegistrationPayload: res.webhookRegistrationPayload
+    });
+  });
+  manager.onRequest("slates/trigger_group.webhook.unregister", async ({ params }) => {
+    let ctx = getContextFull();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let autoRegistration = getWebhookAutoRegistration(group);
+    let context = new SlateContext(
+      ctx.config,
+      {
+        webhookRegistrationIdentifier: params.webhookRegistrationIdentifier,
+        webhookRegistrationPayload: params.webhookRegistrationPayload
+      },
+      ctx.auth?.output,
+      slate.spec,
+      logger
+    );
+    await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookUnregister",
+        message: `Unregistering webhook for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: `Unregistered webhook for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while unregistering a webhook`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name,
+          webhookRegistrationIdentifier: params.webhookRegistrationIdentifier
+        }
+      },
+      () => runWithContext(context, () => autoRegistration.webhookUnregister(context))
+    );
+    return withRequestTraces(context, {});
+  });
+  manager.onRequest("slates/trigger_group.webhook.manual_setup", async ({ params }) => {
+    getContextBasic();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let manualRegistration = getWebhookManualRegistration(group);
+    let context = new SlateContext(
+      {},
+      { webhookUrl: params.webhookUrl },
+      {},
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookManualSetup",
+        message: `Building manual webhook setup for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: `Built manual webhook setup for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while building a manual webhook setup`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name
+        }
+      },
+      () => runWithContext(context, () => manualRegistration.setup(context))
+    );
+    return {
+      webhookSetupDocument: res.webhookSetupDocument,
+      partialWebhookRegistrationPayload: res.partialWebhookRegistrationPayload
+    };
+  });
+  manager.onRequest("slates/trigger_group.webhook.manual_finish", async ({ params }) => {
+    getContextBasic();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let manualRegistration = getWebhookManualRegistration(group);
+    if (!manualRegistration.finish) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Trigger group does not support manual webhook finish: ${params.triggerGroupId}`
+        })
+      );
+    }
+    let context = new SlateContext(
+      {},
+      {
+        webhookUrl: params.webhookUrl,
+        partialWebhookRegistrationPayload: params.partialWebhookRegistrationPayload,
+        userWebhookRegistrationPayload: params.userWebhookRegistrationPayload
+      },
+      {},
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookManualFinish",
+        message: `Finishing manual webhook setup for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: `Finished manual webhook setup for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while finishing a manual webhook setup`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name
+        }
+      },
+      () => runWithContext(context, () => manualRegistration.finish(context))
+    );
+    return withRequestTraces(context, {
+      webhookRegistrationPayload: res.webhookRegistrationPayload
+    });
+  });
+  manager.onRequest("slates/trigger_group.webhook.process", async ({ params }) => {
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    if (group.source !== "webhook" || !group.webhook) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Trigger group does not support webhook processing: ${params.triggerGroupId}`
+        })
+      );
+    }
+    let req = new Request(params.url, {
+      method: params.method,
+      headers: params.headers,
+      body: params.body ? Uint8Array.from(atob(params.body.content), (c) => c.charCodeAt(0)) : null
+    });
+    let context = new SlateContext(
+      {},
+      {
+        request: req,
+        webhookRegistrationPayload: params.webhookRegistrationPayload
+      },
+      {},
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "webhookProcess",
+        message: `Processing webhook request for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: (result) => `Extracted ${result.events.length} event(s) from webhook request for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while processing a webhook request`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name,
+          requestMethod: params.method,
+          hasRequestBody: !!params.body
+        },
+        onSuccess: (result) => ({
+          eventCount: result.events.length,
+          hasResponse: result.response !== void 0
+        })
+      },
+      () => runWithContext(context, () => group.webhook.process(context))
+    );
+    for (let event of res.events) {
+      if (!event.matchers) {
+        throw new ServiceError4(
+          preconditionFailedError({
+            message: `Trigger group "${group.key}" process handler must return matchers for every event (return [] if there is nothing to assert)`
+          })
+        );
+      }
+    }
+    let response = res.response === void 0 ? void 0 : await serializeWebhookHttpResponse(res.response);
+    return withRequestTraces(context, {
+      events: res.events.map((event) => ({
+        matchers: event.matchers,
+        payload: event.payload,
+        idempotencyKey: event.idempotencyKey,
+        triggerIds: evaluateTriggerMatches(slate, group.key, event.payload)
+      })),
+      response
+    });
+  });
+  manager.onRequest("slates/trigger_group.routing_matchers.get", async ({ params }) => {
+    let ctx = getContextFull();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    let context = new SlateContext(ctx.config, {}, ctx.auth?.output, slate.spec, logger);
+    let matchers = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "routingMatchers",
+        message: `Getting routing matchers for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: (result) => `Retrieved ${result.length} routing matcher(s) for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while getting routing matchers`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name
+        },
+        onSuccess: (result) => ({
+          matcherCount: result.length
+        })
+      },
+      () => runWithContext(context, () => group.routingMatchers(context))
+    );
+    return withRequestTraces(context, { matchers });
+  });
+  manager.onRequest("slates/trigger_group.polling.poll", async ({ params }) => {
+    let ctx = getContextFull();
+    let group = getTriggerGroup(slate, params.triggerGroupId);
+    if (group.source !== "polling" || !group.polling) {
+      throw new ServiceError4(
+        badRequestError3({
+          message: `Trigger group does not support polling: ${params.triggerGroupId}`
+        })
+      );
+    }
+    let context = new SlateContext(
+      ctx.config,
+      { state: params.state },
+      ctx.auth?.output,
+      slate.spec,
+      logger
+    );
+    let res = await traceProviderCall(
+      {
+        component: "action",
+        functionName: "pollEvents",
+        message: `Polling events for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        successMessage: (result) => `Polled ${result.events.length} event(s) for trigger group ${formatEntityLabel(group.name, group.key)}`,
+        errorMessage: `Trigger group ${formatEntityLabel(group.name, group.key)} failed while polling events`,
+        metadata: {
+          triggerGroupId: group.key,
+          triggerGroupName: group.name,
+          hasPreviousState: params.state !== null
+        },
+        onSuccess: (result) => ({
+          eventCount: result.events.length,
+          hasUpdatedState: result.updatedState !== void 0
+        })
+      },
+      () => runWithContext(context, () => group.polling.pollEvents(context))
+    );
+    return withRequestTraces(context, {
+      updatedState: res.updatedState,
+      events: res.events.map((event) => ({
+        payload: event.payload,
+        idempotencyKey: event.idempotencyKey,
+        triggerIds: evaluateTriggerMatches(slate, group.key, event.payload)
+      }))
+    });
+  });
+});
+export {
+  createProviderHandler
+};