@slates/provider 1.0.0-rc.27 → 1.0.0-rc.29

package/dist/index.module.js

@@ -64,380 +64,639 @@ var SlateAction = class {
 
 // src/error/api.ts
 import { badRequestError, ServiceError } from "@lowerdeck/error";
-var DEFAULT_DETAIL_KEYS = ["message", "detail", "error", "error_description", "code"];
-var DEFAULT_NESTED_KEYS = ["errors"];
-var isApiErrorRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var pushDetail = (details, value, options = {}) => {
-  if (typeof value !== "string" && (options.includeNumbers === false || typeof value !== "number")) {
-    return;
-  }
-  let detail = String(value).trim();
-  if (detail && !details.includes(detail)) {
-    details.push(detail);
-  }
-};
-var collectApiErrorDetails = (value, details, options = {}) => {
-  if (Array.isArray(value)) {
-    for (let item of value) {
-      collectApiErrorDetails(item, details, options);
-    }
-    return;
-  }
-  if (!isApiErrorRecord(value)) {
-    pushDetail(details, value, options);
-    return;
-  }
-  for (let key of options.detailKeys ?? DEFAULT_DETAIL_KEYS) {
-    pushDetail(details, value[key], options);
+
+// src/auth/redact.ts
+var AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX = "$$MT$secret$authConfig$";
+var ALWAYS = () => true;
+var AuthConfigSecretRedactor = class {
+  // A value shared by several fields keeps every path, so a filter that rejects one
+  // field (e.g. `username`) can still match another (e.g. `token`) with the same value.
+  secretToPaths = /* @__PURE__ */ new Map();
+  constructor(authConfig) {
+    if (authConfig) this.buildSecretMap(authConfig);
   }
-  for (let key of options.nestedKeys ?? DEFAULT_NESTED_KEYS) {
-    collectApiErrorDetails(value[key], details, options);
+  redact(value, wholeValue = ALWAYS) {
+    return this.transform(value, (stringValue) => {
+      return this.placeholderFor(stringValue, wholeValue) ?? stringValue;
+    });
   }
-};
-var getSlateErrorResponse = (error) => {
-  if (error.name !== "SlateError" || !isApiErrorRecord(error.data)) {
-    return void 0;
+  /**
+   * `embeddable` limits which secrets are also replaced inside longer strings;
+   * `wholeValue` limits which secrets replace a string that equals them exactly.
+   */
+  redactEmbedded(value, embeddable = ALWAYS, wholeValue = ALWAYS) {
+    let embeddedPlaceholders = /* @__PURE__ */ new Map();
+    for (let secret of this.secretToPaths.keys()) {
+      let placeholder = this.placeholderFor(secret, embeddable);
+      if (placeholder) embeddedPlaceholders.set(secret, placeholder);
+    }
+    if (embeddedPlaceholders.size === 0) return this.redact(value, wholeValue);
+    let pattern = new RegExp(
+      [...embeddedPlaceholders.keys()].sort((a, b) => b.length - a.length).map((secret) => secret.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"),
+      "g"
+    );
+    return this.transform(value, (stringValue) => {
+      let exactPlaceholder = this.placeholderFor(stringValue, wholeValue);
+      if (exactPlaceholder) return exactPlaceholder;
+      return stringValue.replace(pattern, (secret) => `${embeddedPlaceholders.get(secret)}$$`);
+    });
   }
-  let data = error.data;
-  let upstream = isApiErrorRecord(data.upstream) ? data.upstream : void 0;
-  let status = upstream?.status ?? data.status;
-  return typeof status === "number" || typeof status === "string" ? { status } : void 0;
-};
-var getApiErrorResponse = (error) => {
-  if (!isApiErrorRecord(error)) {
+  // The last registered path that passes the filter wins, matching the historical
+  // last-write-wins behavior when no filter is given.
+  placeholderFor(value, filter) {
+    let paths = this.secretToPaths.get(value);
+    if (!paths) return void 0;
+    for (let index = paths.length - 1; index >= 0; index--) {
+      let path = paths[index];
+      if (path !== void 0 && filter(value, path))
+        return `${AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX}${path}`;
+    }
     return void 0;
   }
-  if (!isApiErrorRecord(error.response)) {
-    return getSlateErrorResponse(error);
-  }
-  let response = error.response;
-  return {
-    status: typeof response.status === "number" || typeof response.status === "string" ? response.status : void 0,
-    statusText: typeof response.statusText === "string" ? response.statusText : void 0,
-    data: response.data
-  };
-};
-var getApiErrorStatus = (error) => getApiErrorResponse(error)?.status;
-var statusLabelForApiError = (status, statusText) => status !== void 0 ? `HTTP ${status}${statusText ? ` ${statusText}` : ""}: ` : "";
-var extractApiErrorMessage = (error, options = {}) => {
-  let details = [];
-  let response = options.response ?? getApiErrorResponse(error);
-  collectApiErrorDetails(response?.data, details, options);
-  if (details.length > 0) {
-    return details.join(options.separator ?? " - ");
-  }
-  if (error instanceof Error && error.message) {
-    return error.message;
-  }
-  return options.fallbackMessage ?? "Unknown error";
-};
-var createApiServiceError = (message, options = {}) => {
-  let error = new ServiceError(badRequestError({ message }));
-  if (options.reason !== void 0) {
-    error.data.reason = options.reason;
-  }
-  if ("upstreamStatus" in options) {
-    error.data.upstreamStatus = options.upstreamStatus;
+  buildSecretMap(value, path = []) {
+    if (typeof value === "string") {
+      if (value.length === 0) return;
+      let paths = this.secretToPaths.get(value);
+      if (paths) paths.push(path.join("."));
+      else this.secretToPaths.set(value, [path.join(".")]);
+      return;
+    }
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        this.buildSecretMap(item, [...path, String(index)]);
+      });
+      return;
+    }
+    if (this.isPlainObject(value)) {
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        this.buildSecretMap(nestedValue, [...path, key]);
+      });
+    }
   }
-  if ("upstreamCode" in options) {
-    error.data.upstreamCode = options.upstreamCode;
+  transform(value, transformString) {
+    if (typeof value === "string") {
+      return transformString(value);
+    }
+    if (Array.isArray(value)) {
+      return value.map((item) => this.transform(item, transformString));
+    }
+    if (this.isPlainObject(value)) {
+      let result = {};
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        result[key] = this.transform(nestedValue, transformString);
+      });
+      return result;
+    }
+    return value;
   }
-  if (options.parent instanceof Error) {
-    error.setParent(options.parent);
+  isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
   }
-  return error;
-};
-var helpers = {
-  collectDetails: collectApiErrorDetails,
-  extractMessage: extractApiErrorMessage,
-  getResponse: getApiErrorResponse,
-  getStatus: getApiErrorStatus,
-  isRecord: isApiErrorRecord,
-  statusLabelFor: statusLabelForApiError
 };
-var buildApiServiceError = (error, options) => {
-  if (error instanceof ServiceError) {
-    return error;
-  }
-  let operation = options.operation ?? "request";
-  let response = options.extractResponse?.(error, helpers) ?? getApiErrorResponse(error);
-  let status = options.extractStatus?.(error, response, helpers) ?? response?.status;
-  let message = options.extractMessage?.(error, helpers) ?? extractApiErrorMessage(error, { ...options, response });
-  let statusLabel = statusLabelForApiError(status, response?.statusText);
-  let fullMessage = options.formatMessage?.({
-    providerLabel: options.providerLabel,
-    operation,
-    statusLabel,
-    message,
-    response,
-    status
-  }) ?? `${options.providerLabel} API ${operation} failed: ${statusLabel}${message}`;
-  return createApiServiceError(fullMessage, {
-    reason: options.reason,
-    upstreamStatus: status,
-    upstreamCode: options.extractUpstreamCode?.(error, response, helpers),
-    parent: options.parent ?? error
+var URL_CREDENTIAL_KEY = /^(?:.*[-_])?(?:token|secret|password|api[-_]?key)$/i;
+var isUrlEmbeddedCredential = (secret, path) => secret.length >= 8 && URL_CREDENTIAL_KEY.test(path.split(".").pop() ?? "");
+var redactUrlAttachmentSecrets = (attachments, authConfig) => {
+  if (!authConfig || !attachments) return attachments;
+  let redactor = new AuthConfigSecretRedactor(authConfig);
+  return attachments.map((attachment) => {
+    if (attachment.content.type !== "url") return attachment;
+    let { url, headers, query } = attachment.content;
+    return {
+      ...attachment,
+      content: {
+        ...attachment.content,
+        url: redactor.redactEmbedded(url, isUrlEmbeddedCredential),
+        ...headers ? { headers: redactor.redactEmbedded(headers) } : {},
+        ...query ? { query: redactor.redactEmbedded(query) } : {}
+      }
+    };
   });
 };
 
-// src/error/axios.ts
-import { isAxiosError } from "axios";
-
-// src/context/hook.ts
-import { AsyncLocalStorage } from "async_hooks";
-var slateContextStorageKey = /* @__PURE__ */ Symbol.for("slates.provider.context.asyncLocalStorage");
-var globalWithSlateContext = globalThis;
-var asyncLocalStorage = globalWithSlateContext[slateContextStorageKey] ?? new AsyncLocalStorage();
-globalWithSlateContext[slateContextStorageKey] = asyncLocalStorage;
-var runWithContext = (context, fn) => {
-  return asyncLocalStorage.run(context, fn);
-};
-var getCurrentContext = () => {
-  let context = asyncLocalStorage.getStore();
-  if (!context) {
-    throw new Error("No Slate context is available");
-  }
-  return context;
-};
-
-// src/error/defaults.ts
-var DEFAULT_CODE = "internal.unexpected";
-var DEFAULT_MESSAGES = {
-  "declaration.invalid_definition": "The slate definition is invalid.",
-  "context.missing": "No Slate context is available.",
-  "input.invalid": "The provided input is invalid.",
-  "request.bad": "The request is invalid.",
-  "request.invalid_version": "The requested version is invalid.",
-  "request.precondition_failed": "The request precondition failed.",
-  "request.not_acceptable": "The request is not acceptable.",
-  "request.rate_limited": "Too many requests were made in a short period of time.",
-  "config.invalid": "The provided configuration is invalid.",
-  "auth.required": "Authentication is required.",
-  "auth.invalid": "Authentication failed.",
-  "auth.expired": "Authentication has expired.",
-  "permission.denied": "Permission was denied.",
-  "resource.not_found": "The requested resource was not found.",
-  "resource.conflict": "The requested resource is in conflict.",
-  "resource.gone": "The requested resource is no longer available.",
-  "payment.required": "Payment is required to continue.",
-  "operation.not_implemented": "The requested operation is not implemented.",
-  "upstream.invalid_request": "The upstream service rejected the request.",
-  "upstream.rate_limited": "The upstream service rate limited the request.",
-  "upstream.timeout": "The upstream service timed out.",
-  "upstream.network_error": "A network error occurred while contacting the upstream service.",
-  "upstream.unavailable": "The upstream service is unavailable.",
-  "upstream.invalid_response": "The upstream service returned an invalid response.",
-  "upstream.error": "The upstream service returned an error.",
-  "transport.invoke_failed": "The provider transport failed.",
-  "internal.timeout": "The operation timed out.",
-  "internal.unexpected": "An unexpected internal error occurred."
-};
-var SERVICE_ERROR_CODE_MAP = {
-  invalid_data: "input.invalid",
-  bad_request: "request.bad",
-  not_found: "resource.not_found",
-  unauthorized: "auth.required",
-  forbidden: "permission.denied",
-  invalid_version: "request.invalid_version",
-  conflict: "resource.conflict",
-  gone: "resource.gone",
-  payment_required: "payment.required",
-  precondition_failed: "request.precondition_failed",
-  not_acceptable: "request.not_acceptable",
-  not_implemented: "operation.not_implemented",
-  too_many_requests: "request.rate_limited",
-  timeout: "internal.timeout",
-  internal_server_error: "internal.unexpected"
-};
-
-// src/error/utils.ts
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var normalizeKind = (code, kind) => {
-  if (kind) return kind;
-  if (code.startsWith("declaration.")) return "declaration";
-  if (code.startsWith("input.")) return "validation";
-  if (code.startsWith("request.")) return "request";
-  if (code.startsWith("config.")) return "config";
-  if (code.startsWith("auth.") || code.startsWith("permission.")) return "auth";
-  if (code.startsWith("resource.")) return "resource";
-  if (code.startsWith("payment.")) return "payment";
-  if (code.startsWith("transport.")) return "transport";
-  if (code.startsWith("upstream.")) return "upstream";
-  return "internal";
-};
-var normalizeStatus = (code, status) => {
-  if (status) return status;
-  if (code === "input.invalid" || code === "request.bad" || code === "config.invalid")
-    return 400;
-  if (code === "request.invalid_version") return 400;
-  if (code === "auth.required" || code === "auth.invalid" || code === "auth.expired")
-    return 401;
-  if (code === "payment.required") return 402;
-  if (code === "permission.denied") return 403;
-  if (code === "resource.not_found") return 404;
-  if (code === "resource.conflict") return 409;
-  if (code === "resource.gone") return 410;
-  if (code === "request.not_acceptable") return 406;
-  if (code === "request.precondition_failed") return 412;
-  if (code === "request.rate_limited" || code === "upstream.rate_limited") return 429;
-  if (code === "operation.not_implemented") return 501;
-  if (code === "upstream.invalid_request") return 400;
-  if (code === "upstream.timeout" || code === "internal.timeout") return 504;
-  if (code === "upstream.unavailable") return 503;
-  if (code === "upstream.error") return 502;
-  return void 0;
+// src/axios/trace.ts
+var traceDraftsByConfig = /* @__PURE__ */ new WeakMap();
+var traceDraftsByHeaders = /* @__PURE__ */ new WeakMap();
+var TRACE_TEXT_LIMIT = 10 * 1024;
+var REDACTED_VALUE = "[redacted]";
+var STRUCTURED_DEPTH_LIMIT = 6;
+var STRUCTURED_ENTRY_LIMIT = 50;
+var CORE_SECRET_KEY_ATOMS = [
+  // HTTP authentication
+  "authorization",
+  "proxy[-_.]?authorization",
+  "www[-_.]?authenticate",
+  "bearer",
+  // Generic tokens
+  "token",
+  "tokens",
+  "access[-_.]?token",
+  "refresh[-_.]?token",
+  "id[-_.]?token",
+  "auth[-_.]?token",
+  "bearer[-_.]?token",
+  "session[-_.]?token",
+  "api[-_.]?token",
+  "app[-_.]?token",
+  "user[-_.]?token",
+  "oauth[-_.]?token",
+  "personal[-_.]?access[-_.]?token",
+  "x[-_.]?auth[-_.]?token",
+  "x[-_.]?access[-_.]?token",
+  "x[-_.]?refresh[-_.]?token",
+  // API keys
+  "apikey",
+  "api[-_.]?key",
+  "app[-_.]?key",
+  "x[-_.]?api[-_.]?key",
+  "x[-_.]?app[-_.]?key",
+  // HubSpot legacy API key query param
+  "hapikey",
+  "access[-_.]?key",
+  // OAuth client credentials
+  "client[-_.]?secret",
+  "client[-_.]?key",
+  "consumer[-_.]?secret",
+  "consumer[-_.]?key",
+  // Cryptographic keys
+  "private[-_.]?key",
+  "privatekey",
+  "secret[-_.]?key",
+  "secretkey",
+  "secret[-_.]?access[-_.]?key",
+  "encryption[-_.]?key",
+  "decryption[-_.]?key",
+  "signing[-_.]?key",
+  "signing[-_.]?secret",
+  "master[-_.]?key",
+  "master[-_.]?secret",
+  "master[-_.]?password",
+  "shared[-_.]?secret",
+  "webhook[-_.]?secret",
+  "webhook[-_.]?signing[-_.]?secret",
+  // OAuth codes & PKCE
+  "auth[-_.]?code",
+  "authcode",
+  "authorization[-_.]?code",
+  "code[-_.]?verifier",
+  "code[-_.]?challenge",
+  // Passwords & passcodes
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "pass[-_.]?phrase",
+  "pin",
+  "passcode",
+  // Generic secret markers
+  "secret",
+  "secrets",
+  "credential",
+  "credentials",
+  "creds",
+  "auth",
+  "x[-_.]?auth",
+  "x[-_.]?auth[-_.]?key",
+  // CSRF / XSRF
+  "csrf",
+  "xsrf",
+  "csrf[-_.]?token",
+  "xsrf[-_.]?token",
+  "x[-_.]?csrf[-_.]?token",
+  "x[-_.]?xsrf[-_.]?token",
+  // JWT
+  "jwt",
+  // Sessions & cookies
+  "session[-_.]?id",
+  "sessionid",
+  "sid",
+  "sessid",
+  "jsessionid",
+  "phpsessid",
+  "cookie",
+  "cookies",
+  "set[-_.]?cookie",
+  // Signatures / MAC
+  "signature",
+  "x[-_.]?hub[-_.]?signature",
+  "x[-_.]?signature",
+  "sig",
+  "hmac",
+  "mac",
+  // Crypto artifacts
+  "salt",
+  "nonce",
+  // Multi-factor / verification
+  "otp",
+  "totp",
+  "mfa",
+  "mfa[-_.]?code",
+  "2fa",
+  "two[-_.]?factor",
+  "twofactor",
+  "verification[-_.]?code",
+  "verify[-_.]?code",
+  "confirm(?:ation)?[-_.]?code",
+  "sms[-_.]?code",
+  "email[-_.]?code",
+  // Recovery & seed phrases
+  "seed[-_.]?phrase",
+  "mnemonic",
+  "recovery[-_.]?key",
+  "recovery[-_.]?code",
+  "recovery[-_.]?phrase",
+  // PII / financial
+  "card[-_.]?number",
+  "card[-_.]?code",
+  "cvv",
+  "cvc",
+  "ccv",
+  "cc[-_.]?num(?:ber)?",
+  "pan",
+  "ssn",
+  "social[-_.]?security",
+  "license[-_.]?key"
+];
+var URL_FORM_SECRET_KEY_ATOMS = [...CORE_SECRET_KEY_ATOMS, "code"];
+var buildKeyBoundaryPattern = (atoms, flags) => new RegExp(`(?:^|[^A-Za-z0-9])(?:${atoms.join("|")})(?=[^A-Za-z0-9]|$)`, flags);
+var SECRET_KEY_PATTERN = buildKeyBoundaryPattern(CORE_SECRET_KEY_ATOMS, "i");
+var URL_FORM_SECRET_KEY_PATTERN = buildKeyBoundaryPattern(URL_FORM_SECRET_KEY_ATOMS, "i");
+var NON_SECRET_KEY_EXACT = /* @__PURE__ */ new Set([
+  "token_type",
+  "token-type",
+  "tokentype",
+  "token_kind",
+  "token-kind",
+  "tokenkind",
+  "token_ttl",
+  "token-ttl",
+  "token_expires_in",
+  "token-expires-in",
+  "token_expiry",
+  "signature_method",
+  "signature-method",
+  "signature_type",
+  "signature-type",
+  "signature_version",
+  "signature-version",
+  "auth_type",
+  "auth-type",
+  "auth_method",
+  "auth-method",
+  "authentication_type",
+  "authentication-type",
+  "authentication_method",
+  "authentication-method",
+  "grant_type",
+  "grant-type",
+  "password_strength",
+  "password-strength",
+  "password_policy",
+  "password-policy",
+  "key_type",
+  "key-type",
+  "key_name",
+  "key-name",
+  "key_id",
+  "key-id",
+  "kid"
+]);
+var isSecretKeyName = (name) => {
+  let normalized = name.toLowerCase();
+  if (NON_SECRET_KEY_EXACT.has(normalized)) return false;
+  return SECRET_KEY_PATTERN.test(normalized);
 };
-var normalizeRetryable = (code, retryable) => {
-  if (typeof retryable === "boolean") return retryable;
-  return code === "request.rate_limited" || code === "upstream.rate_limited" || code === "upstream.timeout" || code === "upstream.network_error" || code === "upstream.unavailable" || code === "upstream.error" || code === "transport.invoke_failed" || code === "internal.timeout";
+var URL_FORM_EXACT_SECRET_KEYS = /* @__PURE__ */ new Set(["key"]);
+var isUrlFormSecretKeyName = (name) => {
+  let normalized = name.toLowerCase();
+  if (NON_SECRET_KEY_EXACT.has(normalized)) return false;
+  if (URL_FORM_EXACT_SECRET_KEYS.has(normalized)) return true;
+  return URL_FORM_SECRET_KEY_PATTERN.test(normalized);
 };
-var getDefaultMessage = (code, message) => {
-  if (message?.trim()) return message;
-  return DEFAULT_MESSAGES[code] ?? DEFAULT_MESSAGES[DEFAULT_CODE] ?? "An unexpected internal error occurred.";
+var splitCamelCase = (key) => key.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+var splitKeyParts = (key) => splitCamelCase(key).toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+var NON_SECRET_KEY_SUFFIXES = /* @__PURE__ */ new Set([
+  "count",
+  "limit",
+  "timeout",
+  "expired",
+  "expires",
+  "expiry",
+  "at",
+  "valid",
+  "url",
+  "uri",
+  "error",
+  "type",
+  "id",
+  "ids",
+  "name"
+]);
+var NON_SECRET_FIELD_KEYS = /* @__PURE__ */ new Set([
+  "page_token",
+  "next_page_token",
+  "prev_page_token",
+  "previous_page_token",
+  "next_token",
+  "continuation_token"
+]);
+var SECRET_ID_QUALIFIERS = /* @__PURE__ */ new Set(["session", "sess", "secret"]);
+var isSecretFieldName = (key) => {
+  let parts = splitKeyParts(key);
+  if (parts.length === 0) return false;
+  let normalized = parts.join("_");
+  if (NON_SECRET_FIELD_KEYS.has(normalized)) return false;
+  let last = parts[parts.length - 1] ?? "";
+  if (parts.length > 1 && NON_SECRET_KEY_SUFFIXES.has(last)) {
+    return (last === "id" || last === "ids") && SECRET_ID_QUALIFIERS.has(parts[parts.length - 2] ?? "");
+  }
+  return isSecretKeyName(key) || isSecretKeyName(normalized) || parts.includes("session");
+};
+var AUTH_CONFIG_CREDENTIAL_SUFFIXES = /* @__PURE__ */ new Set(["key", "keys", "hash"]);
+var HEADER_NAME_VALUE_PATTERN = /^[A-Za-z]+(?:-[A-Za-z]+)*$/;
+var isAuthConfigSecretValue = (secret, path) => {
+  let segment = path.split(".").reverse().find((part) => !/^\d+$/.test(part));
+  if (!segment) return false;
+  let parts = splitKeyParts(segment);
+  let last = parts[parts.length - 1] ?? "";
+  if (last === "header" && HEADER_NAME_VALUE_PATTERN.test(secret)) return false;
+  return isSecretFieldName(segment) || AUTH_CONFIG_CREDENTIAL_SUFFIXES.has(last);
 };
-var cleanRecord = (value) => {
-  if (!value) return void 0;
-  let entries = Object.entries(value).filter(([, entry]) => entry !== void 0);
-  if (entries.length === 0) return void 0;
-  return Object.fromEntries(entries);
+var KNOWN_SECRET_VALUE_PATTERNS = [
+  // JSON Web Tokens (header.payload.signature)
+  /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
+  // AWS access key IDs
+  /\b(?:AKIA|ASIA|AGPA|AIDA|ANPA|ANVA|AROA|APKA|ASCA)[A-Z0-9]{16}\b/g,
+  // GitHub tokens (PAT / OAuth / server-to-server / user-to-server / refresh)
+  /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g,
+  // Slack tokens
+  /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g,
+  // Stripe secret / public / restricted keys
+  /\b(?:sk|rk|pk)_(?:test|live)_[A-Za-z0-9]{16,}\b/g,
+  // OpenAI API keys
+  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
+  // Anthropic API keys
+  /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
+  // Google API keys
+  /\bAIza[A-Za-z0-9_-]{35}\b/g,
+  // SendGrid API keys
+  /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/g,
+  // Twilio API keys
+  /\bSK[0-9a-fA-F]{32}\b/g,
+  // PEM-encoded private keys (multi-line)
+  /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+  // SSH private keys (OpenSSH format)
+  /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g
+];
+var HTTP_AUTH_SCHEME_PATTERN = /\b(bearer|basic|digest|token|negotiate|apikey)\s+([A-Za-z0-9_\-.~+/=]{4,})/gi;
+var GENERIC_KEY_VALUE_PATTERN = /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)(\s*=\s*)([^&#\s;]+)/g;
+var GENERIC_JSON_KEY_VALUE_PATTERN = /"([^"\\]*(?:\\.[^"\\]*)*)"(\s*:\s*)"([^"\\]*(?:\\.[^"\\]*)*)"/g;
+var SAFE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "cache-control",
+  "connection",
+  "content-encoding",
+  "content-language",
+  "content-length",
+  "content-type",
+  "date",
+  "etag",
+  "expires",
+  "if-modified-since",
+  "if-none-match",
+  "keep-alive",
+  "last-modified",
+  "location",
+  "origin",
+  "pragma",
+  "referer",
+  "referrer-policy",
+  "request-id",
+  "retry-after",
+  "server",
+  "transfer-encoding",
+  "user-agent",
+  "vary",
+  "via",
+  "x-correlation-id",
+  "x-powered-by",
+  "x-request-id",
+  "x-slates-provider",
+  "x-trace-id"
+]);
+var SAFE_HEADER_PREFIXES = ["ratelimit-", "x-ratelimit-"];
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+var normalizeContentType = (value) => value?.split(";")[0]?.trim().toLowerCase() || void 0;
+var isTextContentType = (contentType) => !contentType || /(^text\/)|json|xml|html|javascript|graphql|x-www-form-urlencoded|svg/.test(contentType);
+var redactKnownSecretValues = (text) => {
+  let result = text;
+  for (let pattern of KNOWN_SECRET_VALUE_PATTERNS) {
+    result = result.replace(pattern, REDACTED_VALUE);
+  }
+  return result;
 };
-var mergeRecords = (left, right) => {
-  if (!left && !right) return void 0;
-  return cleanRecord({
-    ...left ?? {},
-    ...right ?? {}
-  });
+var isSafeHeaderName = (name) => {
+  let normalized = name.toLowerCase();
+  if (isSecretKeyName(normalized)) return false;
+  if (SAFE_HEADER_NAMES.has(normalized)) return true;
+  return SAFE_HEADER_PREFIXES.some((prefix) => normalized.startsWith(prefix));
 };
-var mergeSlateErrorData = (base, override) => {
-  if (!override) return base;
+var truncateText = (text) => {
+  if (text.length <= TRACE_TEXT_LIMIT) {
+    return { text, truncated: false };
+  }
   return {
-    ...base,
-    ...override,
-    provider: cleanRecord({
-      ...base.provider ?? {},
-      ...override.provider ?? {}
-    }),
-    upstream: cleanRecord({
-      ...base.upstream ?? {},
-      ...override.upstream ?? {}
-    }),
-    baggage: mergeRecords(base.baggage, override.baggage),
-    issues: override.issues ?? base.issues,
-    requestTraces: override.requestTraces ?? base.requestTraces
+    text: `${text.slice(0, TRACE_TEXT_LIMIT)}...[truncated]`,
+    truncated: true
   };
 };
-var sanitizeForBaggage = (value, depth = 0) => {
+var sanitizeFreeText = (text, redactor) => {
+  if (!text) return text;
+  let result = redactor ? redactor.redact(text, isAuthConfigSecretValue) : text;
+  result = result.replace(
+    HTTP_AUTH_SCHEME_PATTERN,
+    (_match, scheme) => `${scheme} ${REDACTED_VALUE}`
+  );
+  result = redactKnownSecretValues(result);
+  result = result.replace(
+    GENERIC_KEY_VALUE_PATTERN,
+    (match, key, equals, _value) => isUrlFormSecretKeyName(key) ? `${key}${equals}${REDACTED_VALUE}` : match
+  );
+  result = result.replace(
+    GENERIC_JSON_KEY_VALUE_PATTERN,
+    (match, key, colon, _value) => isSecretKeyName(key) ? `"${key}"${colon}"${REDACTED_VALUE}"` : match
+  );
+  return result;
+};
+var PROSE_SAFE_AUTH_SCHEME_PATTERN = /\b(bearer|basic|digest|token|negotiate|apikey)(\s+)([A-Za-z0-9_\-.~+/=]{8,})/gi;
+var looksLikeCredential = (value) => {
+  if (/^[A-Za-z][A-Za-z0-9_\-.]*=/.test(value)) return false;
+  return /[0-9_\-.~+/=]/.test(value) || /[a-z]/.test(value) && /[A-Z]/.test(value.slice(1));
+};
+var CREDENTIAL_HEADER_VALUE_PATTERN = /\b(proxy-authorization|authorization|x-api-key|api[-_]?key|set-cookie|cookie)(\s*[:=]\s*)(?:(["'])((?:\\.|(?!\3)[^\\\r\n])*)|([^\r\n&]*))/gi;
+var AUTH_SCHEME_WORD_PATTERN = /^(?:bearer|basic|digest|token|negotiate|apikey)$/i;
+var COOKIE_HEADER_NAME_PATTERN = /^(?:set-)?cookie$/i;
+var AUTHORIZATION_HEADER_NAME_PATTERN = /^(?:proxy-)?authorization$/i;
+var COOKIE_PAIRS_PATTERN = /^[^\s;=&"',]+=[^\s;&"',]*(?:;\s*[^\s;=&"',]+=[^\s;&"',]*)*/;
+var HEADER_TOKEN_PATTERN = /^[^\s&"',;]+/;
+var HEADER_SCHEME_PATTERN = /^([A-Za-z][\w-]*)(\s+)([\s\S]*)$/;
+var HEADER_AUTH_PARAMS_PATTERN = /^[A-Za-z][\w-]*\s*=/;
+var redactCredentialHeaderValue = (name, value) => {
+  if (COOKIE_HEADER_NAME_PATTERN.test(name)) {
+    let pairs = COOKIE_PAIRS_PATTERN.exec(value)?.[0];
+    if (pairs) return `${REDACTED_VALUE}${value.slice(pairs.length)}`;
+  }
+  let scheme = HEADER_SCHEME_PATTERN.exec(value);
+  if (scheme) {
+    let [, word = "", space = "", rest = ""] = scheme;
+    let schemePrefix = `${word}${space}`;
+    if (AUTHORIZATION_HEADER_NAME_PATTERN.test(name) && HEADER_AUTH_PARAMS_PATTERN.test(rest)) {
+      return `${schemePrefix}${REDACTED_VALUE}`;
+    }
+    let credential = HEADER_TOKEN_PATTERN.exec(rest)?.[0];
+    if (credential === REDACTED_VALUE) return value;
+    if (credential && (AUTH_SCHEME_WORD_PATTERN.test(word) || looksLikeCredential(credential))) {
+      return `${schemePrefix}${REDACTED_VALUE}${rest.slice(credential.length)}`;
+    }
+  }
+  let token = HEADER_TOKEN_PATTERN.exec(value)?.[0];
+  if (token && token !== REDACTED_VALUE && looksLikeCredential(token)) {
+    return `${REDACTED_VALUE}${value.slice(token.length)}`;
+  }
+  return value;
+};
+var GENERIC_SINGLE_QUOTED_KEY_VALUE_PATTERN = /'([^'\\]*(?:\\.[^'\\]*)*)'(\s*:\s*)'([^'\\]*(?:\\.[^'\\]*)*)'/g;
+var PROSE_KEY_VALUE_PATTERN = /(?<![A-Za-z0-9_\-.])([A-Za-z][A-Za-z0-9_\-.]*)([ \t]*:[ \t]*)(["'`]?)([^\s"'`,;&)\]}]+)/g;
+var PROSE_STATE_WORD_PATTERN = /^(?:required|missing|invalid|expired|revoked|empty|blank|null|undefined|none|not|is|was|has|must|should|cannot|incorrect|wrong|malformed|provided|present|absent|unknown|denied|rejected|unauthorized|forbidden|true|false|too|the|a|an)$/i;
+var PROSE_ERROR_CODE_PATTERN = /^[a-z]+(?:_[a-z]+)+$/;
+var redactProseKeyValue = (match, key, separator, quote, value) => {
+  if (AUTHORIZATION_HEADER_NAME_PATTERN.test(key) || COOKIE_HEADER_NAME_PATTERN.test(key)) {
+    return match;
+  }
+  if (value.startsWith("[") || value.startsWith(AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX)) {
+    return match;
+  }
+  if (!isSecretFieldName(key)) return match;
+  let credential = value.replace(/[.!?:]+$/, "");
+  if (!credential || PROSE_ERROR_CODE_PATTERN.test(credential)) return match;
+  let compoundKey = splitKeyParts(key).length > 1;
+  if (looksLikeCredential(credential) || compoundKey && !PROSE_STATE_WORD_PATTERN.test(credential)) {
+    return `${key}${separator}${quote}${REDACTED_VALUE}${value.slice(credential.length)}`;
+  }
+  return match;
+};
+var sanitizeSecretValuesInText = (text) => {
+  if (!text) return text;
+  let result = text.replace(
+    PROSE_SAFE_AUTH_SCHEME_PATTERN,
+    (match, scheme, space, value) => looksLikeCredential(value) ? `${scheme}${space}${REDACTED_VALUE}` : match
+  );
+  result = result.replace(
+    CREDENTIAL_HEADER_VALUE_PATTERN,
+    (_match, name, separator, quote, quotedValue, plainValue) => `${name}${separator}${quote ?? ""}${redactCredentialHeaderValue(
+      name,
+      quote ? quotedValue ?? "" : plainValue ?? ""
+    )}`
+  );
+  result = redactKnownSecretValues(result);
+  result = result.replace(
+    GENERIC_KEY_VALUE_PATTERN,
+    (match, key, equals, value, offset, whole) => {
+      if (!isSecretKeyName(key)) return match;
+      let rest = whole.slice(offset + match.length);
+      if (AUTH_SCHEME_WORD_PATTERN.test(value) && /^\s+\[redacted\]/.test(rest)) return match;
+      return `${key}${equals}${REDACTED_VALUE}`;
+    }
+  );
+  result = result.replace(PROSE_KEY_VALUE_PATTERN, redactProseKeyValue);
+  result = result.replace(
+    GENERIC_SINGLE_QUOTED_KEY_VALUE_PATTERN,
+    (match, key, colon, _value) => isSecretKeyName(key) ? `'${key}'${colon}'${REDACTED_VALUE}'` : match
+  );
+  return result.replace(
+    GENERIC_JSON_KEY_VALUE_PATTERN,
+    (match, key, colon, _value) => isSecretKeyName(key) ? `"${key}"${colon}"${REDACTED_VALUE}"` : match
+  );
+};
+var sanitizeScalar = (value, redactor) => truncateText(sanitizeFreeText(value, redactor));
+var redactStructuredValue = (value, depth = 0, redactor) => {
   if (value == null) return value;
-  if (depth >= 4) return "[truncated]";
-  if (typeof value === "string") {
-    return value.length > 2e3 ? `${value.slice(0, 2e3)}...[truncated]` : value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return value;
+  if (depth >= STRUCTURED_DEPTH_LIMIT) return "[truncated]";
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return typeof value === "string" ? sanitizeFreeText(value, redactor) : value;
   }
   if (Array.isArray(value)) {
-    return value.slice(0, 20).map((item) => sanitizeForBaggage(item, depth + 1));
+    return value.slice(0, STRUCTURED_ENTRY_LIMIT).map((entry) => redactStructuredValue(entry, depth + 1, redactor));
   }
   if (isRecord(value)) {
     return Object.fromEntries(
-      Object.entries(value).slice(0, 30).map(([key, entry]) => [key, sanitizeForBaggage(entry, depth + 1)])
+      Object.entries(value).slice(0, STRUCTURED_ENTRY_LIMIT).map(([key, entry]) => [
+        key,
+        isSecretKeyName(key) ? REDACTED_VALUE : redactStructuredValue(entry, depth + 1, redactor)
+      ])
     );
   }
   return String(value);
 };
-var normalizeSlateErrorInput = (input) => {
-  let code = input.code || DEFAULT_CODE;
+var maybeParseJson = (text, contentType) => {
+  let trimmed = text.trim();
+  if (!trimmed) return null;
+  if (!contentType?.includes("json") && !/^[[{]/.test(trimmed)) {
+    return null;
+  }
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+};
+var sanitizeTextBody = (text, contentType, redactor) => {
+  if (!text) return void 0;
+  let normalizedContentType = normalizeContentType(contentType);
+  let parsedJson = maybeParseJson(text, normalizedContentType);
+  let normalizedText = parsedJson !== null ? JSON.stringify(redactStructuredValue(parsedJson, 0, redactor)) : sanitizeFreeText(text, redactor);
+  let { text: truncatedText, truncated } = truncateText(normalizedText);
   return {
-    code,
-    message: getDefaultMessage(code, input.message),
-    kind: normalizeKind(code, input.kind),
-    retryable: normalizeRetryable(code, input.retryable),
-    status: normalizeStatus(code, input.status ?? input.upstream?.status),
-    issues: input.issues,
-    provider: cleanRecord(input.provider),
-    upstream: cleanRecord({
-      ...input.upstream,
-      status: input.upstream?.status ?? input.status
-    }),
-    baggage: cleanRecord(input.baggage),
-    requestTraces: input.requestTraces
+    ...normalizedContentType ? { contentType: normalizedContentType } : {},
+    text: truncatedText,
+    ...truncated ? { truncated: true } : {}
   };
 };
-var isSlateErrorResponse = (error) => {
-  if (!isRecord(error)) return false;
-  return typeof error.code === "string" && typeof error.message === "string";
-};
-
-// src/error/axios.ts
-var getResponseField = (value, key) => {
-  if (!isRecord(value)) return void 0;
-  return value[key];
+var isBinaryLike = (value) => {
+  if (typeof Buffer !== "undefined" && Buffer.isBuffer(value)) return true;
+  if (value instanceof ArrayBuffer) return true;
+  if (ArrayBuffer.isView(value)) return true;
+  if (typeof Blob !== "undefined" && value instanceof Blob) return true;
+  if (typeof FormData !== "undefined" && value instanceof FormData) return true;
+  return false;
 };
-var getNestedMessage = (value) => {
-  if (typeof value === "string") return value;
-  if (!isRecord(value)) return void 0;
-  let message = getResponseField(value, "message");
-  if (typeof message === "string" && message.trim()) return message;
-  let description = getResponseField(value, "description");
-  if (typeof description === "string" && description.trim()) return description;
-  let error = getResponseField(value, "error");
-  if (typeof error === "string" && error.trim()) return error;
-  if (isRecord(error)) {
-    let nested = getNestedMessage(error);
-    if (nested) return nested;
+var serializeTextBody = (value, contentType, redactor) => {
+  let normalizedContentType = normalizeContentType(contentType);
+  if (value == null || isBinaryLike(value) || !isTextContentType(normalizedContentType)) {
+    return void 0;
   }
-  let errorDescription = getResponseField(value, "error_description");
-  if (typeof errorDescription === "string" && errorDescription.trim()) {
-    return errorDescription;
+  if (typeof value === "string") {
+    return sanitizeTextBody(value, normalizedContentType, redactor);
   }
-  return void 0;
-};
-var getNestedCode = (value) => {
-  if (!isRecord(value)) return void 0;
-  let directCode = getResponseField(value, "code");
-  if (typeof directCode === "string" && directCode.trim()) return directCode;
-  let errorCode = getResponseField(value, "error_code");
-  if (typeof errorCode === "string" && errorCode.trim()) return errorCode;
-  let type = getResponseField(value, "type");
-  if (typeof type === "string" && type.trim()) return type;
-  let error = getResponseField(value, "error");
-  if (typeof error === "string" && error.trim()) return error;
-  if (isRecord(error)) return getNestedCode(error);
-  return void 0;
-};
-var getNestedType = (value) => {
-  if (!isRecord(value)) return void 0;
-  let type = getResponseField(value, "type");
-  if (typeof type === "string" && type.trim()) return type;
-  let error = getResponseField(value, "error");
-  if (isRecord(error)) {
-    let nestedType = getNestedType(error);
-    if (nestedType) return nestedType;
+  if (value instanceof URLSearchParams) {
+    return sanitizeTextBody(value.toString(), normalizedContentType, redactor);
   }
-  return void 0;
-};
-var getHeaderValue = (headers, key) => {
-  if (!headers) return void 0;
-  if (typeof headers.get === "function") {
-    let value = headers.get(key);
-    if (typeof value === "string" && value.trim()) return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return sanitizeTextBody(String(value), normalizedContentType, redactor);
   }
-  if (isRecord(headers)) {
-    for (let [headerKey, headerValue] of Object.entries(headers)) {
-      if (headerKey.toLowerCase() !== key.toLowerCase()) continue;
-      if (typeof headerValue === "string" && headerValue.trim()) return headerValue;
-      if (Array.isArray(headerValue)) {
-        let first = headerValue.find((item) => typeof item === "string" && item.trim());
-        if (typeof first === "string") return first;
-      }
-    }
+  if (Array.isArray(value) || isRecord(value)) {
+    return sanitizeTextBody(
+      JSON.stringify(redactStructuredValue(value, 0, redactor)),
+      "application/json",
+      redactor
+    );
   }
   return void 0;
 };
-var buildRequestUrl = (error) => {
-  let baseURL = error.config?.baseURL;
-  let url = error.config?.url;
-  if (!url) return void 0;
+var buildUrl = (baseURL, url) => {
+  if (!url) return "";
   if (!baseURL) return url;
   try {
     return new URL(url, baseURL).toString();
@@ -445,1747 +704,1897 @@ var buildRequestUrl = (error) => {
     return url;
   }
 };
-var getProviderDefaults = () => {
-  try {
-    let ctx = getCurrentContext();
-    return {
-      provider: {
-        key: ctx.specification.key
-      },
-      ...ctx.getHttpTraces().length > 0 ? { requestTraces: ctx.getHttpTraces() } : {}
-    };
-  } catch {
-    return {};
-  }
-};
-var inferAxiosCode = (error, data) => {
-  let status = error.response?.status;
-  let axiosCode = error.code?.toUpperCase();
-  let remoteCode = getNestedCode(data)?.toLowerCase();
-  if (axiosCode === "ECONNABORTED" || axiosCode === "ETIMEDOUT" || status === 408 || remoteCode?.includes("timeout")) {
-    return "upstream.timeout";
-  }
-  if (!error.response) {
-    return "upstream.network_error";
-  }
-  if (status === 401) return "auth.invalid";
-  if (status === 403) {
-    return remoteCode?.includes("rate") ? "upstream.rate_limited" : "permission.denied";
-  }
-  if (status === 404) return "resource.not_found";
-  if (status === 409) return "resource.conflict";
-  if (status === 422 || status === 400) return "upstream.invalid_request";
-  if (status === 429) return "upstream.rate_limited";
-  if (status === 502 || status === 503 || status === 504) return "upstream.unavailable";
-  if (status && status >= 500) return "upstream.error";
-  return "upstream.error";
-};
-var inferAxiosMessage = (error, data, code) => {
-  return getNestedMessage(data) ?? error.response?.statusText ?? error.message ?? getDefaultMessage(code);
-};
-var inferAxiosRetryable = (error, code) => {
-  let headerValue = getHeaderValue(error.response?.headers, "retry-after");
-  if (headerValue) return true;
-  return normalizeRetryable(code, void 0);
-};
-var isAxiosErrorLike = (error) => isAxiosError(error);
-var inferSlateErrorFromAxios = (error, options = {}) => {
-  let responseData = error.response ? options.extractResponseData?.(error.response) ?? error.response.data : void 0;
-  let code = inferAxiosCode(error, responseData);
-  return normalizeSlateErrorInput({
-    ...getProviderDefaults(),
-    ...options.defaults,
-    code: options.defaults?.code ?? code,
-    message: options.defaults?.message ?? inferAxiosMessage(error, responseData, code),
-    kind: options.defaults?.kind ?? normalizeKind(options.defaults?.code ?? code),
-    retryable: options.defaults?.retryable ?? inferAxiosRetryable(error, options.defaults?.code ?? code),
-    status: options.defaults?.status ?? error.response?.status,
-    provider: {
-      ...getProviderDefaults().provider,
-      ...options.defaults?.provider ?? {}
-    },
-    upstream: {
-      ...options.defaults?.upstream ?? {},
-      status: error.response?.status ?? options.defaults?.upstream?.status,
-      code: getNestedCode(responseData) ?? options.defaults?.upstream?.code,
-      type: getNestedType(responseData) ?? options.defaults?.upstream?.type,
-      requestId: getHeaderValue(error.response?.headers, "x-request-id") ?? getHeaderValue(error.response?.headers, "request-id") ?? getHeaderValue(error.response?.headers, "x-correlation-id") ?? options.defaults?.upstream?.requestId,
-      method: error.config?.method?.toUpperCase() ?? options.defaults?.upstream?.method,
-      url: buildRequestUrl(error) ?? options.defaults?.upstream?.url
-    },
-    baggage: mergeRecords(options.defaults?.baggage, {
-      axiosCode: error.code,
-      response: sanitizeForBaggage(responseData)
-    })
-  });
-};
-
-// src/error/service.ts
-import { isServiceError } from "@lowerdeck/error";
-var SERVICE_ERROR_DATA_RESERVED_KEYS = /* @__PURE__ */ new Set([
-  "status",
-  "code",
-  "message",
-  "hint",
-  "description",
-  "reason",
-  "errors",
-  "object",
-  "ok"
-]);
-var isStructuredValue = (value) => (typeof value === "object" || typeof value === "function") && value !== null;
-var mapServiceErrorCodeByStatus = (status) => {
-  if (status === 400) return "request.bad";
-  if (status === 401) return "auth.required";
-  if (status === 402) return "payment.required";
-  if (status === 403) return "permission.denied";
-  if (status === 404) return "resource.not_found";
-  if (status === 406) return "request.not_acceptable";
-  if (status === 409) return "resource.conflict";
-  if (status === 410) return "resource.gone";
-  if (status === 412) return "request.precondition_failed";
-  if (status === 429) return "request.rate_limited";
-  if (status === 501) return "operation.not_implemented";
-  if (status === 504) return "internal.timeout";
-  if (status && status >= 500) return "internal.unexpected";
-  return DEFAULT_CODE;
-};
-var normalizeServiceErrorIssues = (errors) => {
-  if (!Array.isArray(errors)) return void 0;
-  let issues = errors.map((error) => {
-    if (!isRecord(error)) {
-      return {
-        message: String(error)
-      };
+var REDACTED_ENCODED = encodeURIComponent(REDACTED_VALUE);
+var decodeRedactedMarker = (value) => REDACTED_ENCODED === REDACTED_VALUE ? value : value.split(REDACTED_ENCODED).join(REDACTED_VALUE);
+var redactQueryValue = (rawValue, redactor) => redactKnownSecretValues(
+  redactor ? redactor.redact(rawValue, isAuthConfigSecretValue) : rawValue
+);
+var redactHashFragment = (hash, redactor) => {
+  if (!hash?.includes("=")) return hash;
+  let withoutHash = hash.startsWith("#") ? hash.slice(1) : hash;
+  let redacted = withoutHash.replace(
+    /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)=([^&]*)/g,
+    (match, key, rawValue) => {
+      if (isUrlFormSecretKeyName(key)) return `${key}=${REDACTED_VALUE}`;
+      let redactedValue = redactQueryValue(rawValue, redactor);
+      return redactedValue !== rawValue ? `${key}=${redactedValue}` : match;
     }
-    let path = Array.isArray(error.path) ? error.path.map((entry) => String(entry)) : void 0;
-    return {
-      ...error,
-      path,
-      code: typeof error.code === "string" ? error.code : void 0,
-      message: typeof error.message === "string" ? error.message : typeof error.hint === "string" ? error.hint : "Validation issue"
-    };
-  });
-  return issues.length > 0 ? issues : void 0;
-};
-var getServiceErrorBaggage = (data) => {
-  let extraEntries = Object.entries(data).filter(
-    ([key]) => !SERVICE_ERROR_DATA_RESERVED_KEYS.has(key)
   );
-  return cleanRecord({
-    serviceError: {
-      code: data.code,
-      status: data.status,
-      hint: data.hint,
-      description: data.description,
-      reason: data.reason
-    },
-    ...extraEntries.length > 0 ? {
-      serviceErrorData: sanitizeForBaggage(Object.fromEntries(extraEntries))
-    } : {}
-  });
+  return redacted ? `#${redacted}` : "";
 };
-var mapServiceErrorCode = (code, status) => SERVICE_ERROR_CODE_MAP[code] ?? mapServiceErrorCodeByStatus(status);
-var isServiceErrorData = (value) => isRecord(value) && typeof value.status === "number" && typeof value.code === "string" && typeof value.message === "string" && !("config" in value) && !("request" in value) && !("response" in value) && !("isAxiosError" in value);
-var getServiceErrorData = (error) => {
-  if (isServiceError(error)) {
-    return isServiceErrorData(error.data) ? error.data : null;
-  }
-  if (isServiceErrorData(error)) {
-    return error;
-  }
-  if (isStructuredValue(error) && "data" in error && isServiceErrorData(error.data)) {
-    return error.data;
-  }
-  if (isStructuredValue(error) && "toResponse" in error && typeof error.toResponse === "function") {
-    let response = error.toResponse();
-    return isServiceErrorData(response) ? response : null;
+var isEmbeddedPathSecret = (secret, path) => secret.length >= 8 && isAuthConfigSecretValue(secret, path);
+var redactAuthConfigSecretsInText = (text, redactor) => redactor.redactEmbedded(text, isEmbeddedPathSecret, isAuthConfigSecretValue);
+var sanitizeUrl = (value, redactor) => {
+  if (!value) return value;
+  try {
+    let url = new URL(value);
+    if (url.username || url.password) {
+      url.username = "";
+      url.password = "";
+    }
+    if (redactor) url.pathname = redactAuthConfigSecretsInText(url.pathname, redactor);
+    for (let key of Array.from(url.searchParams.keys())) {
+      if (isUrlFormSecretKeyName(key)) {
+        url.searchParams.set(key, REDACTED_VALUE);
+        continue;
+      }
+      let rawValue = url.searchParams.get(key) ?? "";
+      let redactedValue = redactQueryValue(rawValue, redactor);
+      if (redactedValue !== rawValue) url.searchParams.set(key, redactedValue);
+    }
+    url.hash = redactHashFragment(url.hash, redactor);
+    return decodeRedactedMarker(url.toString());
+  } catch {
+    let text = redactor ? redactAuthConfigSecretsInText(value, redactor) : value;
+    return text.replace(
+      /([?&]([^=&#]+)=)([^&#]+)/g,
+      (_match, prefix, key, rawValue) => isUrlFormSecretKeyName(key) ? `${prefix}${REDACTED_VALUE}` : `${prefix}${redactKnownSecretValues(rawValue)}`
+    );
   }
-  return null;
 };
-var mapServiceErrorToSlateErrorInput = (error, defaults = {}) => {
-  let data = getServiceErrorData(error);
-  if (!data) {
-    return {
-      code: defaults.code ?? DEFAULT_CODE,
-      message: defaults.message ?? "An unexpected internal error occurred.",
-      kind: defaults.kind,
-      retryable: defaults.retryable,
-      status: defaults.status,
-      provider: defaults.provider,
-      upstream: defaults.upstream,
-      baggage: defaults.baggage
-    };
+var flattenHeaderValue = (value) => {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) {
+    let normalized = value.map((entry) => flattenHeaderValue(entry)).filter((entry) => typeof entry === "string" && entry.length > 0);
+    return normalized.length > 0 ? normalized.join(", ") : void 0;
   }
-  let code = defaults.code ?? mapServiceErrorCode(data.code, data.status);
-  return {
-    code,
-    message: defaults.message ?? data.message,
-    kind: defaults.kind ?? normalizeKind(code),
-    retryable: defaults.retryable ?? normalizeRetryable(code),
-    status: defaults.status ?? data.status,
-    issues: defaults.issues ?? normalizeServiceErrorIssues(data.errors),
-    provider: defaults.provider,
-    upstream: defaults.upstream,
-    baggage: cleanRecord({
-      ...defaults.baggage ?? {},
-      ...getServiceErrorBaggage(data)
-    })
-  };
+  return void 0;
 };
-
-// src/error/base.ts
-var SlateError = class _SlateError extends Error {
-  cause;
-  data;
-  constructor(input) {
-    let normalized = normalizeSlateErrorInput(input);
-    super(normalized.message);
-    this.name = "SlateError";
-    this.data = normalized;
-    this.cause = input.cause;
-  }
-  get code() {
-    return this.data.code;
-  }
-  get kind() {
-    return this.data.kind;
+var headerEntries = (headers) => {
+  if (!headers) return [];
+  if (typeof headers.toJSON === "function") {
+    let json = headers.toJSON();
+    if (isRecord(json)) {
+      return Object.entries(json).map(([key, value]) => {
+        let flattened = flattenHeaderValue(value);
+        return flattened ? [key, flattened] : null;
+      }).filter((entry) => entry !== null);
+    }
   }
-  get status() {
-    return this.data.status;
+  if (typeof headers.entries === "function") {
+    return Array.from(
+      headers.entries()
+    ).map(([key, value]) => [key, value]);
   }
-  get retryable() {
-    return this.data.retryable;
+  if (isRecord(headers)) {
+    return Object.entries(headers).map(([key, value]) => {
+      let flattened = flattenHeaderValue(value);
+      return flattened ? [key, flattened] : null;
+    }).filter((entry) => entry !== null);
   }
-  toResponse() {
-    return {
-      ...this.data
-    };
+  return [];
+};
+var sanitizeHeaders = (headers, redactor) => {
+  let entries = headerEntries(headers).map(
+    ([key, value]) => [key.toLowerCase(), sanitizeScalar(value, redactor).text]
+  ).filter(([key]) => isSafeHeaderName(key));
+  if (entries.length === 0) return void 0;
+  return Object.fromEntries(entries);
+};
+var getContentType = (headers) => headerEntries(headers).find(([key]) => key.toLowerCase() === "content-type")?.[1];
+var takeTraceDraft = (config2) => {
+  if (!config2) return void 0;
+  let draft = config2.__slatesHttpTraceDraft ?? (isObjectLike(config2) ? traceDraftsByConfig.get(config2) : void 0) ?? (isObjectLike(config2.headers) ? traceDraftsByHeaders.get(config2.headers) : void 0);
+  if (!draft) return void 0;
+  return draft;
+};
+var clearTraceDraft = (config2, draft) => {
+  if (!config2) return;
+  if (config2.__slatesHttpTraceDraft === draft) {
+    config2.__slatesHttpTraceDraft = void 0;
   }
-  toJSON() {
-    return this.toResponse();
+  if (isObjectLike(config2)) {
+    traceDraftsByConfig.delete(config2);
   }
-  static is(error) {
-    return error instanceof _SlateError;
+  if (isObjectLike(config2.headers)) {
+    traceDraftsByHeaders.delete(config2.headers);
   }
-  static fromUnknown(error, defaults = {}) {
-    if (_SlateError.is(error)) return error;
-    if (isSlateErrorResponse(error)) return new _SlateError({ ...defaults, ...error });
-    if (getServiceErrorData(error)) return _SlateError.fromServiceError(error, defaults);
-    if (isAxiosErrorLike(error)) return _SlateError.fromAxios(error, { defaults });
-    if (error instanceof Error) {
-      return new _SlateError({
-        code: defaults.code ?? DEFAULT_CODE,
-        message: error.message,
-        kind: defaults.kind,
-        retryable: defaults.retryable,
-        status: defaults.status,
-        issues: defaults.issues,
-        provider: defaults.provider,
-        upstream: defaults.upstream,
-        baggage: mergeRecords(defaults.baggage, {
-          originalName: error.name
-        }),
-        cause: error
-      });
+};
+var attachHttpTraceDraft = (config2, context) => {
+  let traceAwareConfig = config2;
+  let contentType = getContentType(config2.headers);
+  let redactor = new AuthConfigSecretRedactor(context._getAuthConfigForRedaction());
+  traceAwareConfig.__slatesHttpTraceDraft = {
+    context,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    startedAtMs: Date.now(),
+    request: {
+      method: (config2.method ?? "GET").toUpperCase(),
+      url: sanitizeUrl(buildUrl(config2.baseURL, config2.url), redactor),
+      ...sanitizeHeaders(config2.headers, redactor) ? { headers: sanitizeHeaders(config2.headers, redactor) } : {},
+      ...serializeTextBody(config2.data, contentType, redactor) ? { body: serializeTextBody(config2.data, contentType, redactor) } : {}
     }
-    return new _SlateError({
-      code: defaults.code ?? DEFAULT_CODE,
-      message: getDefaultMessage(defaults.code ?? DEFAULT_CODE, defaults.message),
-      kind: defaults.kind,
-      retryable: defaults.retryable,
-      status: defaults.status,
-      issues: defaults.issues,
-      provider: defaults.provider,
-      upstream: defaults.upstream,
-      baggage: mergeRecords(defaults.baggage, {
-        originalValue: sanitizeForBaggage(error)
-      })
-    });
+  };
+  if (isObjectLike(traceAwareConfig)) {
+    traceDraftsByConfig.set(traceAwareConfig, traceAwareConfig.__slatesHttpTraceDraft);
   }
-  static fromServiceError(error, defaults = {}) {
-    return new _SlateError(mapServiceErrorToSlateErrorInput(error, defaults));
+  if (isObjectLike(traceAwareConfig.headers)) {
+    traceDraftsByHeaders.set(
+      traceAwareConfig.headers,
+      traceAwareConfig.__slatesHttpTraceDraft
+    );
   }
-  static fromAxios(error, options = {}) {
-    if (_SlateError.is(error)) return error;
-    if (getServiceErrorData(error))
-      return _SlateError.fromServiceError(error, options.defaults);
-    if (!isAxiosErrorLike(error)) return _SlateError.fromUnknown(error, options.defaults);
-    let inferred = inferSlateErrorFromAxios(error, options);
-    let mapped = options.mapAxiosError?.(error, inferred);
-    if (_SlateError.is(mapped)) return mapped;
-    return new _SlateError(mergeSlateErrorData(inferred, mapped ?? void 0));
+  return config2;
+};
+var recordHttpTraceFromResponse = (response) => {
+  let config2 = response.config;
+  let draft = takeTraceDraft(config2);
+  if (!draft) return response;
+  clearTraceDraft(config2, draft);
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
+  let contentType = getContentType(response.headers);
+  draft.context.recordHttpTrace({
+    startedAt: draft.startedAt,
+    durationMs: Math.max(Date.now() - draft.startedAtMs, 0),
+    request: draft.request,
+    response: {
+      status: response.status,
+      ...response.statusText ? { statusText: response.statusText } : {},
+      ...sanitizeHeaders(response.headers, redactor) ? { headers: sanitizeHeaders(response.headers, redactor) } : {},
+      ...serializeTextBody(response.data, contentType, redactor) ? { body: serializeTextBody(response.data, contentType, redactor) } : {}
+    }
+  });
+  return response;
+};
+var recordHttpTraceFromError = (error) => {
+  let config2 = error.config;
+  let draft = takeTraceDraft(config2);
+  if (!draft) return;
+  clearTraceDraft(config2, draft);
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
+  let responseContentType = getContentType(error.response?.headers);
+  draft.context.recordHttpTrace({
+    startedAt: draft.startedAt,
+    durationMs: Math.max(Date.now() - draft.startedAtMs, 0),
+    request: draft.request,
+    ...error.response ? {
+      response: {
+        status: error.response.status,
+        ...error.response.statusText ? { statusText: error.response.statusText } : {},
+        ...sanitizeHeaders(error.response.headers, redactor) ? { headers: sanitizeHeaders(error.response.headers, redactor) } : {},
+        ...serializeTextBody(error.response.data, responseContentType, redactor) ? { body: serializeTextBody(error.response.data, responseContentType, redactor) } : {}
+      }
+    } : {},
+    error: {
+      ...error.code ? { code: error.code } : {},
+      message: error.message
+    }
+  });
+};
+
+// src/context/hook.ts
+import { AsyncLocalStorage } from "async_hooks";
+var slateContextStorageKey = /* @__PURE__ */ Symbol.for("slates.provider.context.asyncLocalStorage");
+var globalWithSlateContext = globalThis;
+var asyncLocalStorage = globalWithSlateContext[slateContextStorageKey] ?? new AsyncLocalStorage();
+globalWithSlateContext[slateContextStorageKey] = asyncLocalStorage;
+var runWithContext = (context, fn) => {
+  return asyncLocalStorage.run(context, fn);
+};
+var getCurrentContext = () => {
+  let context = asyncLocalStorage.getStore();
+  if (!context) {
+    throw new Error("No Slate context is available");
   }
+  return context;
+};
+
+// src/error/defaults.ts
+var DEFAULT_CODE = "internal.unexpected";
+var DEFAULT_MESSAGES = {
+  "declaration.invalid_definition": "The slate definition is invalid.",
+  "context.missing": "No Slate context is available.",
+  "input.invalid": "The provided input is invalid.",
+  "request.bad": "The request is invalid.",
+  "request.invalid_version": "The requested version is invalid.",
+  "request.precondition_failed": "The request precondition failed.",
+  "request.not_acceptable": "The request is not acceptable.",
+  "request.rate_limited": "Too many requests were made in a short period of time.",
+  "config.invalid": "The provided configuration is invalid.",
+  "auth.required": "Authentication is required.",
+  "auth.invalid": "Authentication failed.",
+  "auth.expired": "Authentication has expired.",
+  "permission.denied": "Permission was denied.",
+  "resource.not_found": "The requested resource was not found.",
+  "resource.conflict": "The requested resource is in conflict.",
+  "resource.gone": "The requested resource is no longer available.",
+  "payment.required": "Payment is required to continue.",
+  "operation.not_implemented": "The requested operation is not implemented.",
+  "upstream.invalid_request": "The upstream service rejected the request.",
+  "upstream.rate_limited": "The upstream service rate limited the request.",
+  "upstream.timeout": "The upstream service timed out.",
+  "upstream.network_error": "A network error occurred while contacting the upstream service.",
+  "upstream.unavailable": "The upstream service is unavailable.",
+  "upstream.invalid_response": "The upstream service returned an invalid response.",
+  "upstream.error": "The upstream service returned an error.",
+  "transport.invoke_failed": "The provider transport failed.",
+  "internal.timeout": "The operation timed out.",
+  "internal.unexpected": "An unexpected internal error occurred."
 };
-var createSlateError = (input) => new SlateError(input);
-
-// src/error/declaration.ts
-var SlateDeclarationError = class _SlateDeclarationError extends SlateError {
-  constructor(message, input = {}) {
-    super({
-      code: "declaration.invalid_definition",
-      kind: "declaration",
-      message,
-      ...input
-    });
-    this.name = "SlateError.DeclarationError";
-  }
-  static is(error) {
-    return error instanceof _SlateDeclarationError;
-  }
+var SERVICE_ERROR_CODE_MAP = {
+  invalid_data: "input.invalid",
+  bad_request: "request.bad",
+  not_found: "resource.not_found",
+  unauthorized: "auth.required",
+  forbidden: "permission.denied",
+  invalid_version: "request.invalid_version",
+  conflict: "resource.conflict",
+  gone: "resource.gone",
+  payment_required: "payment.required",
+  precondition_failed: "request.precondition_failed",
+  not_acceptable: "request.not_acceptable",
+  not_implemented: "operation.not_implemented",
+  too_many_requests: "request.rate_limited",
+  timeout: "internal.timeout",
+  internal_server_error: "internal.unexpected"
 };
 
-// src/action/scopes.ts
-var scopeClause = (...scopes) => {
-  assertScopeValues(scopes);
-  return {
-    OR: [...scopes]
-  };
+// src/error/utils.ts
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var normalizeKind = (code, kind) => {
+  if (kind) return kind;
+  if (code.startsWith("declaration.")) return "declaration";
+  if (code.startsWith("input.")) return "validation";
+  if (code.startsWith("request.")) return "request";
+  if (code.startsWith("config.")) return "config";
+  if (code.startsWith("auth.") || code.startsWith("permission.")) return "auth";
+  if (code.startsWith("resource.")) return "resource";
+  if (code.startsWith("payment.")) return "payment";
+  if (code.startsWith("transport.")) return "transport";
+  if (code.startsWith("upstream.")) return "upstream";
+  return "internal";
 };
-var anyOf = (...scopes) => ({
-  AND: [scopeClause(...scopes)]
-});
-var allOf = (...inputs) => {
-  let AND = inputs.flatMap((input) => normalizeScopes(input).AND);
-  return validateScopes({ AND });
+var normalizeStatus = (code, status) => {
+  if (status) return status;
+  if (code === "input.invalid" || code === "request.bad" || code === "config.invalid")
+    return 400;
+  if (code === "request.invalid_version") return 400;
+  if (code === "auth.required" || code === "auth.invalid" || code === "auth.expired")
+    return 401;
+  if (code === "payment.required") return 402;
+  if (code === "permission.denied") return 403;
+  if (code === "resource.not_found") return 404;
+  if (code === "resource.conflict") return 409;
+  if (code === "resource.gone") return 410;
+  if (code === "request.not_acceptable") return 406;
+  if (code === "request.precondition_failed") return 412;
+  if (code === "request.rate_limited" || code === "upstream.rate_limited") return 429;
+  if (code === "operation.not_implemented") return 501;
+  if (code === "upstream.invalid_request") return 400;
+  if (code === "upstream.timeout" || code === "internal.timeout") return 504;
+  if (code === "upstream.unavailable") return 503;
+  if (code === "upstream.error") return 502;
+  return void 0;
 };
-var mergeScopes = (...inputs) => {
-  let AND = inputs.flatMap((input) => input ? input.AND : []);
-  if (AND.length === 0) {
-    return void 0;
-  }
-  return validateScopes({ AND });
+var normalizeRetryable = (code, retryable) => {
+  if (typeof retryable === "boolean") return retryable;
+  return code === "request.rate_limited" || code === "upstream.rate_limited" || code === "upstream.timeout" || code === "upstream.network_error" || code === "upstream.unavailable" || code === "upstream.error" || code === "transport.invoke_failed" || code === "internal.timeout";
 };
-var validateScopes = (scopes) => {
-  if (!Array.isArray(scopes.AND) || scopes.AND.length === 0) {
-    throw new SlateDeclarationError("Action scopes must include at least one AND clause");
-  }
-  return {
-    AND: scopes.AND.map((clause) => normalizeClause(clause))
-  };
+var getDefaultMessage = (code, message) => {
+  if (message?.trim()) return message;
+  return DEFAULT_MESSAGES[code] ?? DEFAULT_MESSAGES[DEFAULT_CODE] ?? "An unexpected internal error occurred.";
 };
-var normalizeScopes = (input) => {
-  if (isScopes(input)) {
-    return validateScopes(input);
-  }
-  return {
-    AND: [normalizeClause(input)]
-  };
+var cleanRecord = (value) => {
+  if (!value) return void 0;
+  let entries = Object.entries(value).filter(([, entry]) => entry !== void 0);
+  if (entries.length === 0) return void 0;
+  return Object.fromEntries(entries);
 };
-var normalizeClause = (input) => {
-  if (typeof input === "string") {
-    return scopeClause(input);
-  }
-  if (Array.isArray(input)) {
-    return scopeClause(...input);
-  }
-  if (!isClause(input)) {
-    throw new SlateDeclarationError("Action scope clauses must be strings or OR clauses");
-  }
-  assertScopeValues(input.OR);
+var mergeRecords = (left, right) => {
+  if (!left && !right) return void 0;
+  return cleanRecord({
+    ...left ?? {},
+    ...right ?? {}
+  });
+};
+var mergeSlateErrorData = (base, override) => {
+  if (!override) return base;
   return {
-    OR: [...input.OR]
+    ...base,
+    ...override,
+    provider: cleanRecord({
+      ...base.provider ?? {},
+      ...override.provider ?? {}
+    }),
+    upstream: cleanRecord({
+      ...base.upstream ?? {},
+      ...override.upstream ?? {}
+    }),
+    baggage: mergeRecords(base.baggage, override.baggage),
+    issues: override.issues ?? base.issues,
+    requestTraces: override.requestTraces ?? base.requestTraces
   };
 };
-var assertScopeValues = (scopes) => {
-  if (scopes.length === 0) {
-    throw new SlateDeclarationError(
-      "Each action scope clause must include at least one OR scope"
-    );
-  }
-  for (let scope of scopes) {
-    if (typeof scope !== "string" || scope.trim().length === 0) {
-      throw new SlateDeclarationError("Action scopes must be non-empty strings");
-    }
-  }
-};
-var isClause = (value) => typeof value === "object" && value !== null && "OR" in value && Array.isArray(value.OR);
-var isScopes = (value) => typeof value === "object" && value !== null && "AND" in value && Array.isArray(value.AND);
-
-// src/action/builder.ts
-var SlateActionBuilder = class {
-  constructor(type, spec2, params, factory, isPublicTool = false) {
-    this.type = type;
-    this.spec = spec2;
-    this.params = params;
-    this.factory = factory;
-    this.isPublicTool = isPublicTool;
-    this.#configSchema = spec2.configSchema;
-    this.#authSchema = spec2.authSchema;
-  }
-  type;
-  spec;
-  params;
-  factory;
-  isPublicTool;
-  #configSchema;
-  #authSchema;
-  #inputSchema = null;
-  #outputSchema = null;
-  #scopes;
-  #authMethods;
-  #toolParams = null;
-  #triggerGroup = null;
-  #triggerMatches = null;
-  #triggerMap = null;
-  #interfaceLocked = false;
-  input(schema) {
-    if (this.#interfaceLocked) {
-      throw new SlateDeclarationError("Adapter contract input schema cannot be changed");
-    }
-    this.#inputSchema = schema;
-    return this;
-  }
-  output(schema) {
-    if (this.#interfaceLocked) {
-      throw new SlateDeclarationError("Adapter contract output schema cannot be changed");
-    }
-    this.#outputSchema = schema;
-    return this;
-  }
-  lockInterface() {
-    this.#interfaceLocked = true;
-    return this;
-  }
-  scopes(scopes) {
-    validateScopes(scopes);
-    this.#scopes = scopes;
-    return this;
-  }
-  authMethods(authMethods) {
-    if (this.isPublicTool) {
-      throw new SlateDeclarationError("Public tools cannot require authentication methods");
-    }
-    this.#authMethods = this.validateAuthMethods(authMethods);
-    return this;
-  }
-  validateAuthMethods(authMethods) {
-    if (!authMethods) return void 0;
-    let normalized = [...new Set(authMethods.map((authMethod) => authMethod.trim()))];
-    if (normalized.some((authMethod) => !authMethod)) {
-      throw new SlateDeclarationError("Auth method IDs must be non-empty strings");
-    }
-    return normalized;
-  }
-  handleInvocation(handler) {
-    if (this.type !== "tool") {
-      throw new SlateDeclarationError("handleInvocation can only be set for tool actions");
-    }
-    this.#toolParams = {
-      type: "tool",
-      handleInvocation: handler
-    };
-    return this;
-  }
-  triggerGroup(group) {
-    if (this.type !== "trigger") {
-      throw new SlateDeclarationError("triggerGroup can only be set for trigger actions");
-    }
-    this.#triggerGroup = group;
-    return this;
+var BAGGAGE_TRUNCATED_VALUE = "[truncated]";
+var BAGGAGE_REDACTED_VALUE = "[redacted]";
+var BAGGAGE_UNSERIALIZABLE_VALUE = "[unserializable]";
+var BAGGAGE_DEFAULT_MAX_DEPTH = 4;
+var BAGGAGE_RESPONSE_MAX_DEPTH = 8;
+var BAGGAGE_MAX_STRING_LENGTH = 2e3;
+var BAGGAGE_MAX_ARRAY_ITEMS = 20;
+var BAGGAGE_MAX_OBJECT_KEYS = 30;
+var BAGGAGE_MAX_SERIALIZED_SIZE = 16384;
+var BAGGAGE_STRING_TRUNCATION_SUFFIX = "...[truncated]";
+var BAGGAGE_MIN_STRING_SLICE = 32;
+var BAGGAGE_SCAN_LENGTH = BAGGAGE_MAX_STRING_LENGTH + 100;
+var BAGGAGE_REDACTOR_SCAN_LENGTH = BAGGAGE_MAX_STRING_LENGTH * 4;
+var BAGGAGE_MIN_ENTRY_COST = 6;
+var getCurrentAuthConfigRedactor = () => {
+  try {
+    let authConfig = getCurrentContext()._getAuthConfigForRedaction();
+    return authConfig ? new AuthConfigSecretRedactor(authConfig) : void 0;
+  } catch {
+    return void 0;
   }
-  matches(handler) {
-    if (this.type !== "trigger") {
-      throw new SlateDeclarationError("matches can only be set for trigger actions");
-    }
-    this.#triggerMatches = handler;
-    return this;
+};
+var ERROR_TEXT_MAX_LENGTH = BAGGAGE_MAX_STRING_LENGTH * 4;
+var ERROR_TEXT_SCAN_MARGIN = 512;
+var sanitizeErrorText = (text, redactor) => {
+  let activeRedactor = redactor === void 0 ? getCurrentAuthConfigRedactor() : redactor;
+  let truncated = text.length > ERROR_TEXT_MAX_LENGTH;
+  let scanned = truncated ? text.slice(0, ERROR_TEXT_MAX_LENGTH + ERROR_TEXT_SCAN_MARGIN) : text;
+  let result = scanned;
+  if (activeRedactor) {
+    try {
+      result = redactAuthConfigSecretsInText(result, activeRedactor);
+    } catch {
+      result = scanned;
+    }
+  }
+  result = sanitizeSecretValuesInText(result);
+  return truncated ? `${result.slice(0, ERROR_TEXT_MAX_LENGTH)}${BAGGAGE_STRING_TRUNCATION_SUFFIX}` : result;
+};
+var NUMERIC_SECRET_KEY_PATTERN = /(?:^|_)(?:pin|passcode|password|passwd|pwd|otp|totp|cvv|cvc|ccv|pan|ssn|card_number|card_code|cc_num(?:ber)?)(?:_|$)|(?:^|_)(?:code|secret|key)$/;
+var VALIDATION_VOCABULARY_PATTERN = /\b(?:required|invalid|must|blank|empty|missing|too (?:short|long|weak|common|simple)|characters?|(?:does not|doesn't|do not|don't) match|cannot be|can't be|not allowed|not valid|at least|at most|incorrect|already (?:taken|used|exists|in use)|has expired|is expired)\b/i;
+var isValidationProse = (value) => {
+  let text = value.trim();
+  if (text.length > 300) return false;
+  let words = text.split(/\s+/);
+  if (words.length < 3) return false;
+  if (words.some((word) => word.length > 20 || /[a-z]/i.test(word) && /\d/.test(word))) {
+    return false;
+  }
+  return VALIDATION_VOCABULARY_PATTERN.test(text);
+};
+var isKeptUnderSecretKey = (key, value) => {
+  if (typeof value === "boolean") return true;
+  if (typeof value === "number")
+    return !NUMERIC_SECRET_KEY_PATTERN.test(splitKeyParts(key).join("_"));
+  if (typeof value === "string") return isValidationProse(value);
+  if (Array.isArray(value)) {
+    return value.length > 0 && value.length <= BAGGAGE_MAX_ARRAY_ITEMS && value.every((item) => typeof item === "string" && isValidationProse(item));
   }
-  map(handler) {
-    if (this.type !== "trigger") {
-      throw new SlateDeclarationError("map can only be set for trigger actions");
-    }
-    this.#triggerMap = handler;
-    return this;
+  return false;
+};
+var jsonLength = (value) => JSON.stringify(value).length;
+var redactLiteralSecrets = (value, redactor) => {
+  if (!redactor) return value;
+  try {
+    return redactAuthConfigSecretsInText(
+      value.slice(0, BAGGAGE_REDACTOR_SCAN_LENGTH),
+      redactor
+    );
+  } catch {
+    return value;
   }
-  build() {
-    let scopes = this.#scopes ?? this.params.scopes;
-    if (scopes) {
-      validateScopes(scopes);
-    }
-    let authMethods = this.validateAuthMethods(this.#authMethods ?? this.params.authMethods);
-    if (this.isPublicTool && authMethods) {
-      throw new SlateDeclarationError("Public tools cannot require authentication methods");
-    }
-    if (!this.#inputSchema) {
-      throw new SlateDeclarationError("Input schema is not defined");
-    }
-    if (!this.#outputSchema) {
-      throw new SlateDeclarationError("Output schema is not defined");
-    }
-    if (this.type === "tool" && !this.#toolParams) {
-      throw new SlateDeclarationError("Tool invocation handler is not defined");
-    }
-    if (this.type === "trigger" && !this.#triggerGroup) {
-      throw new SlateDeclarationError("Trigger group is not defined");
-    }
-    if (this.type === "trigger" && !this.#triggerMatches) {
-      throw new SlateDeclarationError("Trigger matches handler is not defined");
-    }
-    if (this.type === "trigger" && !this.#triggerMap) {
-      throw new SlateDeclarationError("Trigger map handler is not defined");
+};
+var sanitizeBaggageString = (value, state) => {
+  let literalRedacted = redactLiteralSecrets(value, state.redactor);
+  let text = sanitizeSecretValuesInText(literalRedacted.slice(0, BAGGAGE_SCAN_LENGTH));
+  if (value.length > BAGGAGE_MAX_STRING_LENGTH || literalRedacted.length > BAGGAGE_MAX_STRING_LENGTH || text.length > BAGGAGE_MAX_STRING_LENGTH) {
+    text = `${text.slice(0, BAGGAGE_MAX_STRING_LENGTH)}${BAGGAGE_STRING_TRUNCATION_SUFFIX}`;
+  }
+  let cost = jsonLength(text);
+  if (cost > state.remaining) {
+    let sliceLength = state.remaining - BAGGAGE_STRING_TRUNCATION_SUFFIX.length - 2 - (cost - text.length);
+    text = sliceLength >= BAGGAGE_MIN_STRING_SLICE ? `${text.slice(0, sliceLength)}${BAGGAGE_STRING_TRUNCATION_SUFFIX}` : BAGGAGE_TRUNCATED_VALUE;
+    cost = jsonLength(text);
+    if (cost > state.remaining && text !== BAGGAGE_TRUNCATED_VALUE) {
+      text = BAGGAGE_TRUNCATED_VALUE;
+      cost = jsonLength(text);
     }
-    let triggerParams = this.type === "trigger" ? {
-      type: "trigger",
-      triggerGroup: this.#triggerGroup,
-      matches: this.#triggerMatches,
-      map: this.#triggerMap
-    } : null;
-    return this.factory({
-      ...this.params,
-      scopes,
-      authMethods,
-      isPublic: this.isPublicTool === true,
-      configSchema: this.#configSchema,
-      authSchema: this.#authSchema,
-      inputSchema: this.#inputSchema,
-      outputSchema: this.#outputSchema,
-      ...this.#toolParams,
-      ...triggerParams
-    });
   }
+  state.remaining -= cost;
+  return text;
 };
-
-// src/action/getFileUrlTool.ts
-import { z } from "zod";
-
-// src/auth/redact.ts
-var AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX = "$$MT$secret$authConfig$";
-var AuthConfigSecretRedactor = class {
-  secretToPlaceholder = /* @__PURE__ */ new Map();
-  constructor(authConfig) {
-    if (authConfig) this.buildSecretMap(authConfig);
+var sanitizeBaggageValue = (value, depth, maxDepth, state) => {
+  if (value === void 0) return value;
+  if (value === null) {
+    state.remaining -= 4;
+    return value;
   }
-  redact(value) {
-    return this.transform(value, (stringValue) => {
-      return this.secretToPlaceholder.get(stringValue) ?? stringValue;
-    });
+  if (depth >= maxDepth) {
+    state.remaining -= jsonLength(BAGGAGE_TRUNCATED_VALUE);
+    return BAGGAGE_TRUNCATED_VALUE;
   }
-  redactEmbedded(value) {
-    if (this.secretToPlaceholder.size === 0) return value;
-    let pattern = new RegExp(
-      [...this.secretToPlaceholder.keys()].sort((a, b) => b.length - a.length).map((secret) => secret.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"),
-      "g"
-    );
-    return this.transform(value, (stringValue) => {
-      let exactPlaceholder = this.secretToPlaceholder.get(stringValue);
-      if (exactPlaceholder) return exactPlaceholder;
-      return stringValue.replace(
-        pattern,
-        (secret) => `${this.secretToPlaceholder.get(secret)}$$`
-      );
-    });
+  if (typeof value === "string") return sanitizeBaggageString(value, state);
+  if (typeof value === "number" || typeof value === "boolean") {
+    state.remaining -= String(value).length;
+    return value;
   }
-  buildSecretMap(value, path = []) {
-    if (typeof value === "string") {
-      if (value.length === 0) return;
-      this.secretToPlaceholder.set(
-        value,
-        `${AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX}${path.join(".")}`
-      );
-      return;
-    }
-    if (Array.isArray(value)) {
-      value.forEach((item, index) => {
-        this.buildSecretMap(item, [...path, String(index)]);
-      });
-      return;
-    }
-    if (this.isPlainObject(value)) {
-      Object.entries(value).forEach(([key, nestedValue]) => {
-        this.buildSecretMap(nestedValue, [...path, key]);
-      });
+  if (typeof value === "bigint") return sanitizeBaggageString(value.toString(), state);
+  if (Array.isArray(value)) {
+    state.remaining -= 2;
+    let items = [];
+    for (let item of value.slice(0, BAGGAGE_MAX_ARRAY_ITEMS)) {
+      if (state.remaining <= 0) break;
+      state.remaining -= 1;
+      if (item === void 0) {
+        state.remaining -= 4;
+        items.push(null);
+        continue;
+      }
+      items.push(sanitizeBaggageValue(item, depth + 1, maxDepth, state));
     }
+    return items;
   }
-  transform(value, transformString) {
-    if (typeof value === "string") {
-      return transformString(value);
-    }
-    if (Array.isArray(value)) {
-      return value.map((item) => this.transform(item, transformString));
-    }
-    if (this.isPlainObject(value)) {
-      let result = {};
-      Object.entries(value).forEach(([key, nestedValue]) => {
-        result[key] = this.transform(nestedValue, transformString);
-      });
-      return result;
+  if (isRecord2(value)) {
+    state.remaining -= 2;
+    let entries = [];
+    for (let key of Object.keys(value).slice(0, BAGGAGE_MAX_OBJECT_KEYS)) {
+      if (state.remaining < BAGGAGE_MIN_ENTRY_COST) break;
+      let keyCost = jsonLength(key) + 2;
+      if (state.remaining - keyCost <= 0) continue;
+      state.remaining -= keyCost;
+      try {
+        let entry = value[key];
+        if (entry != null && isSecretFieldName(key) && !isKeptUnderSecretKey(key, entry)) {
+          state.remaining -= jsonLength(BAGGAGE_REDACTED_VALUE);
+          entries.push([key, BAGGAGE_REDACTED_VALUE]);
+          continue;
+        }
+        entries.push([key, sanitizeBaggageValue(entry, depth + 1, maxDepth, state)]);
+      } catch {
+        state.remaining -= jsonLength(BAGGAGE_UNSERIALIZABLE_VALUE);
+        entries.push([key, BAGGAGE_UNSERIALIZABLE_VALUE]);
+      }
     }
-    return value;
-  }
-  isPlainObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
+    return Object.fromEntries(entries);
   }
+  return sanitizeBaggageString(String(value), state);
 };
-var redactUrlAttachmentSecrets = (attachments, authConfig) => {
-  if (!authConfig || !attachments) return attachments;
-  let redactor = new AuthConfigSecretRedactor(authConfig);
-  return attachments.map((attachment) => {
-    if (attachment.content.type !== "url") return attachment;
-    if (!attachment.content.headers && !attachment.content.query) return attachment;
-    return {
-      ...attachment,
-      content: {
-        ...attachment.content,
-        headers: attachment.content.headers ? redactor.redactEmbedded(attachment.content.headers) : void 0,
-        query: attachment.content.query ? redactor.redactEmbedded(attachment.content.query) : void 0
-      }
-    };
-  });
-};
-
-// src/action/tool.ts
-var SlateTool = class _SlateTool extends SlateAction {
-  #handleInvocation;
-  constructor(spec2, inputSchema, outputSchema, params) {
-    super("tool", spec2, inputSchema, outputSchema, params);
-    this.#handleInvocation = params.handleInvocation;
-  }
-  static create(spec2, params) {
-    return new SlateActionBuilder("tool", spec2, params, (params2) => {
-      return _SlateTool.fromCreateParameters(spec2, params2);
+var sanitizeForBaggage = (value, options = {}) => {
+  try {
+    return sanitizeBaggageValue(value, 0, options.maxDepth ?? BAGGAGE_DEFAULT_MAX_DEPTH, {
+      remaining: options.maxSerializedSize ?? BAGGAGE_MAX_SERIALIZED_SIZE,
+      redactor: options.redactor === null ? void 0 : options.redactor ?? getCurrentAuthConfigRedactor()
     });
-  }
-  static fromCreateParameters(spec2, params) {
-    if (params.type !== "tool") throw new Error("Invalid action type for tool");
-    return new _SlateTool(spec2, params.inputSchema, params.outputSchema, params);
-  }
-  get handleInvocation() {
-    return this.#handleInvocation;
+  } catch {
+    return BAGGAGE_UNSERIALIZABLE_VALUE;
   }
 };
-var tool = (spec2, params) => SlateTool.create(spec2, params);
-
-// src/action/getFileUrlTool.ts
-var GET_FILE_URL_TOOL_ID = "metorial$getFileUrl";
-var getFileUrlToolInputSchema = z.object({
-  url: z.string(),
-  reference: z.any().nullable()
-});
-var getFileUrlToolOutputSchema = z.object({
-  url: z.string(),
-  expiresAt: z.string(),
-  headers: z.record(z.string(), z.string()).optional(),
-  query: z.record(z.string(), z.string()).optional()
-});
-var getFileUrlTool = (spec2, handleGetFileUrl) => tool(spec2, {
-  key: GET_FILE_URL_TOOL_ID,
-  name: "Get File URL",
-  description: "Reserved: refreshes an expiring attachment download URL. Hub-internal only."
-}).input(getFileUrlToolInputSchema).output(getFileUrlToolOutputSchema).handleInvocation(async (ctx) => {
-  let output = await handleGetFileUrl(ctx);
-  let redactor = new AuthConfigSecretRedactor(ctx._getAuthConfigForRedaction());
+var normalizeSlateErrorInput = (input) => {
+  let code = input.code || DEFAULT_CODE;
   return {
-    output: {
-      ...output,
-      ...output.headers ? { headers: redactor.redactEmbedded(output.headers) } : {},
-      ...output.query ? { query: redactor.redactEmbedded(output.query) } : {}
-    },
-    message: "ok"
+    code,
+    message: getDefaultMessage(code, input.message),
+    kind: normalizeKind(code, input.kind),
+    retryable: normalizeRetryable(code, input.retryable),
+    status: normalizeStatus(code, input.status ?? input.upstream?.status),
+    issues: input.issues,
+    provider: cleanRecord(input.provider),
+    upstream: cleanRecord({
+      ...input.upstream,
+      status: input.upstream?.status ?? input.status
+    }),
+    baggage: cleanRecord(input.baggage),
+    requestTraces: input.requestTraces
   };
-}).build();
+};
+var isSlateErrorResponse = (error) => {
+  if (!isRecord2(error)) return false;
+  return typeof error.code === "string" && typeof error.message === "string";
+};
 
-// src/action/publicTool.ts
-var SlatePublicTool = class {
-  constructor() {
+// src/error/api.ts
+var DEFAULT_DETAIL_KEYS = ["message", "detail", "error", "error_description", "code"];
+var DEFAULT_NESTED_KEYS = ["errors"];
+var isApiErrorRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var pushDetail = (details, value, options = {}) => {
+  if (typeof value !== "string" && (options.includeNumbers === false || typeof value !== "number")) {
+    return;
   }
-  static create(spec2, params) {
-    return new SlateActionBuilder(
-      "tool",
-      spec2,
-      params,
-      (params2) => {
-        return SlateTool.fromCreateParameters(spec2, {
-          ...params2,
-          isPublic: true
-        });
-      },
-      true
-    );
+  let detail = String(value).trim();
+  if (detail && !details.includes(detail)) {
+    details.push(detail);
   }
 };
-var publicTool = (spec2, params) => SlatePublicTool.create(spec2, params);
-
-// src/action/trigger.ts
-var SlateTrigger = class _SlateTrigger extends SlateAction {
-  #triggerGroup;
-  #matches;
-  #map;
-  constructor(spec2, inputSchema, outputSchema, params) {
-    super("trigger", spec2, inputSchema, outputSchema, params);
-    this.#triggerGroup = params.triggerGroup;
-    this.#matches = params.matches;
-    this.#map = params.map;
-  }
-  static create(spec2, params) {
-    return new SlateActionBuilder("trigger", spec2, params, (params2) => {
-      if (params2.type !== "trigger") throw new Error("Invalid action type for trigger");
-      return new _SlateTrigger(spec2, params2.inputSchema, params2.outputSchema, params2);
-    });
+var collectApiErrorDetails = (value, details, options = {}) => {
+  if (Array.isArray(value)) {
+    for (let item of value) {
+      collectApiErrorDetails(item, details, options);
+    }
+    return;
   }
-  get triggerGroup() {
-    return this.#triggerGroup;
+  if (!isApiErrorRecord(value)) {
+    pushDetail(details, value, options);
+    return;
   }
-  get matches() {
-    return this.#matches;
+  for (let key of options.detailKeys ?? DEFAULT_DETAIL_KEYS) {
+    pushDetail(details, value[key], options);
   }
-  get map() {
-    return this.#map;
+  for (let key of options.nestedKeys ?? DEFAULT_NESTED_KEYS) {
+    collectApiErrorDetails(value[key], details, options);
   }
 };
-var trigger = (spec2, params) => SlateTrigger.create(spec2, params);
-
-// src/action/triggerGroup.ts
-import { z as z2 } from "zod";
-var SlateDefaultPollingIntervalSeconds = 60 * 10;
-var SlateTriggerGroup = class _SlateTriggerGroup {
-  constructor(_spec, _params) {
-    this._spec = _spec;
-    this._params = _params;
-  }
-  _spec;
-  _params;
-  static create(spec2, params) {
-    return new SlateTriggerGroupBuilder(spec2, params, (p) => new _SlateTriggerGroup(spec2, p));
-  }
-  get spec() {
-    return this._spec;
+var getSlateErrorResponse = (error) => {
+  if (error.name !== "SlateError" || !isApiErrorRecord(error.data)) {
+    return void 0;
   }
-  get key() {
-    return this._params.key;
+  let data = error.data;
+  let upstream = isApiErrorRecord(data.upstream) ? data.upstream : void 0;
+  let status = upstream?.status ?? data.status;
+  return typeof status === "number" || typeof status === "string" ? { status } : void 0;
+};
+var getApiErrorResponse = (error) => {
+  if (!isApiErrorRecord(error)) {
+    return void 0;
   }
-  get name() {
-    return this._params.name;
+  if (!isApiErrorRecord(error.response)) {
+    return getSlateErrorResponse(error);
   }
-  get description() {
-    return this._params.description;
+  let response = error.response;
+  return {
+    status: typeof response.status === "number" || typeof response.status === "string" ? response.status : void 0,
+    statusText: typeof response.statusText === "string" ? response.statusText : void 0,
+    data: response.data
+  };
+};
+var getApiErrorStatus = (error) => getApiErrorResponse(error)?.status;
+var getApiErrorResponseWithBody = (error) => {
+  let response = getApiErrorResponse(error);
+  if (response?.data !== void 0) return response;
+  if (!isApiErrorRecord(error) || error.name !== "SlateError" || !isApiErrorRecord(error.data)) {
+    return response;
+  }
+  let baggage = isApiErrorRecord(error.data.baggage) ? error.data.baggage : void 0;
+  if (baggage?.response === void 0) return response;
+  return { ...response, data: baggage.response };
+};
+var API_ERROR_MAX_DETAILS = 5;
+var API_ERROR_MAX_MESSAGE_LENGTH = 1e3;
+var API_ERROR_TRUNCATED_PLACEHOLDER = BAGGAGE_TRUNCATED_VALUE;
+var BAGGAGE_PLACEHOLDERS = /* @__PURE__ */ new Set([
+  BAGGAGE_TRUNCATED_VALUE,
+  BAGGAGE_REDACTED_VALUE,
+  BAGGAGE_UNSERIALIZABLE_VALUE
+]);
+var looksLikeHtmlErrorBody = (value) => /^\s*<!doctype\s+html\b/i.test(value) || /^\s*<(html|head)\b[^>]*>/i.test(value) || /<\/(html|head|body)\s*>/i.test(value) || /^\s*<(title|h[1-6]|p|div|pre|center)\b[^>]*>[\s\S]*<\/\1\s*>/i.test(value);
+var truncateApiErrorMessage = (value, maxLength = API_ERROR_MAX_MESSAGE_LENGTH) => value.length > maxLength ? `${value.slice(0, maxLength)}...` : value;
+var readApiErrorText = (value, options = {}) => {
+  if (typeof value !== "string" && (options.includeNumbers === false || typeof value !== "number")) {
+    return void 0;
   }
-  get metadata() {
-    return this._params.metadata;
+  let text = String(value).trim();
+  if (!text || BAGGAGE_PLACEHOLDERS.has(text) || looksLikeHtmlErrorBody(text)) {
+    return void 0;
   }
-  get eventSchema() {
-    return this._params.eventSchema ?? z2.object({}).passthrough();
+  return text;
+};
+var pushBoundedApiErrorDetail = (details, value, options = {}) => {
+  if (details.length >= (options.maxDetails ?? API_ERROR_MAX_DETAILS)) return;
+  let text = readApiErrorText(value, options);
+  if (!text) return;
+  let detail = options.field ? `${options.field}: ${text}` : text;
+  if (!details.includes(detail)) {
+    details.push(detail);
   }
-  get source() {
-    return this._params.source;
+};
+var decodeApiErrorBody = (data, options = {}) => {
+  let text;
+  if (typeof data === "string") {
+    text = data;
+  } else if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) {
+    let bytes = data instanceof ArrayBuffer ? new Uint8Array(data) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+    if (options.maxBytes !== void 0 && bytes.byteLength > options.maxBytes) {
+      bytes = bytes.subarray(0, options.maxBytes);
+    }
+    text = new TextDecoder("utf-8").decode(bytes);
+  } else {
+    return data;
   }
-  get polling() {
-    return this._params.polling;
+  let trimmed = text.trim();
+  if (/^[{[]/.test(trimmed)) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+    }
   }
-  get webhook() {
-    return this._params.webhook;
+  return trimmed;
+};
+var statusLabelForApiError = (status, statusText) => status !== void 0 ? `HTTP ${status}${statusText ? ` ${statusText}` : ""}: ` : "";
+var extractApiErrorMessage = (error, options = {}) => {
+  let details = [];
+  let response = options.response ?? getApiErrorResponse(error);
+  collectApiErrorDetails(response?.data, details, options);
+  if (details.length > 0) {
+    return details.join(options.separator ?? " - ");
   }
-  get routingMatchers() {
-    return this._params.routingMatchers;
+  if (error instanceof Error && error.message) {
+    return error.message;
   }
+  return options.fallbackMessage ?? "Unknown error";
 };
-var SlateTriggerGroupBuilder = class {
-  constructor(spec2, params, factory) {
-    this.spec = spec2;
-    this.params = params;
-    this.factory = factory;
+var createApiServiceError = (message, options = {}) => {
+  let error = new ServiceError(badRequestError({ message }));
+  if (options.reason !== void 0) {
+    error.data.reason = options.reason;
   }
-  spec;
-  params;
-  factory;
-  #source = null;
-  #polling = null;
-  #webhook = null;
-  #routingMatchers = null;
-  polling(props) {
-    if (this.#source) {
-      throw new SlateDeclarationError("Trigger group invocation is already defined");
-    }
-    this.#source = "polling";
-    this.#polling = {
-      intervalSeconds: props.intervalSeconds ?? SlateDefaultPollingIntervalSeconds,
-      pollEvents: props.pollEvents
-    };
-    return this;
+  if ("upstreamStatus" in options) {
+    error.data.upstreamStatus = options.upstreamStatus;
   }
-  webhook(props) {
-    if (this.#source) {
-      throw new SlateDeclarationError("Trigger group invocation is already defined");
-    }
-    if (!!props.autoRegistration === !!props.manualRegistration) {
-      throw new SlateDeclarationError(
-        "Webhook trigger groups require exactly one of autoRegistration or manualRegistration"
-      );
-    }
-    this.#source = "webhook";
-    this.#webhook = {
-      autoRegistration: props.autoRegistration,
-      manualRegistration: props.manualRegistration,
-      process: props.process
-    };
-    return this;
+  if ("upstreamCode" in options) {
+    error.data.upstreamCode = options.upstreamCode;
   }
-  routingMatchers(handler) {
-    this.#routingMatchers = handler;
-    return this;
+  if (options.parent instanceof Error) {
+    error.setParent(options.parent);
   }
-  build() {
-    if (!this.#source) {
-      throw new SlateDeclarationError(
-        "Trigger group invocation (polling or webhook) is not defined"
-      );
-    }
-    if (!this.#routingMatchers) {
-      throw new SlateDeclarationError("Trigger group routing matchers handler is not defined");
-    }
-    return this.factory({
-      ...this.params,
-      source: this.#source,
-      polling: this.#polling ?? void 0,
-      webhook: this.#webhook ?? void 0,
-      routingMatchers: this.#routingMatchers
-    });
+  return error;
+};
+var helpers = {
+  collectDetails: collectApiErrorDetails,
+  extractMessage: extractApiErrorMessage,
+  getResponse: getApiErrorResponse,
+  getResponseWithBody: getApiErrorResponseWithBody,
+  getStatus: getApiErrorStatus,
+  isRecord: isApiErrorRecord,
+  statusLabelFor: statusLabelForApiError
+};
+var buildApiServiceError = (error, options) => {
+  if (error instanceof ServiceError) {
+    return error;
   }
+  let operation = options.operation ?? "request";
+  let response = options.extractResponse?.(error, helpers) ?? getApiErrorResponse(error);
+  let status = options.extractStatus?.(error, response, helpers) ?? response?.status;
+  let message = options.extractMessage?.(error, helpers) ?? extractApiErrorMessage(error, { ...options, response });
+  let statusLabel = statusLabelForApiError(status, response?.statusText);
+  let fullMessage = options.formatMessage?.({
+    providerLabel: options.providerLabel,
+    operation,
+    statusLabel,
+    message,
+    response,
+    status
+  }) ?? `${options.providerLabel} API ${operation} failed: ${statusLabel}${message}`;
+  return createApiServiceError(fullMessage, {
+    reason: options.reason,
+    upstreamStatus: status,
+    upstreamCode: options.extractUpstreamCode?.(error, response, helpers),
+    parent: options.parent ?? error
+  });
 };
-var triggerGroup = (spec2, params) => SlateTriggerGroup.create(spec2, params);
 
-// src/action/attachment.ts
-var createUrlAttachment = (url, opts = {}) => {
-  if (opts.refreshReference !== void 0 && !opts.refreshAt) {
-    throw new Error("createUrlAttachment: refreshAt is required when refreshReference is set");
+// src/error/axios.ts
+import { isAxiosError } from "axios";
+var getResponseField = (value, key) => {
+  if (!isRecord2(value)) return void 0;
+  return value[key];
+};
+var getNestedMessage = (value) => {
+  if (typeof value === "string") return value;
+  if (!isRecord2(value)) return void 0;
+  let message = getResponseField(value, "message");
+  if (typeof message === "string" && message.trim()) return message;
+  let description = getResponseField(value, "description");
+  if (typeof description === "string" && description.trim()) return description;
+  let error = getResponseField(value, "error");
+  if (typeof error === "string" && error.trim()) return error;
+  if (isRecord2(error)) {
+    let nested = getNestedMessage(error);
+    if (nested) return nested;
   }
-  return {
-    mimeType: opts.mimeType,
-    attachmentHash: opts.attachmentHash,
-    content: {
-      type: "url",
-      url,
-      ...opts.headers ? { headers: opts.headers } : {},
-      ...opts.query ? { query: opts.query } : {},
-      ...opts.refreshReference !== void 0 ? { refreshReference: opts.refreshReference } : {},
-      ...opts.refreshAt ? { refreshAt: opts.refreshAt } : {}
+  let errorDescription = getResponseField(value, "error_description");
+  if (typeof errorDescription === "string" && errorDescription.trim()) {
+    return errorDescription;
+  }
+  return void 0;
+};
+var getNestedCode = (value) => {
+  if (!isRecord2(value)) return void 0;
+  let directCode = getResponseField(value, "code");
+  if (typeof directCode === "string" && directCode.trim()) return directCode;
+  let errorCode = getResponseField(value, "error_code");
+  if (typeof errorCode === "string" && errorCode.trim()) return errorCode;
+  let type = getResponseField(value, "type");
+  if (typeof type === "string" && type.trim()) return type;
+  let error = getResponseField(value, "error");
+  if (typeof error === "string" && error.trim()) return error;
+  if (isRecord2(error)) return getNestedCode(error);
+  return void 0;
+};
+var getNestedType = (value) => {
+  if (!isRecord2(value)) return void 0;
+  let type = getResponseField(value, "type");
+  if (typeof type === "string" && type.trim()) return type;
+  let error = getResponseField(value, "error");
+  if (isRecord2(error)) {
+    let nestedType = getNestedType(error);
+    if (nestedType) return nestedType;
+  }
+  return void 0;
+};
+var getHeaderValue = (headers, key) => {
+  if (!headers) return void 0;
+  if (typeof headers.get === "function") {
+    let value = headers.get(key);
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  if (isRecord2(headers)) {
+    for (let [headerKey, headerValue] of Object.entries(headers)) {
+      if (headerKey.toLowerCase() !== key.toLowerCase()) continue;
+      if (typeof headerValue === "string" && headerValue.trim()) return headerValue;
+      if (Array.isArray(headerValue)) {
+        let first = headerValue.find((item) => typeof item === "string" && item.trim());
+        if (typeof first === "string") return first;
+      }
     }
-  };
+  }
+  return void 0;
 };
-var createBase64Attachment = (content, mimeType, attachmentHash) => ({
-  mimeType,
-  attachmentHash,
-  content: {
-    type: "content",
-    encoding: "base64",
-    content
+var sanitizeRequestUrl = (url, redactor) => {
+  try {
+    return sanitizeUrl(url, redactor);
+  } catch {
+    return sanitizeUrl(url);
   }
-});
-var createTextAttachment = (content, mimeType, attachmentHash) => ({
-  mimeType,
-  attachmentHash,
-  content: {
-    type: "content",
-    encoding: "utf-8",
-    content
+};
+var buildRequestUrl = (error, redactor) => {
+  let baseURL = error.config?.baseURL;
+  let url = error.config?.url;
+  if (!url) return void 0;
+  if (!baseURL) return sanitizeRequestUrl(url, redactor);
+  let absoluteUrl = url;
+  try {
+    absoluteUrl = new URL(url, baseURL).toString();
+  } catch {
   }
-});
-
-// src/action/directUpload.ts
-var bufferAttachmentBody = async (body, maxSizeBytes) => {
-  if (body instanceof Uint8Array) {
-    if (body.byteLength > maxSizeBytes) {
-      throw new Error(`Attachment exceeds the maximum size of ${maxSizeBytes} bytes`);
-    }
-    let buffered2 = new ArrayBuffer(body.byteLength);
-    new Uint8Array(buffered2).set(body);
-    return buffered2;
+  return sanitizeRequestUrl(absoluteUrl, redactor);
+};
+var getProviderDefaults = () => {
+  try {
+    let ctx = getCurrentContext();
+    return {
+      provider: {
+        key: ctx.specification.key
+      },
+      ...ctx.getHttpTraces().length > 0 ? { requestTraces: ctx.getHttpTraces() } : {}
+    };
+  } catch {
+    return {};
   }
-  let reader = body.getReader();
-  let chunks = [];
-  let sizeBytes = 0;
-  while (true) {
-    let { done, value } = await reader.read();
-    if (done) break;
-    if (!value) continue;
-    sizeBytes += value.byteLength;
-    if (sizeBytes > maxSizeBytes) {
-      await reader.cancel();
-      throw new Error(`Attachment exceeds the maximum size of ${maxSizeBytes} bytes`);
-    }
-    chunks.push(value);
+};
+var inferAxiosCode = (error, data) => {
+  let status = error.response?.status;
+  let axiosCode = error.code?.toUpperCase();
+  let remoteCode = getNestedCode(data)?.toLowerCase();
+  if (axiosCode === "ECONNABORTED" || axiosCode === "ETIMEDOUT" || status === 408 || remoteCode?.includes("timeout")) {
+    return "upstream.timeout";
   }
-  let buffered = new ArrayBuffer(sizeBytes);
-  let bufferedView = new Uint8Array(buffered);
-  let offset = 0;
-  for (let chunk of chunks) {
-    bufferedView.set(chunk, offset);
-    offset += chunk.byteLength;
+  if (!error.response) {
+    return "upstream.network_error";
   }
-  return buffered;
+  if (status === 401) return "auth.invalid";
+  if (status === 403) {
+    return remoteCode?.includes("rate") ? "upstream.rate_limited" : "permission.denied";
+  }
+  if (status === 404) return "resource.not_found";
+  if (status === 409) return "resource.conflict";
+  if (status === 422 || status === 400) return "upstream.invalid_request";
+  if (status === 429) return "upstream.rate_limited";
+  if (status === 502 || status === 503 || status === 504) return "upstream.unavailable";
+  if (status && status >= 500) return "upstream.error";
+  return "upstream.error";
 };
-var uploadAttachmentDirect = async (d) => {
-  let baseUrl = d.live.baseUrl.replace(/\/$/, "");
-  let body = await bufferAttachmentBody(d.body, d.live.maxAttachmentSizeBytes);
-  let registerRes = await fetch(`${baseUrl}/slates-hub/live-invocation/attachments`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${d.live.token}`
+var inferAxiosMessage = (error, data, code, redactor) => {
+  let message = getNestedMessage(data) ?? error.response?.statusText ?? error.message ?? getDefaultMessage(code);
+  let scrubbed = sanitizeErrorText(message, redactor ?? null);
+  return scrubbed.length > BAGGAGE_MAX_STRING_LENGTH ? `${scrubbed.slice(0, BAGGAGE_MAX_STRING_LENGTH)}...` : scrubbed;
+};
+var inferAxiosRetryable = (error, code) => {
+  let headerValue = getHeaderValue(error.response?.headers, "retry-after");
+  if (headerValue) return true;
+  return normalizeRetryable(code, void 0);
+};
+var isAxiosErrorLike = (error) => isAxiosError(error);
+var inferSlateErrorFromAxios = (error, options = {}) => {
+  let responseData = error.response ? options.extractResponseData?.(error.response) ?? error.response.data : void 0;
+  let code = inferAxiosCode(error, responseData);
+  let redactor = getCurrentAuthConfigRedactor();
+  return normalizeSlateErrorInput({
+    ...getProviderDefaults(),
+    ...options.defaults,
+    code: options.defaults?.code ?? code,
+    message: options.defaults?.message ?? inferAxiosMessage(error, responseData, code, redactor),
+    kind: options.defaults?.kind ?? normalizeKind(options.defaults?.code ?? code),
+    retryable: options.defaults?.retryable ?? inferAxiosRetryable(error, options.defaults?.code ?? code),
+    status: options.defaults?.status ?? error.response?.status,
+    provider: {
+      ...getProviderDefaults().provider,
+      ...options.defaults?.provider ?? {}
     },
-    body: JSON.stringify({
-      attachments: [
-        {
-          mimeType: d.mimeType,
-          filename: d.filename,
-          sizeBytes: body.byteLength || void 0
-        }
-      ]
+    upstream: {
+      ...options.defaults?.upstream ?? {},
+      status: error.response?.status ?? options.defaults?.upstream?.status,
+      code: getNestedCode(responseData) ?? options.defaults?.upstream?.code,
+      type: getNestedType(responseData) ?? options.defaults?.upstream?.type,
+      requestId: getHeaderValue(error.response?.headers, "x-request-id") ?? getHeaderValue(error.response?.headers, "request-id") ?? getHeaderValue(error.response?.headers, "x-correlation-id") ?? options.defaults?.upstream?.requestId,
+      method: error.config?.method?.toUpperCase() ?? options.defaults?.upstream?.method,
+      url: buildRequestUrl(error, redactor) ?? options.defaults?.upstream?.url
+    },
+    baggage: mergeRecords(options.defaults?.baggage, {
+      axiosCode: error.code,
+      response: sanitizeForBaggage(responseData, {
+        maxDepth: BAGGAGE_RESPONSE_MAX_DEPTH,
+        redactor: redactor ?? null
+      })
     })
   });
-  if (!registerRes.ok) {
-    throw new Error(
-      `Failed to register attachment for direct upload (status ${registerRes.status})`
-    );
-  }
-  let { attachments } = await registerRes.json();
-  let registration = attachments[0];
-  if (!registration) {
-    throw new Error("Live invocation API returned no attachment registrations");
-  }
-  let putRes = await fetch(registration.uploadUrl, {
-    method: "PUT",
-    headers: {
-      ...d.mimeType ? { "content-type": d.mimeType } : {},
-      "content-length": String(body.byteLength)
+};
+
+// src/error/service.ts
+import { isServiceError } from "@lowerdeck/error";
+var SERVICE_ERROR_DATA_RESERVED_KEYS = /* @__PURE__ */ new Set([
+  "status",
+  "code",
+  "message",
+  "hint",
+  "description",
+  "reason",
+  "errors",
+  "object",
+  "ok"
+]);
+var isStructuredValue = (value) => (typeof value === "object" || typeof value === "function") && value !== null;
+var mapServiceErrorCodeByStatus = (status) => {
+  if (status === 400) return "request.bad";
+  if (status === 401) return "auth.required";
+  if (status === 402) return "payment.required";
+  if (status === 403) return "permission.denied";
+  if (status === 404) return "resource.not_found";
+  if (status === 406) return "request.not_acceptable";
+  if (status === 409) return "resource.conflict";
+  if (status === 410) return "resource.gone";
+  if (status === 412) return "request.precondition_failed";
+  if (status === 429) return "request.rate_limited";
+  if (status === 501) return "operation.not_implemented";
+  if (status === 504) return "internal.timeout";
+  if (status && status >= 500) return "internal.unexpected";
+  return DEFAULT_CODE;
+};
+var normalizeServiceErrorIssues = (errors) => {
+  if (!Array.isArray(errors)) return void 0;
+  let issues = errors.map((error) => {
+    if (!isRecord2(error)) {
+      return {
+        message: String(error)
+      };
+    }
+    let path = Array.isArray(error.path) ? error.path.map((entry) => String(entry)) : void 0;
+    return {
+      ...error,
+      path,
+      code: typeof error.code === "string" ? error.code : void 0,
+      message: typeof error.message === "string" ? error.message : typeof error.hint === "string" ? error.hint : "Validation issue"
+    };
+  });
+  return issues.length > 0 ? issues : void 0;
+};
+var getServiceErrorBaggage = (data) => {
+  let extraEntries = Object.entries(data).filter(
+    ([key]) => !SERVICE_ERROR_DATA_RESERVED_KEYS.has(key)
+  );
+  return cleanRecord({
+    serviceError: {
+      code: data.code,
+      status: data.status,
+      hint: data.hint,
+      description: data.description,
+      reason: data.reason
     },
-    body
+    ...extraEntries.length > 0 ? {
+      serviceErrorData: sanitizeForBaggage(Object.fromEntries(extraEntries))
+    } : {}
   });
-  if (!putRes.ok) {
-    throw new Error(`Failed to upload attachment content (status ${putRes.status})`);
+};
+var mapServiceErrorCode = (code, status) => SERVICE_ERROR_CODE_MAP[code] ?? mapServiceErrorCodeByStatus(status);
+var isServiceErrorData = (value) => isRecord2(value) && typeof value.status === "number" && typeof value.code === "string" && typeof value.message === "string" && !("config" in value) && !("request" in value) && !("response" in value) && !("isAxiosError" in value);
+var getServiceErrorData = (error) => {
+  if (isServiceError(error)) {
+    return isServiceErrorData(error.data) ? error.data : null;
   }
-  return {
-    mimeType: d.mimeType,
-    content: { type: "upload_reference", referenceId: registration.referenceId }
+  if (isServiceErrorData(error)) {
+    return error;
+  }
+  if (isStructuredValue(error) && "data" in error && isServiceErrorData(error.data)) {
+    return error.data;
+  }
+  if (isStructuredValue(error) && "toResponse" in error && typeof error.toResponse === "function") {
+    let response = error.toResponse();
+    return isServiceErrorData(response) ? response : null;
+  }
+  return null;
+};
+var mapServiceErrorToSlateErrorInput = (error, defaults = {}) => {
+  let data = getServiceErrorData(error);
+  if (!data) {
+    return {
+      code: defaults.code ?? DEFAULT_CODE,
+      message: defaults.message ?? "An unexpected internal error occurred.",
+      kind: defaults.kind,
+      retryable: defaults.retryable,
+      status: defaults.status,
+      provider: defaults.provider,
+      upstream: defaults.upstream,
+      baggage: defaults.baggage
+    };
+  }
+  let code = defaults.code ?? mapServiceErrorCode(data.code, data.status);
+  return {
+    code,
+    message: defaults.message ?? data.message,
+    kind: defaults.kind ?? normalizeKind(code),
+    retryable: defaults.retryable ?? normalizeRetryable(code),
+    status: defaults.status ?? data.status,
+    issues: defaults.issues ?? normalizeServiceErrorIssues(data.errors),
+    provider: defaults.provider,
+    upstream: defaults.upstream,
+    baggage: cleanRecord({
+      ...defaults.baggage ?? {},
+      ...getServiceErrorBaggage(data)
+    })
   };
 };
 
-// src/adapter/adapter.ts
-var SlateAdapter = class {
-  constructor(_spec, _tools, _triggers) {
-    this._spec = _spec;
-    this._tools = _tools;
-    this._triggers = _triggers;
-  }
-  _spec;
-  _tools;
-  _triggers;
-  get spec() {
-    return this._spec;
+// src/error/base.ts
+var SlateError = class _SlateError extends Error {
+  cause;
+  data;
+  constructor(input) {
+    let normalized = normalizeSlateErrorInput(input);
+    super(normalized.message);
+    this.name = "SlateError";
+    this.data = normalized;
+    this.cause = input.cause;
   }
-  get id() {
-    return this._spec.id;
+  get code() {
+    return this.data.code;
   }
-  get name() {
-    return this._spec.name;
+  get kind() {
+    return this.data.kind;
   }
-  get capabilities() {
-    return this._spec.capabilities;
+  get status() {
+    return this.data.status;
   }
-  get tools() {
-    return this._tools;
+  get retryable() {
+    return this.data.retryable;
   }
-  get triggers() {
-    return this._triggers;
+  toResponse() {
+    return {
+      ...this.data
+    };
   }
-  get actions() {
-    return [...this._triggers, ...this._tools];
+  toJSON() {
+    return this.toResponse();
   }
-};
-
-// src/adapter/spec.ts
-var SlateAdapterSpec = class _SlateAdapterSpec {
-  constructor(_params) {
-    this._params = _params;
+  static is(error) {
+    return error instanceof _SlateError;
   }
-  _params;
-  static create(params) {
-    let id = params.id?.trim();
-    let name = params.name?.trim();
-    if (!id) {
-      throw new SlateDeclarationError("Adapter id must be a non-empty string");
-    }
-    if (!name) {
-      throw new SlateDeclarationError("Adapter name must be a non-empty string");
+  static fromUnknown(error, defaults = {}) {
+    if (_SlateError.is(error)) return error;
+    if (isSlateErrorResponse(error)) return new _SlateError({ ...defaults, ...error });
+    if (getServiceErrorData(error)) return _SlateError.fromServiceError(error, defaults);
+    if (isAxiosErrorLike(error)) return _SlateError.fromAxios(error, { defaults });
+    if (error instanceof Error) {
+      return new _SlateError({
+        code: defaults.code ?? DEFAULT_CODE,
+        message: error.message,
+        kind: defaults.kind,
+        retryable: defaults.retryable,
+        status: defaults.status,
+        issues: defaults.issues,
+        provider: defaults.provider,
+        upstream: defaults.upstream,
+        baggage: mergeRecords(defaults.baggage, {
+          originalName: error.name
+        }),
+        cause: error
+      });
     }
-    return new _SlateAdapterSpec({
-      id,
-      name,
-      capabilities: validateCapabilities(params.capabilities ?? [])
+    return new _SlateError({
+      code: defaults.code ?? DEFAULT_CODE,
+      message: getDefaultMessage(defaults.code ?? DEFAULT_CODE, defaults.message),
+      kind: defaults.kind,
+      retryable: defaults.retryable,
+      status: defaults.status,
+      issues: defaults.issues,
+      provider: defaults.provider,
+      upstream: defaults.upstream,
+      baggage: mergeRecords(defaults.baggage, {
+        originalValue: sanitizeForBaggage(error)
+      })
     });
   }
-  get id() {
-    return this._params.id;
+  static fromServiceError(error, defaults = {}) {
+    return new _SlateError(mapServiceErrorToSlateErrorInput(error, defaults));
   }
-  get name() {
-    return this._params.name;
+  static fromAxios(error, options = {}) {
+    if (_SlateError.is(error)) return error;
+    if (getServiceErrorData(error))
+      return _SlateError.fromServiceError(error, options.defaults);
+    if (!isAxiosErrorLike(error)) return _SlateError.fromUnknown(error, options.defaults);
+    let inferred = inferSlateErrorFromAxios(error, options);
+    let mapped = options.mapAxiosError?.(error, inferred);
+    if (_SlateError.is(mapped)) return mapped;
+    return new _SlateError(mergeSlateErrorData(inferred, mapped ?? void 0));
   }
-  get capabilities() {
-    return this._params.capabilities;
+};
+var createSlateError = (input) => new SlateError(input);
+
+// src/error/declaration.ts
+var SlateDeclarationError = class _SlateDeclarationError extends SlateError {
+  constructor(message, input = {}) {
+    super({
+      code: "declaration.invalid_definition",
+      kind: "declaration",
+      message,
+      ...input
+    });
+    this.name = "SlateError.DeclarationError";
   }
-  get parameters() {
-    return this._params;
+  static is(error) {
+    return error instanceof _SlateDeclarationError;
   }
-  tool(spec2, params) {
-    return SlateTool.create(spec2, this.linkAction(params));
+};
+
+// src/action/scopes.ts
+var scopeClause = (...scopes) => {
+  assertScopeValues(scopes);
+  return {
+    OR: [...scopes]
+  };
+};
+var anyOf = (...scopes) => ({
+  AND: [scopeClause(...scopes)]
+});
+var allOf = (...inputs) => {
+  let AND = inputs.flatMap((input) => normalizeScopes(input).AND);
+  return validateScopes({ AND });
+};
+var mergeScopes = (...inputs) => {
+  let AND = inputs.flatMap((input) => input ? input.AND : []);
+  if (AND.length === 0) {
+    return void 0;
   }
-  publicTool(spec2, params) {
-    return SlatePublicTool.create(spec2, this.linkAction(params));
+  return validateScopes({ AND });
+};
+var validateScopes = (scopes) => {
+  if (!Array.isArray(scopes.AND) || scopes.AND.length === 0) {
+    throw new SlateDeclarationError("Action scopes must include at least one AND clause");
   }
-  trigger(spec2, params) {
-    return SlateTrigger.create(spec2, this.linkAction(params));
+  return {
+    AND: scopes.AND.map((clause) => normalizeClause(clause))
+  };
+};
+var normalizeScopes = (input) => {
+  if (isScopes(input)) {
+    return validateScopes(input);
   }
-  register(params) {
-    let actions = [...params.tools, ...params.triggers];
-    let seenKeys = /* @__PURE__ */ new Set();
-    for (let action of actions) {
-      if (action.adapter && action.adapter !== this.id) {
-        throw new SlateDeclarationError(
-          `Action "${action.key}" is linked to adapter "${action.adapter}", not "${this.id}"`
-        );
-      }
-      if (!action.adapter) {
-        throw new SlateDeclarationError(
-          `Action "${action.key}" must be created with this adapter's tool(), publicTool(), or trigger() helpers`
-        );
-      }
-      if (seenKeys.has(action.key)) {
-        throw new SlateDeclarationError(
-          `Adapter "${this.id}" already has an action with key "${action.key}"`
-        );
-      }
-      seenKeys.add(action.key);
-    }
-    return new SlateAdapter(this, params.tools, params.triggers);
+  return {
+    AND: [normalizeClause(input)]
+  };
+};
+var normalizeClause = (input) => {
+  if (typeof input === "string") {
+    return scopeClause(input);
   }
-  linkAction(params) {
-    if (params.adapter != null && params.adapter !== this.id) {
-      throw new SlateDeclarationError(
-        `Action "${params.key}" cannot be linked to adapter "${this.id}" because it is already linked to "${params.adapter}"`
-      );
-    }
-    return {
-      ...params,
-      adapter: this.id
-    };
+  if (Array.isArray(input)) {
+    return scopeClause(...input);
+  }
+  if (!isClause(input)) {
+    throw new SlateDeclarationError("Action scope clauses must be strings or OR clauses");
   }
+  assertScopeValues(input.OR);
+  return {
+    OR: [...input.OR]
+  };
 };
-var adapterSpec = (params) => SlateAdapterSpec.create(params);
-var validateCapabilities = (capabilities) => {
-  let seenIds = /* @__PURE__ */ new Set();
-  return capabilities.map((capability) => {
-    let id = capability.id?.trim();
-    if (!id) {
-      throw new SlateDeclarationError("Adapter capability ids must be non-empty strings");
-    }
-    if (seenIds.has(id)) {
-      throw new SlateDeclarationError(`Adapter capability "${id}" is defined more than once`);
-    }
-    seenIds.add(id);
-    return {
-      id,
-      value: capability.value
-    };
-  });
+var assertScopeValues = (scopes) => {
+  if (scopes.length === 0) {
+    throw new SlateDeclarationError(
+      "Each action scope clause must include at least one OR scope"
+    );
+  }
+  for (let scope of scopes) {
+    if (typeof scope !== "string" || scope.trim().length === 0) {
+      throw new SlateDeclarationError("Action scopes must be non-empty strings");
+    }
+  }
 };
+var isClause = (value) => typeof value === "object" && value !== null && "OR" in value && Array.isArray(value.OR);
+var isScopes = (value) => typeof value === "object" && value !== null && "AND" in value && Array.isArray(value.AND);
 
-// src/auth/auth.ts
-var SlateAuth = class _SlateAuth {
-  #outputSchema = null;
-  #authStack = [];
-  constructor() {
+// src/action/builder.ts
+var SlateActionBuilder = class {
+  constructor(type, spec2, params, factory, isPublicTool = false) {
+    this.type = type;
+    this.spec = spec2;
+    this.params = params;
+    this.factory = factory;
+    this.isPublicTool = isPublicTool;
+    this.#configSchema = spec2.configSchema;
+    this.#authSchema = spec2.authSchema;
   }
-  static create() {
-    return new _SlateAuth();
+  type;
+  spec;
+  params;
+  factory;
+  isPublicTool;
+  #configSchema;
+  #authSchema;
+  #inputSchema = null;
+  #outputSchema = null;
+  #scopes;
+  #authMethods;
+  #toolParams = null;
+  #triggerGroup = null;
+  #triggerMatches = null;
+  #triggerMap = null;
+  #interfaceLocked = false;
+  input(schema) {
+    if (this.#interfaceLocked) {
+      throw new SlateDeclarationError("Adapter contract input schema cannot be changed");
+    }
+    this.#inputSchema = schema;
+    return this;
   }
   output(schema) {
+    if (this.#interfaceLocked) {
+      throw new SlateDeclarationError("Adapter contract output schema cannot be changed");
+    }
     this.#outputSchema = schema;
     return this;
   }
-  addAuth(auth2) {
-    let existingKeys = this.#authStack.map((a) => a.key);
-    if (existingKeys.includes(auth2.key)) {
-      throw new Error(`Auth with key "${auth2.key}" already exists in the auth stack`);
-    }
-    this.#authStack.push(auth2);
+  lockInterface() {
+    this.#interfaceLocked = true;
     return this;
   }
-  addOauth(auth2) {
-    this.addAuth(auth2);
+  scopes(scopes) {
+    validateScopes(scopes);
+    this.#scopes = scopes;
     return this;
   }
-  addTokenAuth(auth2) {
-    this.addAuth(auth2);
+  authMethods(authMethods) {
+    if (this.isPublicTool) {
+      throw new SlateDeclarationError("Public tools cannot require authentication methods");
+    }
+    this.#authMethods = this.validateAuthMethods(authMethods);
     return this;
   }
-  addServiceAccountAuth(auth2) {
-    this.addAuth(auth2);
+  validateAuthMethods(authMethods) {
+    if (!authMethods) return void 0;
+    let normalized = [...new Set(authMethods.map((authMethod) => authMethod.trim()))];
+    if (normalized.some((authMethod) => !authMethod)) {
+      throw new SlateDeclarationError("Auth method IDs must be non-empty strings");
+    }
+    return normalized;
+  }
+  handleInvocation(handler) {
+    if (this.type !== "tool") {
+      throw new SlateDeclarationError("handleInvocation can only be set for tool actions");
+    }
+    this.#toolParams = {
+      type: "tool",
+      handleInvocation: handler
+    };
     return this;
   }
-  addCustomAuth(auth2) {
-    this.addAuth(auth2);
+  triggerGroup(group) {
+    if (this.type !== "trigger") {
+      throw new SlateDeclarationError("triggerGroup can only be set for trigger actions");
+    }
+    this.#triggerGroup = group;
     return this;
   }
-  addNone() {
-    this.addAuth({
-      type: "auth.none",
-      name: "No Authentication",
-      key: "none"
-    });
+  matches(handler) {
+    if (this.type !== "trigger") {
+      throw new SlateDeclarationError("matches can only be set for trigger actions");
+    }
+    this.#triggerMatches = handler;
     return this;
   }
-  get authStack() {
-    return this.#authStack.filter((a) => a.type !== "auth.none");
+  map(handler) {
+    if (this.type !== "trigger") {
+      throw new SlateDeclarationError("map can only be set for trigger actions");
+    }
+    this.#triggerMap = handler;
+    return this;
   }
-  get outputSchema() {
+  build() {
+    let scopes = this.#scopes ?? this.params.scopes;
+    if (scopes) {
+      validateScopes(scopes);
+    }
+    let authMethods = this.validateAuthMethods(this.#authMethods ?? this.params.authMethods);
+    if (this.isPublicTool && authMethods) {
+      throw new SlateDeclarationError("Public tools cannot require authentication methods");
+    }
+    if (!this.#inputSchema) {
+      throw new SlateDeclarationError("Input schema is not defined");
+    }
     if (!this.#outputSchema) {
-      throw new Error("Output schema is not defined for this auth");
+      throw new SlateDeclarationError("Output schema is not defined");
     }
-    return this.#outputSchema;
+    if (this.type === "tool" && !this.#toolParams) {
+      throw new SlateDeclarationError("Tool invocation handler is not defined");
+    }
+    if (this.type === "trigger" && !this.#triggerGroup) {
+      throw new SlateDeclarationError("Trigger group is not defined");
+    }
+    if (this.type === "trigger" && !this.#triggerMatches) {
+      throw new SlateDeclarationError("Trigger matches handler is not defined");
+    }
+    if (this.type === "trigger" && !this.#triggerMap) {
+      throw new SlateDeclarationError("Trigger map handler is not defined");
+    }
+    let triggerParams = this.type === "trigger" ? {
+      type: "trigger",
+      triggerGroup: this.#triggerGroup,
+      matches: this.#triggerMatches,
+      map: this.#triggerMap
+    } : null;
+    return this.factory({
+      ...this.params,
+      scopes,
+      authMethods,
+      isPublic: this.isPublicTool === true,
+      configSchema: this.#configSchema,
+      authSchema: this.#authSchema,
+      inputSchema: this.#inputSchema,
+      outputSchema: this.#outputSchema,
+      ...this.#toolParams,
+      ...triggerParams
+    });
   }
 };
-var auth = () => SlateAuth.create();
 
-// src/auth/oauth.ts
-var isOAuthTokenResponse = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var formatOAuthTokenResponseMessage = (fieldLabel, providerLabel = "OAuth provider", operation = "token response") => `${providerLabel} OAuth ${operation} did not return ${fieldLabel}.`;
-var getOAuthExpiresAtFromExpiresIn = (expiresIn, options = {}) => {
-  let {
-    nowMs = Date.now(),
-    providerLabel,
-    operation,
-    required = false,
-    expiresInType = "numberLike",
-    message
-  } = options;
-  if (expiresIn === void 0 || expiresIn === null || expiresIn === "") {
-    if (required) {
-      throw createApiServiceError(
-        message ?? formatOAuthTokenResponseMessage(
-          "a valid expires_in value",
-          providerLabel,
-          operation
-        ),
-        { reason: "oauth_token_response" }
-      );
-    }
-    return void 0;
+// src/action/getFileUrlTool.ts
+import { z } from "zod";
+
+// src/action/tool.ts
+var SlateTool = class _SlateTool extends SlateAction {
+  #handleInvocation;
+  constructor(spec2, inputSchema, outputSchema, params) {
+    super("tool", spec2, inputSchema, outputSchema, params);
+    this.#handleInvocation = params.handleInvocation;
   }
-  let seconds = typeof expiresIn === "number" ? expiresIn : expiresInType === "numberLike" && typeof expiresIn === "string" ? Number(expiresIn) : Number.NaN;
-  if (!Number.isFinite(seconds)) {
-    throw createApiServiceError(
-      message ?? formatOAuthTokenResponseMessage("a valid expires_in value", providerLabel, operation),
-      { reason: "oauth_token_response" }
-    );
+  static create(spec2, params) {
+    return new SlateActionBuilder("tool", spec2, params, (params2) => {
+      return _SlateTool.fromCreateParameters(spec2, params2);
+    });
   }
-  return new Date(nowMs + seconds * 1e3).toISOString();
-};
-var getRefreshToken = (refreshToken, previousRefreshToken, fallbackMode) => {
-  if (typeof refreshToken === "string") {
-    if (fallbackMode === "falsy" && !refreshToken) {
-      return previousRefreshToken;
-    }
-    return refreshToken;
+  static fromCreateParameters(spec2, params) {
+    if (params.type !== "tool") throw new Error("Invalid action type for tool");
+    return new _SlateTool(spec2, params.inputSchema, params.outputSchema, params);
   }
-  if (fallbackMode === "falsy" && !refreshToken) {
-    return previousRefreshToken;
+  get handleInvocation() {
+    return this.#handleInvocation;
   }
-  return refreshToken === void 0 || refreshToken === null ? previousRefreshToken : void 0;
 };
-var normalizeOAuthTokenResponse = (data, options = {}) => {
-  let {
-    providerLabel,
-    operation,
-    previousRefreshToken,
-    refreshTokenFallbackMode = "nullish",
-    accessTokenMessage,
-    expiresInMessage,
-    ...expiresAtOptions
-  } = options;
-  if (!isOAuthTokenResponse(data)) {
-    throw createApiServiceError(
-      accessTokenMessage ?? formatOAuthTokenResponseMessage("a token response object", providerLabel, operation),
-      { reason: "oauth_token_response" }
-    );
+var tool = (spec2, params) => SlateTool.create(spec2, params);
+
+// src/action/getFileUrlTool.ts
+var GET_FILE_URL_TOOL_ID = "metorial$getFileUrl";
+var getFileUrlToolInputSchema = z.object({
+  url: z.string(),
+  reference: z.any().nullable()
+});
+var getFileUrlToolOutputSchema = z.object({
+  url: z.string(),
+  expiresAt: z.string(),
+  headers: z.record(z.string(), z.string()).optional(),
+  query: z.record(z.string(), z.string()).optional()
+});
+var getFileUrlTool = (spec2, handleGetFileUrl) => tool(spec2, {
+  key: GET_FILE_URL_TOOL_ID,
+  name: "Get File URL",
+  description: "Reserved: refreshes an expiring attachment download URL. Hub-internal only."
+}).input(getFileUrlToolInputSchema).output(getFileUrlToolOutputSchema).handleInvocation(async (ctx) => {
+  let output = await handleGetFileUrl(ctx);
+  let redactor = new AuthConfigSecretRedactor(ctx._getAuthConfigForRedaction());
+  return {
+    output: {
+      ...output,
+      url: redactor.redactEmbedded(output.url, isUrlEmbeddedCredential),
+      ...output.headers ? { headers: redactor.redactEmbedded(output.headers) } : {},
+      ...output.query ? { query: redactor.redactEmbedded(output.query) } : {}
+    },
+    message: "ok"
+  };
+}).build();
+
+// src/action/publicTool.ts
+var SlatePublicTool = class {
+  constructor() {
   }
-  if (typeof data.access_token !== "string" || !data.access_token) {
-    throw createApiServiceError(
-      accessTokenMessage ?? formatOAuthTokenResponseMessage("an access token", providerLabel, operation),
-      { reason: "oauth_token_response" }
+  static create(spec2, params) {
+    return new SlateActionBuilder(
+      "tool",
+      spec2,
+      params,
+      (params2) => {
+        return SlateTool.fromCreateParameters(spec2, {
+          ...params2,
+          isPublic: true
+        });
+      },
+      true
     );
   }
-  return {
-    token: data.access_token,
-    refreshToken: getRefreshToken(
-      data.refresh_token,
-      previousRefreshToken,
-      refreshTokenFallbackMode
-    ),
-    expiresAt: getOAuthExpiresAtFromExpiresIn(data.expires_in, {
-      ...expiresAtOptions,
-      providerLabel,
-      operation,
-      message: expiresInMessage
-    })
-  };
 };
+var publicTool = (spec2, params) => SlatePublicTool.create(spec2, params);
 
-// src/axios/index.ts
-import baseAxios, { getAdapter, isAxiosError as isAxiosError2 } from "axios";
-
-// src/axios/trace.ts
-var traceDraftsByConfig = /* @__PURE__ */ new WeakMap();
-var traceDraftsByHeaders = /* @__PURE__ */ new WeakMap();
-var TRACE_TEXT_LIMIT = 10 * 1024;
-var REDACTED_VALUE = "[redacted]";
-var STRUCTURED_DEPTH_LIMIT = 6;
-var STRUCTURED_ENTRY_LIMIT = 50;
-var CORE_SECRET_KEY_ATOMS = [
-  // HTTP authentication
-  "authorization",
-  "proxy[-_.]?authorization",
-  "www[-_.]?authenticate",
-  "bearer",
-  // Generic tokens
-  "token",
-  "tokens",
-  "access[-_.]?token",
-  "refresh[-_.]?token",
-  "id[-_.]?token",
-  "auth[-_.]?token",
-  "bearer[-_.]?token",
-  "session[-_.]?token",
-  "api[-_.]?token",
-  "app[-_.]?token",
-  "user[-_.]?token",
-  "oauth[-_.]?token",
-  "personal[-_.]?access[-_.]?token",
-  "x[-_.]?auth[-_.]?token",
-  "x[-_.]?access[-_.]?token",
-  "x[-_.]?refresh[-_.]?token",
-  // API keys
-  "apikey",
-  "api[-_.]?key",
-  "app[-_.]?key",
-  "x[-_.]?api[-_.]?key",
-  "x[-_.]?app[-_.]?key",
-  // OAuth client credentials
-  "client[-_.]?secret",
-  "client[-_.]?key",
-  "consumer[-_.]?secret",
-  "consumer[-_.]?key",
-  // Cryptographic keys
-  "private[-_.]?key",
-  "privatekey",
-  "secret[-_.]?key",
-  "secretkey",
-  "secret[-_.]?access[-_.]?key",
-  "encryption[-_.]?key",
-  "decryption[-_.]?key",
-  "signing[-_.]?key",
-  "signing[-_.]?secret",
-  "master[-_.]?key",
-  "master[-_.]?secret",
-  "master[-_.]?password",
-  "shared[-_.]?secret",
-  "webhook[-_.]?secret",
-  "webhook[-_.]?signing[-_.]?secret",
-  // OAuth codes & PKCE
-  "auth[-_.]?code",
-  "authcode",
-  "authorization[-_.]?code",
-  "code[-_.]?verifier",
-  "code[-_.]?challenge",
-  // Passwords & passcodes
-  "password",
-  "passwd",
-  "pwd",
-  "passphrase",
-  "pass[-_.]?phrase",
-  "pin",
-  "passcode",
-  // Generic secret markers
-  "secret",
-  "secrets",
-  "credential",
-  "credentials",
-  "creds",
-  "auth",
-  "x[-_.]?auth",
-  "x[-_.]?auth[-_.]?key",
-  // CSRF / XSRF
-  "csrf",
-  "xsrf",
-  "csrf[-_.]?token",
-  "xsrf[-_.]?token",
-  "x[-_.]?csrf[-_.]?token",
-  "x[-_.]?xsrf[-_.]?token",
-  // JWT
-  "jwt",
-  // Sessions & cookies
-  "session[-_.]?id",
-  "sessionid",
-  "sid",
-  "cookie",
-  "cookies",
-  "set[-_.]?cookie",
-  // Signatures / MAC
-  "signature",
-  "x[-_.]?hub[-_.]?signature",
-  "x[-_.]?signature",
-  "sig",
-  "hmac",
-  "mac",
-  // Crypto artifacts
-  "salt",
-  "nonce",
-  // Multi-factor / verification
-  "otp",
-  "totp",
-  "mfa",
-  "mfa[-_.]?code",
-  "2fa",
-  "two[-_.]?factor",
-  "twofactor",
-  "verification[-_.]?code",
-  "verify[-_.]?code",
-  "confirm(?:ation)?[-_.]?code",
-  "sms[-_.]?code",
-  "email[-_.]?code",
-  // Recovery & seed phrases
-  "seed[-_.]?phrase",
-  "mnemonic",
-  "recovery[-_.]?key",
-  "recovery[-_.]?code",
-  "recovery[-_.]?phrase",
-  // PII / financial
-  "card[-_.]?number",
-  "card[-_.]?code",
-  "cvv",
-  "cvc",
-  "ccv",
-  "cc[-_.]?num(?:ber)?",
-  "pan",
-  "ssn",
-  "social[-_.]?security",
-  "license[-_.]?key"
-];
-var URL_FORM_SECRET_KEY_ATOMS = [...CORE_SECRET_KEY_ATOMS, "code"];
-var buildKeyBoundaryPattern = (atoms, flags) => new RegExp(`(?:^|[^A-Za-z0-9])(?:${atoms.join("|")})(?=[^A-Za-z0-9]|$)`, flags);
-var SECRET_KEY_PATTERN = buildKeyBoundaryPattern(CORE_SECRET_KEY_ATOMS, "i");
-var URL_FORM_SECRET_KEY_PATTERN = buildKeyBoundaryPattern(URL_FORM_SECRET_KEY_ATOMS, "i");
-var NON_SECRET_KEY_EXACT = /* @__PURE__ */ new Set([
-  "token_type",
-  "token-type",
-  "tokentype",
-  "token_kind",
-  "token-kind",
-  "tokenkind",
-  "token_ttl",
-  "token-ttl",
-  "token_expires_in",
-  "token-expires-in",
-  "token_expiry",
-  "signature_method",
-  "signature-method",
-  "signature_type",
-  "signature-type",
-  "signature_version",
-  "signature-version",
-  "auth_type",
-  "auth-type",
-  "auth_method",
-  "auth-method",
-  "authentication_type",
-  "authentication-type",
-  "authentication_method",
-  "authentication-method",
-  "grant_type",
-  "grant-type",
-  "password_strength",
-  "password-strength",
-  "password_policy",
-  "password-policy",
-  "key_type",
-  "key-type",
-  "key_name",
-  "key-name",
-  "key_id",
-  "key-id",
-  "kid"
-]);
-var isSecretKeyName = (name) => {
-  let normalized = name.toLowerCase();
-  if (NON_SECRET_KEY_EXACT.has(normalized)) return false;
-  return SECRET_KEY_PATTERN.test(normalized);
+// src/action/trigger.ts
+var SlateTrigger = class _SlateTrigger extends SlateAction {
+  #triggerGroup;
+  #matches;
+  #map;
+  constructor(spec2, inputSchema, outputSchema, params) {
+    super("trigger", spec2, inputSchema, outputSchema, params);
+    this.#triggerGroup = params.triggerGroup;
+    this.#matches = params.matches;
+    this.#map = params.map;
+  }
+  static create(spec2, params) {
+    return new SlateActionBuilder("trigger", spec2, params, (params2) => {
+      if (params2.type !== "trigger") throw new Error("Invalid action type for trigger");
+      return new _SlateTrigger(spec2, params2.inputSchema, params2.outputSchema, params2);
+    });
+  }
+  get triggerGroup() {
+    return this.#triggerGroup;
+  }
+  get matches() {
+    return this.#matches;
+  }
+  get map() {
+    return this.#map;
+  }
 };
-var isUrlFormSecretKeyName = (name) => {
-  let normalized = name.toLowerCase();
-  if (NON_SECRET_KEY_EXACT.has(normalized)) return false;
-  return URL_FORM_SECRET_KEY_PATTERN.test(normalized);
+var trigger = (spec2, params) => SlateTrigger.create(spec2, params);
+
+// src/action/triggerGroup.ts
+import { z as z2 } from "zod";
+var SlateDefaultPollingIntervalSeconds = 60 * 10;
+var SlateTriggerGroup = class _SlateTriggerGroup {
+  constructor(_spec, _params) {
+    this._spec = _spec;
+    this._params = _params;
+  }
+  _spec;
+  _params;
+  static create(spec2, params) {
+    return new SlateTriggerGroupBuilder(spec2, params, (p) => new _SlateTriggerGroup(spec2, p));
+  }
+  get spec() {
+    return this._spec;
+  }
+  get key() {
+    return this._params.key;
+  }
+  get name() {
+    return this._params.name;
+  }
+  get description() {
+    return this._params.description;
+  }
+  get metadata() {
+    return this._params.metadata;
+  }
+  get eventSchema() {
+    return this._params.eventSchema ?? z2.object({}).passthrough();
+  }
+  get source() {
+    return this._params.source;
+  }
+  get polling() {
+    return this._params.polling;
+  }
+  get webhook() {
+    return this._params.webhook;
+  }
+  get gateway() {
+    return this._params.gateway;
+  }
+  get routingMatchers() {
+    return this._params.routingMatchers;
+  }
 };
-var KNOWN_SECRET_VALUE_PATTERNS = [
-  // JSON Web Tokens (header.payload.signature)
-  /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
-  // AWS access key IDs
-  /\b(?:AKIA|ASIA|AGPA|AIDA|ANPA|ANVA|AROA|APKA|ASCA)[A-Z0-9]{16}\b/g,
-  // GitHub tokens (PAT / OAuth / server-to-server / user-to-server / refresh)
-  /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g,
-  // Slack tokens
-  /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g,
-  // Stripe secret / public / restricted keys
-  /\b(?:sk|rk|pk)_(?:test|live)_[A-Za-z0-9]{16,}\b/g,
-  // OpenAI API keys
-  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g,
-  // Anthropic API keys
-  /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
-  // Google API keys
-  /\bAIza[A-Za-z0-9_-]{35}\b/g,
-  // SendGrid API keys
-  /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/g,
-  // Twilio API keys
-  /\bSK[0-9a-fA-F]{32}\b/g,
-  // PEM-encoded private keys (multi-line)
-  /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
-  // SSH private keys (OpenSSH format)
-  /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]*?-----END OPENSSH PRIVATE KEY-----/g
-];
-var HTTP_AUTH_SCHEME_PATTERN = /\b(bearer|basic|digest|token|negotiate|apikey)\s+([A-Za-z0-9_\-.~+/=]{4,})/gi;
-var GENERIC_KEY_VALUE_PATTERN = /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)(\s*=\s*)([^&#\s;]+)/g;
-var GENERIC_JSON_KEY_VALUE_PATTERN = /"([^"\\]*(?:\\.[^"\\]*)*)"(\s*:\s*)"([^"\\]*(?:\\.[^"\\]*)*)"/g;
-var SAFE_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "accept",
-  "accept-encoding",
-  "accept-language",
-  "cache-control",
-  "connection",
-  "content-encoding",
-  "content-language",
-  "content-length",
-  "content-type",
-  "date",
-  "etag",
-  "expires",
-  "if-modified-since",
-  "if-none-match",
-  "keep-alive",
-  "last-modified",
-  "location",
-  "origin",
-  "pragma",
-  "referer",
-  "referrer-policy",
-  "request-id",
-  "retry-after",
-  "server",
-  "transfer-encoding",
-  "user-agent",
-  "vary",
-  "via",
-  "x-correlation-id",
-  "x-powered-by",
-  "x-request-id",
-  "x-slates-provider",
-  "x-trace-id"
-]);
-var SAFE_HEADER_PREFIXES = ["ratelimit-", "x-ratelimit-"];
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isObjectLike = (value) => typeof value === "object" && value !== null;
-var normalizeContentType = (value) => value?.split(";")[0]?.trim().toLowerCase() || void 0;
-var isTextContentType = (contentType) => !contentType || /(^text\/)|json|xml|html|javascript|graphql|x-www-form-urlencoded|svg/.test(contentType);
-var isSafeHeaderName = (name) => {
-  let normalized = name.toLowerCase();
-  if (isSecretKeyName(normalized)) return false;
-  if (SAFE_HEADER_NAMES.has(normalized)) return true;
-  return SAFE_HEADER_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+var SlateTriggerGroupBuilder = class {
+  constructor(spec2, params, factory) {
+    this.spec = spec2;
+    this.params = params;
+    this.factory = factory;
+  }
+  spec;
+  params;
+  factory;
+  #source = null;
+  #polling = null;
+  #webhook = null;
+  #gateway = null;
+  #routingMatchers = null;
+  polling(props) {
+    if (this.#source) {
+      throw new SlateDeclarationError("Trigger group invocation is already defined");
+    }
+    this.#source = "polling";
+    this.#polling = {
+      intervalSeconds: props.intervalSeconds ?? SlateDefaultPollingIntervalSeconds,
+      pollEvents: props.pollEvents
+    };
+    return this;
+  }
+  webhook(props) {
+    if (this.#source) {
+      throw new SlateDeclarationError("Trigger group invocation is already defined");
+    }
+    if (!!props.autoRegistration === !!props.manualRegistration) {
+      throw new SlateDeclarationError(
+        "Webhook trigger groups require exactly one of autoRegistration or manualRegistration"
+      );
+    }
+    this.#source = "webhook";
+    this.#webhook = {
+      autoRegistration: props.autoRegistration,
+      manualRegistration: props.manualRegistration,
+      process: props.process
+    };
+    return this;
+  }
+  /** Receive events over a platform-managed persistent connection (e.g. a WebSocket gateway). */
+  gateway(props) {
+    if (this.#source) {
+      throw new SlateDeclarationError("Trigger group invocation is already defined");
+    }
+    this.#source = "gateway";
+    this.#gateway = { connect: props.connect, receive: props.receive };
+    return this;
+  }
+  routingMatchers(handler) {
+    this.#routingMatchers = handler;
+    return this;
+  }
+  build() {
+    if (!this.#source) {
+      throw new SlateDeclarationError(
+        "Trigger group invocation (polling, webhook, or gateway) is not defined"
+      );
+    }
+    if (!this.#routingMatchers) {
+      throw new SlateDeclarationError("Trigger group routing matchers handler is not defined");
+    }
+    return this.factory({
+      ...this.params,
+      source: this.#source,
+      polling: this.#polling ?? void 0,
+      webhook: this.#webhook ?? void 0,
+      gateway: this.#gateway ?? void 0,
+      routingMatchers: this.#routingMatchers
+    });
+  }
 };
-var truncateText = (text) => {
-  if (text.length <= TRACE_TEXT_LIMIT) {
-    return { text, truncated: false };
+var triggerGroup = (spec2, params) => SlateTriggerGroup.create(spec2, params);
+
+// src/action/attachment.ts
+var createUrlAttachment = (url, opts = {}) => {
+  if (opts.refreshReference !== void 0 && !opts.refreshAt) {
+    throw new Error("createUrlAttachment: refreshAt is required when refreshReference is set");
   }
   return {
-    text: `${text.slice(0, TRACE_TEXT_LIMIT)}...[truncated]`,
-    truncated: true
+    mimeType: opts.mimeType,
+    attachmentHash: opts.attachmentHash,
+    content: {
+      type: "url",
+      url,
+      ...opts.headers ? { headers: opts.headers } : {},
+      ...opts.query ? { query: opts.query } : {},
+      ...opts.refreshReference !== void 0 ? { refreshReference: opts.refreshReference } : {},
+      ...opts.refreshAt ? { refreshAt: opts.refreshAt } : {}
+    }
   };
 };
-var sanitizeFreeText = (text, redactor) => {
-  if (!text) return text;
-  let result = redactor ? redactor.redact(text) : text;
-  result = result.replace(
-    HTTP_AUTH_SCHEME_PATTERN,
-    (_match, scheme) => `${scheme} ${REDACTED_VALUE}`
-  );
-  for (let pattern of KNOWN_SECRET_VALUE_PATTERNS) {
-    result = result.replace(pattern, REDACTED_VALUE);
+var createBase64Attachment = (content, mimeType, attachmentHash) => ({
+  mimeType,
+  attachmentHash,
+  content: {
+    type: "content",
+    encoding: "base64",
+    content
   }
-  result = result.replace(
-    GENERIC_KEY_VALUE_PATTERN,
-    (match, key, equals, _value) => isUrlFormSecretKeyName(key) ? `${key}${equals}${REDACTED_VALUE}` : match
-  );
-  result = result.replace(
-    GENERIC_JSON_KEY_VALUE_PATTERN,
-    (match, key, colon, _value) => isSecretKeyName(key) ? `"${key}"${colon}"${REDACTED_VALUE}"` : match
-  );
-  return result;
-};
-var sanitizeScalar = (value, redactor) => truncateText(sanitizeFreeText(value, redactor));
-var redactStructuredValue = (value, depth = 0, redactor) => {
-  if (value == null) return value;
-  if (depth >= STRUCTURED_DEPTH_LIMIT) return "[truncated]";
-  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return typeof value === "string" ? sanitizeFreeText(value, redactor) : value;
+});
+var createTextAttachment = (content, mimeType, attachmentHash) => ({
+  mimeType,
+  attachmentHash,
+  content: {
+    type: "content",
+    encoding: "utf-8",
+    content
+  }
+});
+
+// src/action/directUpload.ts
+var bufferAttachmentBody = async (body, maxSizeBytes) => {
+  if (body instanceof Uint8Array) {
+    if (body.byteLength > maxSizeBytes) {
+      throw new Error(`Attachment exceeds the maximum size of ${maxSizeBytes} bytes`);
+    }
+    let buffered2 = new ArrayBuffer(body.byteLength);
+    new Uint8Array(buffered2).set(body);
+    return buffered2;
   }
-  if (Array.isArray(value)) {
-    return value.slice(0, STRUCTURED_ENTRY_LIMIT).map((entry) => redactStructuredValue(entry, depth + 1, redactor));
+  let reader = body.getReader();
+  let chunks = [];
+  let sizeBytes = 0;
+  while (true) {
+    let { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    sizeBytes += value.byteLength;
+    if (sizeBytes > maxSizeBytes) {
+      await reader.cancel();
+      throw new Error(`Attachment exceeds the maximum size of ${maxSizeBytes} bytes`);
+    }
+    chunks.push(value);
   }
-  if (isRecord2(value)) {
-    return Object.fromEntries(
-      Object.entries(value).slice(0, STRUCTURED_ENTRY_LIMIT).map(([key, entry]) => [
-        key,
-        isSecretKeyName(key) ? REDACTED_VALUE : redactStructuredValue(entry, depth + 1, redactor)
-      ])
-    );
+  let buffered = new ArrayBuffer(sizeBytes);
+  let bufferedView = new Uint8Array(buffered);
+  let offset = 0;
+  for (let chunk of chunks) {
+    bufferedView.set(chunk, offset);
+    offset += chunk.byteLength;
   }
-  return String(value);
+  return buffered;
 };
-var maybeParseJson = (text, contentType) => {
-  let trimmed = text.trim();
-  if (!trimmed) return null;
-  if (!contentType?.includes("json") && !/^[[{]/.test(trimmed)) {
-    return null;
+var uploadAttachmentDirect = async (d) => {
+  let baseUrl = d.live.baseUrl.replace(/\/$/, "");
+  let body = await bufferAttachmentBody(d.body, d.live.maxAttachmentSizeBytes);
+  let registerRes = await fetch(`${baseUrl}/slates-hub/live-invocation/attachments`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${d.live.token}`
+    },
+    body: JSON.stringify({
+      attachments: [
+        {
+          mimeType: d.mimeType,
+          filename: d.filename,
+          sizeBytes: body.byteLength || void 0
+        }
+      ]
+    })
+  });
+  if (!registerRes.ok) {
+    throw new Error(
+      `Failed to register attachment for direct upload (status ${registerRes.status})`
+    );
   }
-  try {
-    return JSON.parse(trimmed);
-  } catch {
-    return null;
+  let { attachments } = await registerRes.json();
+  let registration = attachments[0];
+  if (!registration) {
+    throw new Error("Live invocation API returned no attachment registrations");
+  }
+  let putRes = await fetch(registration.uploadUrl, {
+    method: "PUT",
+    headers: {
+      ...d.mimeType ? { "content-type": d.mimeType } : {},
+      "content-length": String(body.byteLength)
+    },
+    body
+  });
+  if (!putRes.ok) {
+    throw new Error(`Failed to upload attachment content (status ${putRes.status})`);
   }
-};
-var sanitizeTextBody = (text, contentType, redactor) => {
-  if (!text) return void 0;
-  let normalizedContentType = normalizeContentType(contentType);
-  let parsedJson = maybeParseJson(text, normalizedContentType);
-  let normalizedText = parsedJson !== null ? JSON.stringify(redactStructuredValue(parsedJson, 0, redactor)) : sanitizeFreeText(text, redactor);
-  let { text: truncatedText, truncated } = truncateText(normalizedText);
   return {
-    ...normalizedContentType ? { contentType: normalizedContentType } : {},
-    text: truncatedText,
-    ...truncated ? { truncated: true } : {}
+    mimeType: d.mimeType,
+    content: { type: "upload_reference", referenceId: registration.referenceId }
   };
 };
-var isBinaryLike = (value) => {
-  if (typeof Buffer !== "undefined" && Buffer.isBuffer(value)) return true;
-  if (value instanceof ArrayBuffer) return true;
-  if (ArrayBuffer.isView(value)) return true;
-  if (typeof Blob !== "undefined" && value instanceof Blob) return true;
-  if (typeof FormData !== "undefined" && value instanceof FormData) return true;
-  return false;
-};
-var serializeTextBody = (value, contentType, redactor) => {
-  let normalizedContentType = normalizeContentType(contentType);
-  if (value == null || isBinaryLike(value) || !isTextContentType(normalizedContentType)) {
-    return void 0;
+
+// src/adapter/adapter.ts
+var SlateAdapter = class {
+  constructor(_spec, _tools, _triggers) {
+    this._spec = _spec;
+    this._tools = _tools;
+    this._triggers = _triggers;
   }
-  if (typeof value === "string") {
-    return sanitizeTextBody(value, normalizedContentType, redactor);
+  _spec;
+  _tools;
+  _triggers;
+  get spec() {
+    return this._spec;
   }
-  if (value instanceof URLSearchParams) {
-    return sanitizeTextBody(value.toString(), normalizedContentType, redactor);
+  get id() {
+    return this._spec.id;
   }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return sanitizeTextBody(String(value), normalizedContentType, redactor);
+  get name() {
+    return this._spec.name;
   }
-  if (Array.isArray(value) || isRecord2(value)) {
-    return sanitizeTextBody(
-      JSON.stringify(redactStructuredValue(value, 0, redactor)),
-      "application/json",
-      redactor
-    );
+  get capabilities() {
+    return this._spec.capabilities;
   }
-  return void 0;
-};
-var buildUrl = (baseURL, url) => {
-  if (!url) return "";
-  if (!baseURL) return url;
-  try {
-    return new URL(url, baseURL).toString();
-  } catch {
-    return url;
+  get tools() {
+    return this._tools;
+  }
+  get triggers() {
+    return this._triggers;
+  }
+  get actions() {
+    return [...this._triggers, ...this._tools];
   }
 };
-var REDACTED_ENCODED = encodeURIComponent(REDACTED_VALUE);
-var decodeRedactedMarker = (value) => REDACTED_ENCODED === REDACTED_VALUE ? value : value.split(REDACTED_ENCODED).join(REDACTED_VALUE);
-var redactHashFragment = (hash, redactor) => {
-  if (!hash?.includes("=")) return hash;
-  let withoutHash = hash.startsWith("#") ? hash.slice(1) : hash;
-  let redacted = withoutHash.replace(
-    /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)=([^&]*)/g,
-    (match, key, rawValue) => {
-      if (isUrlFormSecretKeyName(key)) return `${key}=${REDACTED_VALUE}`;
-      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
-      return literalRedacted !== rawValue ? `${key}=${literalRedacted}` : match;
+
+// src/adapter/spec.ts
+var SlateAdapterSpec = class _SlateAdapterSpec {
+  constructor(_params) {
+    this._params = _params;
+  }
+  _params;
+  static create(params) {
+    let id = params.id?.trim();
+    let name = params.name?.trim();
+    if (!id) {
+      throw new SlateDeclarationError("Adapter id must be a non-empty string");
     }
-  );
-  return redacted ? `#${redacted}` : "";
-};
-var sanitizeUrl = (value, redactor) => {
-  if (!value) return value;
-  try {
-    let url = new URL(value);
-    if (url.username || url.password) {
-      url.username = "";
-      url.password = "";
+    if (!name) {
+      throw new SlateDeclarationError("Adapter name must be a non-empty string");
     }
-    for (let key of Array.from(url.searchParams.keys())) {
-      if (isUrlFormSecretKeyName(key)) {
-        url.searchParams.set(key, REDACTED_VALUE);
-        continue;
+    return new _SlateAdapterSpec({
+      id,
+      name,
+      capabilities: validateCapabilities(params.capabilities ?? [])
+    });
+  }
+  get id() {
+    return this._params.id;
+  }
+  get name() {
+    return this._params.name;
+  }
+  get capabilities() {
+    return this._params.capabilities;
+  }
+  get parameters() {
+    return this._params;
+  }
+  tool(spec2, params) {
+    return SlateTool.create(spec2, this.linkAction(params));
+  }
+  publicTool(spec2, params) {
+    return SlatePublicTool.create(spec2, this.linkAction(params));
+  }
+  trigger(spec2, params) {
+    return SlateTrigger.create(spec2, this.linkAction(params));
+  }
+  register(params) {
+    let actions = [...params.tools, ...params.triggers];
+    let seenKeys = /* @__PURE__ */ new Set();
+    for (let action of actions) {
+      if (action.adapter && action.adapter !== this.id) {
+        throw new SlateDeclarationError(
+          `Action "${action.key}" is linked to adapter "${action.adapter}", not "${this.id}"`
+        );
       }
-      let rawValue = url.searchParams.get(key) ?? "";
-      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
-      if (literalRedacted !== rawValue) url.searchParams.set(key, literalRedacted);
+      if (!action.adapter) {
+        throw new SlateDeclarationError(
+          `Action "${action.key}" must be created with this adapter's tool(), publicTool(), or trigger() helpers`
+        );
+      }
+      if (seenKeys.has(action.key)) {
+        throw new SlateDeclarationError(
+          `Adapter "${this.id}" already has an action with key "${action.key}"`
+        );
+      }
+      seenKeys.add(action.key);
     }
-    url.hash = redactHashFragment(url.hash, redactor);
-    return decodeRedactedMarker(url.toString());
-  } catch {
-    let text = redactor ? redactor.redact(value) : value;
-    return text.replace(
-      /([?&]([^=&#]+)=)([^&#]+)/g,
-      (_match, prefix, key, rawValue) => isUrlFormSecretKeyName(key) ? `${prefix}${REDACTED_VALUE}` : `${prefix}${rawValue}`
-    );
+    return new SlateAdapter(this, params.tools, params.triggers);
+  }
+  linkAction(params) {
+    if (params.adapter != null && params.adapter !== this.id) {
+      throw new SlateDeclarationError(
+        `Action "${params.key}" cannot be linked to adapter "${this.id}" because it is already linked to "${params.adapter}"`
+      );
+    }
+    return {
+      ...params,
+      adapter: this.id
+    };
   }
 };
-var flattenHeaderValue = (value) => {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  if (Array.isArray(value)) {
-    let normalized = value.map((entry) => flattenHeaderValue(entry)).filter((entry) => typeof entry === "string" && entry.length > 0);
-    return normalized.length > 0 ? normalized.join(", ") : void 0;
-  }
-  return void 0;
+var adapterSpec = (params) => SlateAdapterSpec.create(params);
+var validateCapabilities = (capabilities) => {
+  let seenIds = /* @__PURE__ */ new Set();
+  return capabilities.map((capability) => {
+    let id = capability.id?.trim();
+    if (!id) {
+      throw new SlateDeclarationError("Adapter capability ids must be non-empty strings");
+    }
+    if (seenIds.has(id)) {
+      throw new SlateDeclarationError(`Adapter capability "${id}" is defined more than once`);
+    }
+    seenIds.add(id);
+    return {
+      id,
+      value: capability.value
+    };
+  });
 };
-var headerEntries = (headers) => {
-  if (!headers) return [];
-  if (typeof headers.toJSON === "function") {
-    let json = headers.toJSON();
-    if (isRecord2(json)) {
-      return Object.entries(json).map(([key, value]) => {
-        let flattened = flattenHeaderValue(value);
-        return flattened ? [key, flattened] : null;
-      }).filter((entry) => entry !== null);
+
+// src/auth/auth.ts
+var SlateAuth = class _SlateAuth {
+  #outputSchema = null;
+  #authStack = [];
+  constructor() {
+  }
+  static create() {
+    return new _SlateAuth();
+  }
+  output(schema) {
+    this.#outputSchema = schema;
+    return this;
+  }
+  addAuth(auth2) {
+    let existingKeys = this.#authStack.map((a) => a.key);
+    if (existingKeys.includes(auth2.key)) {
+      throw new Error(`Auth with key "${auth2.key}" already exists in the auth stack`);
     }
+    this.#authStack.push(auth2);
+    return this;
   }
-  if (typeof headers.entries === "function") {
-    return Array.from(
-      headers.entries()
-    ).map(([key, value]) => [key, value]);
+  addOauth(auth2) {
+    this.addAuth(auth2);
+    return this;
   }
-  if (isRecord2(headers)) {
-    return Object.entries(headers).map(([key, value]) => {
-      let flattened = flattenHeaderValue(value);
-      return flattened ? [key, flattened] : null;
-    }).filter((entry) => entry !== null);
+  addTokenAuth(auth2) {
+    this.addAuth(auth2);
+    return this;
   }
-  return [];
-};
-var sanitizeHeaders = (headers, redactor) => {
-  let entries = headerEntries(headers).map(
-    ([key, value]) => [key.toLowerCase(), sanitizeScalar(value, redactor).text]
-  ).filter(([key]) => isSafeHeaderName(key));
-  if (entries.length === 0) return void 0;
-  return Object.fromEntries(entries);
-};
-var getContentType = (headers) => headerEntries(headers).find(([key]) => key.toLowerCase() === "content-type")?.[1];
-var takeTraceDraft = (config2) => {
-  if (!config2) return void 0;
-  let draft = config2.__slatesHttpTraceDraft ?? (isObjectLike(config2) ? traceDraftsByConfig.get(config2) : void 0) ?? (isObjectLike(config2.headers) ? traceDraftsByHeaders.get(config2.headers) : void 0);
-  if (!draft) return void 0;
-  return draft;
-};
-var clearTraceDraft = (config2, draft) => {
-  if (!config2) return;
-  if (config2.__slatesHttpTraceDraft === draft) {
-    config2.__slatesHttpTraceDraft = void 0;
+  addServiceAccountAuth(auth2) {
+    this.addAuth(auth2);
+    return this;
   }
-  if (isObjectLike(config2)) {
-    traceDraftsByConfig.delete(config2);
+  addCustomAuth(auth2) {
+    this.addAuth(auth2);
+    return this;
   }
-  if (isObjectLike(config2.headers)) {
-    traceDraftsByHeaders.delete(config2.headers);
+  addNone() {
+    this.addAuth({
+      type: "auth.none",
+      name: "No Authentication",
+      key: "none"
+    });
+    return this;
+  }
+  get authStack() {
+    return this.#authStack.filter((a) => a.type !== "auth.none");
+  }
+  get outputSchema() {
+    if (!this.#outputSchema) {
+      throw new Error("Output schema is not defined for this auth");
+    }
+    return this.#outputSchema;
   }
 };
-var attachHttpTraceDraft = (config2, context) => {
-  let traceAwareConfig = config2;
-  let contentType = getContentType(config2.headers);
-  let redactor = new AuthConfigSecretRedactor(context._getAuthConfigForRedaction());
-  traceAwareConfig.__slatesHttpTraceDraft = {
-    context,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    startedAtMs: Date.now(),
-    request: {
-      method: (config2.method ?? "GET").toUpperCase(),
-      url: sanitizeUrl(buildUrl(config2.baseURL, config2.url), redactor),
-      ...sanitizeHeaders(config2.headers, redactor) ? { headers: sanitizeHeaders(config2.headers, redactor) } : {},
-      ...serializeTextBody(config2.data, contentType, redactor) ? { body: serializeTextBody(config2.data, contentType, redactor) } : {}
+var auth = () => SlateAuth.create();
+
+// src/auth/oauth.ts
+var isOAuthTokenResponse = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var formatOAuthTokenResponseMessage = (fieldLabel, providerLabel = "OAuth provider", operation = "token response") => `${providerLabel} OAuth ${operation} did not return ${fieldLabel}.`;
+var getOAuthExpiresAtFromExpiresIn = (expiresIn, options = {}) => {
+  let {
+    nowMs = Date.now(),
+    providerLabel,
+    operation,
+    required = false,
+    expiresInType = "numberLike",
+    message
+  } = options;
+  if (expiresIn === void 0 || expiresIn === null || expiresIn === "") {
+    if (required) {
+      throw createApiServiceError(
+        message ?? formatOAuthTokenResponseMessage(
+          "a valid expires_in value",
+          providerLabel,
+          operation
+        ),
+        { reason: "oauth_token_response" }
+      );
     }
-  };
-  if (isObjectLike(traceAwareConfig)) {
-    traceDraftsByConfig.set(traceAwareConfig, traceAwareConfig.__slatesHttpTraceDraft);
+    return void 0;
   }
-  if (isObjectLike(traceAwareConfig.headers)) {
-    traceDraftsByHeaders.set(
-      traceAwareConfig.headers,
-      traceAwareConfig.__slatesHttpTraceDraft
+  let seconds = typeof expiresIn === "number" ? expiresIn : expiresInType === "numberLike" && typeof expiresIn === "string" ? Number(expiresIn) : Number.NaN;
+  if (!Number.isFinite(seconds)) {
+    throw createApiServiceError(
+      message ?? formatOAuthTokenResponseMessage("a valid expires_in value", providerLabel, operation),
+      { reason: "oauth_token_response" }
     );
   }
-  return config2;
+  return new Date(nowMs + seconds * 1e3).toISOString();
 };
-var recordHttpTraceFromResponse = (response) => {
-  let config2 = response.config;
-  let draft = takeTraceDraft(config2);
-  if (!draft) return response;
-  clearTraceDraft(config2, draft);
-  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
-  let contentType = getContentType(response.headers);
-  draft.context.recordHttpTrace({
-    startedAt: draft.startedAt,
-    durationMs: Math.max(Date.now() - draft.startedAtMs, 0),
-    request: draft.request,
-    response: {
-      status: response.status,
-      ...response.statusText ? { statusText: response.statusText } : {},
-      ...sanitizeHeaders(response.headers, redactor) ? { headers: sanitizeHeaders(response.headers, redactor) } : {},
-      ...serializeTextBody(response.data, contentType, redactor) ? { body: serializeTextBody(response.data, contentType, redactor) } : {}
+var getRefreshToken = (refreshToken, previousRefreshToken, fallbackMode) => {
+  if (typeof refreshToken === "string") {
+    if (fallbackMode === "falsy" && !refreshToken) {
+      return previousRefreshToken;
     }
-  });
-  return response;
+    return refreshToken;
+  }
+  if (fallbackMode === "falsy" && !refreshToken) {
+    return previousRefreshToken;
+  }
+  return refreshToken === void 0 || refreshToken === null ? previousRefreshToken : void 0;
 };
-var recordHttpTraceFromError = (error) => {
-  let config2 = error.config;
-  let draft = takeTraceDraft(config2);
-  if (!draft) return;
-  clearTraceDraft(config2, draft);
-  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
-  let responseContentType = getContentType(error.response?.headers);
-  draft.context.recordHttpTrace({
-    startedAt: draft.startedAt,
-    durationMs: Math.max(Date.now() - draft.startedAtMs, 0),
-    request: draft.request,
-    ...error.response ? {
-      response: {
-        status: error.response.status,
-        ...error.response.statusText ? { statusText: error.response.statusText } : {},
-        ...sanitizeHeaders(error.response.headers, redactor) ? { headers: sanitizeHeaders(error.response.headers, redactor) } : {},
-        ...serializeTextBody(error.response.data, responseContentType, redactor) ? { body: serializeTextBody(error.response.data, responseContentType, redactor) } : {}
-      }
-    } : {},
-    error: {
-      ...error.code ? { code: error.code } : {},
-      message: error.message
-    }
-  });
+var normalizeOAuthTokenResponse = (data, options = {}) => {
+  let {
+    providerLabel,
+    operation,
+    previousRefreshToken,
+    refreshTokenFallbackMode = "nullish",
+    accessTokenMessage,
+    expiresInMessage,
+    ...expiresAtOptions
+  } = options;
+  if (!isOAuthTokenResponse(data)) {
+    throw createApiServiceError(
+      accessTokenMessage ?? formatOAuthTokenResponseMessage("a token response object", providerLabel, operation),
+      { reason: "oauth_token_response" }
+    );
+  }
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw createApiServiceError(
+      accessTokenMessage ?? formatOAuthTokenResponseMessage("an access token", providerLabel, operation),
+      { reason: "oauth_token_response" }
+    );
+  }
+  return {
+    token: data.access_token,
+    refreshToken: getRefreshToken(
+      data.refresh_token,
+      previousRefreshToken,
+      refreshTokenFallbackMode
+    ),
+    expiresAt: getOAuthExpiresAtFromExpiresIn(data.expires_in, {
+      ...expiresAtOptions,
+      providerLabel,
+      operation,
+      message: expiresInMessage
+    })
+  };
 };
 
 // src/axios/index.ts
+import baseAxios, { getAdapter, isAxiosError as isAxiosError2 } from "axios";
 var applySlateInterceptors = (instance, errorMapping) => {
   instance.interceptors.request.use(
     (request) => {
@@ -2842,6 +3251,9 @@ var skipWebhook = (reason, response) => ({
   response: response ?? { status: 200, body: "" }
 });
 export {
+  API_ERROR_MAX_DETAILS,
+  API_ERROR_MAX_MESSAGE_LENGTH,
+  API_ERROR_TRUNCATED_PLACEHOLDER,
   AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX,
   AuthConfigSecretRedactor,
   GET_FILE_URL_TOOL_ID,
@@ -2880,8 +3292,10 @@ export {
   createSlateError,
   createTextAttachment,
   createUrlAttachment,
+  decodeApiErrorBody,
   extractApiErrorMessage,
   getApiErrorResponse,
+  getApiErrorResponseWithBody,
   getApiErrorStatus,
   getBase64ByteLength,
   getCurrentContext,
@@ -2898,6 +3312,8 @@ export {
   isApiErrorRecord,
   isAxiosErrorLike,
   isServiceErrorData,
+  isUrlEmbeddedCredential,
+  looksLikeHtmlErrorBody,
   mapServiceErrorCode,
   mapServiceErrorToSlateErrorInput,
   mergeScopes,
@@ -2905,6 +3321,8 @@ export {
   normalizeOAuthTokenResponse,
   pickDefined,
   publicTool,
+  pushBoundedApiErrorDetail,
+  readApiErrorText,
   redactUrlAttachmentSecrets,
   requestAxios,
   requestAxiosData,
@@ -2917,6 +3335,7 @@ export {
   tool,
   trigger,
   triggerGroup,
+  truncateApiErrorMessage,
   uploadAttachmentDirect,
   validateScopes,
   verifyHmacSignature